I see that Viewpoint is installed. Viewpoint, Viewpoint Manager, Viewpoint Media Player are Viewpoint components which are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player's components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting Disable auto-updating for the Viewpoint Manager -- the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.
To provide a satisfying consumer experience and to operate effectively, the Viewpoint Media Player periodically sends information to servers at Viewpoint. Each installation of the Viewpoint Media Player is identifiable to Viewpoint via a Customer Unique Identifier (CUID), an alphanumeric identifier embedded in the Viewpoint Media Player. The Viewpoint Media Player randomly generates the CUID during installation and uses it to indicate a unique installation of the product. A CUID is never connected to a user's name, email address, or other personal contact information. CUIDs are used for the sole purpose of filtering redundant information. Each of these information exchanges occurs anonymously.
Viewpoint Manager is considered as foistware instead of malware since it is installed without user's approval but doesn't spy or do anything "bad". This may change, read Viewpoint to Plunge Into Adware.
I recommend that you remove the Viewpoint products; however, decide for yourself. To uninstall the the Viewpoint components (Viewpoint, Viewpoint Manager, Viewpoint Media Player):
Click Start, point to Settings, and then click Control Panel.
In Control Panel, double-click Add or Remove Programs.
In Add or Remove Programs, highlight >>Viewpoint component<< , click Remove.
Do the same for each Viewpoint component.
Restart your PC when you're done.
==========================
Now,
1. Delete CFScript.txt from your desktop.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open *notepad* and copy/paste the text in the quotebox below into it:
File::
C:\WINDOWS\system32\xmlparse.dll
Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.
Refering to the picture above, drag CFScript.txt into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt
Please copy and paste the ComboFix.txt in your next reply please. Also let me know whether you removed ViewPoint.
*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*
;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-09-03 15:30:04
PROTECTIONS: 0
MALWARE: 67
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00032745 adware/sahagent Adware No 0 Yes No c:\windows\downloaded program files\sporder_.dll
00047879 Adware/IST.ISTBar Adware No 1 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODUB0LYZ\image[1].0tm
00048250 Adware/IST.ISTBar Adware No 1 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZVLJ79OW\codec_v2[1].htm
00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\STU7W9AB\welcometoatlanta[1].htm
00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\W1YRC1UR\search[1].htm
00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WLKJ83GV\pageid=84816394[1].htm
00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WLKJ83GV\search[2].htm
00136827 Adware/SAHAgent Adware No 0 Yes No C:\WINDOWS\system32\xmltok.dll
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@trafficmp[2].txt
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@casalemedia[2].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@doubleclick[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@atdmt[1].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@247realmedia[2].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@fastclick[2].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@tribalfusion[1].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@mediaplex[2].txt
00148840 Cookie/Pollstar TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@pollstar[2].txt
00148914 Cookie/Tucows TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@tucows[1].txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@ccbill[1].txt
00152401 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@belnk[1].txt
00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@revenue[2].txt
00162730 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@dist.belnk[1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@com[1].txt
00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@yadro[2].txt
00167650 Cookie/GangbangSquad TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@gangbangsquad[1].txt
00167677 Cookie/WebPower TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@webpower[2].txt
00167690 Cookie/Rightmedia TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@rightmedia[2].txt
00167714 Cookie/64.62.232 TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@64.62.232[2].txt
00167738 Cookie/fe.lea.lycos TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@fe.lea.lycos[1].txt
00167744 Cookie/GoStats TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@gostats[1].txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@toplist[1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@statcounter[1].txt
00167761 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@counter8.sextracker[1].txt
00167776 Cookie/Kount TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@kount[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@ad.yieldmanager[1].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@apmebf[2].txt
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@burstnet[1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@serving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@bs.serving-sys[2].txt
00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@www.burstbeacon[2].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@adtech[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@advertising[1].txt
00169286 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@sextracker[2].txt
00170087 Cookie/Hbmediapro TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@adopt.hbmediapro[1].txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@statse.webtrendslive[2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@ads.pointroll[2].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@overture[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@questionmarket[1].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@zedo[2].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@bluestreak[2].txt
00173545 Cookie/Rn11 TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@rn11[2].txt
00173992 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@c5.zedo[1].txt
00184086 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@image.checkmystats.com[2].txt
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@adrevolver[2].txt
00186561 Cookie/Banner TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@banner[2].txt
00187951 Cookie/seeqA TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@www.seeq[2].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@go[1].txt
00196960 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@ath.belnk[2].txt
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@searchportal.information[1].txt
00207712 Cookie/360i TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@ct.360i[1].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@atwola[1].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@atwola[1].txt
00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@cgi-bin[1].txt
00590315 Rootkit/Agent.LNB HackTools No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP5\A0000293.sys
01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@enhance[2].txt
01281813 Adware/AntivirusXPPro Adware No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP1\A0000045.dll
01281813 Adware/AntivirusXPPro Adware No 0 Yes No C:\Qoobox\Quarantine\C\Documents and Settings\Mike\Application Data\Google\Shell32.dll.vir
01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@adserver.easyad[1].txt
01690516 Spyware/Virtumonde Spyware No 1 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_UAClvdwmxuhnkvoafd_.sys.zip[UAClvdwmxuhnkvoafd.sys]
02515974 Adware/PrivacyCenter Adware No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP5\A0000378.exe
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP0\A0000007.sys
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\WINDOWS\system32\xmlparse.dll
;===================================================================================================================================================================================
SUSPECTS
Sent Location p
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description p
;===================================================================================================================================================================================
212494 HIGH MS09-042 p
212493 HIGH MS09-041 p
212490 HIGH MS09-038 p
212530 HIGH MS09-034 p
211784 HIGH MS09-032 p
211781 HIGH MS09-029 p
210625 HIGH MS09-026 p
210624 HIGH MS09-025 p
210621 HIGH MS09-022 p
210618 HIGH MS09-019 p
208380 HIGH MS09-015 p
208379 HIGH MS09-014 p
208378 HIGH MS09-013 p
208377 HIGH MS09-012 p
206981 HIGH MS09-007 p
206980 HIGH MS09-006 p
204670 HIGH MS09-001 p
203806 HIGH MS08-078 p
203508 HIGH MS08-073 p
203505 HIGH MS08-071 p
202465 HIGH MS08-068 p
201683 HIGH MS08-067 p
201258 HIGH MS08-066 p
201256 HIGH MS08-064 p
201255 HIGH MS08-063 p
201253 HIGH MS08-061 p
201250 HIGH MS08-058 p
209275 HIGH MS08-049 p
209273 HIGH MS08-045 p
196455 MEDIUM MS08-037 p
194862 HIGH MS08-032 p
194861 HIGH MS08-031 p
194860 HIGH MS08-030 p
191618 HIGH MS08-025 p
191617 HIGH MS08-024 p
191616 HIGH MS08-023 p
191614 HIGH MS08-021 p
191613 HIGH MS08-020 p
187735 HIGH MS08-010 p
187733 HIGH MS08-008 p
184380 MEDIUM MS08-002 p
184379 MEDIUM MS08-001 p
;===================================================================================================================================================================================
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
c:\windows\downloaded program files\sporder_.dll
C:\WINDOWS\system32\xmltok.dll
C:\WINDOWS\system32\drivers\hhtioto.sys
C:\WINDOWS\system32\xmlparse.dll
Return to Killbox, go to the File menu, and choose Paste from Clipboard.
Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
Please reboot the computer, and post a new Panda ActiveScan log upon reboot.
Comments
I recommend that you remove the Viewpoint products; however, decide for yourself. To uninstall the the Viewpoint components (Viewpoint, Viewpoint Manager, Viewpoint Media Player):
==========================
Now,
1. Delete CFScript.txt from your desktop.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open *notepad* and copy/paste the text in the quotebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.
Refering to the picture above, drag CFScript.txt into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt
Please copy and paste the ComboFix.txt in your next reply please. Also let me know whether you removed ViewPoint.
*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.512.281 [GMT -7:00]
Running from: c:\documents and settings\Mike\Desktop\test.exe
Command switches used :: c:\documents and settings\Mike\Desktop\CFScript.txt
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2009-08-02 to 2009-09-02 )))))))))))))))))))))))))))))))
.
2009-08-29 01:40 . 2008-06-20 00:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-08-29 01:40 . 2009-08-29 01:40
d
w- c:\program files\Panda Security
2009-08-21 23:10 . 2009-08-21 23:10
d
w- c:\documents and settings\Mike\Application Data\Malwarebytes
2009-08-20 23:35 . 2009-08-03 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-20 23:35 . 2009-08-20 23:35
d
w- c:\program files\the program
2009-08-20 23:35 . 2009-08-20 23:35
d
w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-20 23:35 . 2009-08-03 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-19 04:57 . 2009-08-19 04:57
d
w- c:\program files\Trend Micro
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-29 01:39 . 2006-01-10 21:19
d
w- c:\documents and settings\Mike\Application Data\Corel
2009-08-29 01:38 . 2004-08-14 15:43
d
w- c:\documents and settings\Mike\Application Data\Ahead
2009-08-25 21:53 . 2005-01-13 03:40
d
w- c:\program files\Lexmark X1100 Series
2009-08-19 04:42 . 2009-05-26 19:01
d---a-w- c:\documents and settings\All Users\Application Data\TEMP
.
((((((((((((((((((((((((((((( [EMAIL="SnapShot@2009-08-21_22.53.26"]SnapShot@2009-08-21_22.53.26[/EMAIL] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-17 15:59 . 2009-04-17 15:59 128256 c:\windows\Downloaded Program Files\as2stubie.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
"PSDrvCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-02-23 377856]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-06 282624]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
c:\documents and settings\Mike\Start Menu\Programs\Startup\
CorelCENTRAL Alarms.LNK - c:\program files\Corel\WordPerfect Office 2000\programs\alarm.exe [2006-1-10 249856]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\WS_FTP Pro\\wsftppro.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [8/28/2009 6:40 PM 28544]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 1:44 PM 24652]
S3 ab3af53c-334c-4d2f-bfc0-ed6cf9421d00;ab3af53c-334c-4d2f-bfc0-ed6cf9421d00;\??\d:\cds300\cds300.dll --> d:\cds300\cds300.dll [?]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - PAVBOOT
.
.
Supplementary Scan
.
uStart Page = hxxp://www.google.ca/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: aol.com\free
DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} - hxxp://mlslink.mlxchange.com/Control/MultiSelectComboBox.cab
DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} - hxxp://mlslink.mlxchange.com/Control/MLXClientUtils.cab
DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} - hxxp://mlslink.mlxchange.com/4.2.04.18/Control/IRCSharc.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-01 18:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
- - - - - - - > 'winlogon.exe'(632)
c:\windows\system32\NavLogon.dll
.
Completion time: 2009-09-02 18:42
ComboFix-quarantined-files.txt 2009-09-02 01:42
ComboFix2.txt 2009-09-01 03:52
ComboFix3.txt 2009-08-30 01:09
ComboFix4.txt 2009-08-21 22:56
Pre-Run: 40,794,968,064 bytes free
Post-Run: 40,740,372,480 bytes free
99
;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-09-03 15:30:04
PROTECTIONS: 0
MALWARE: 67
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00032745 adware/sahagent Adware No 0 Yes No c:\windows\downloaded program files\sporder_.dll
00047879 Adware/IST.ISTBar Adware No 1 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODUB0LYZ\image[1].0tm
00048250 Adware/IST.ISTBar Adware No 1 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZVLJ79OW\codec_v2[1].htm
00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\STU7W9AB\welcometoatlanta[1].htm
00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\W1YRC1UR\search[1].htm
00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WLKJ83GV\pageid=84816394[1].htm
00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WLKJ83GV\search[2].htm
00136827 Adware/SAHAgent Adware No 0 Yes No C:\WINDOWS\system32\xmltok.dll
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@trafficmp[2].txt
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@casalemedia[2].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@doubleclick[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@atdmt[1].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@247realmedia[2].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@fastclick[2].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@tribalfusion[1].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@mediaplex[2].txt
00148840 Cookie/Pollstar TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@pollstar[2].txt
00148914 Cookie/Tucows TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@tucows[1].txt
00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@ccbill[1].txt
00152401 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@belnk[1].txt
00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@revenue[2].txt
00162730 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@dist.belnk[1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@com[1].txt
00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@yadro[2].txt
00167650 Cookie/GangbangSquad TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@gangbangsquad[1].txt
00167677 Cookie/WebPower TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@webpower[2].txt
00167690 Cookie/Rightmedia TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@rightmedia[2].txt
00167714 Cookie/64.62.232 TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@64.62.232[2].txt
00167738 Cookie/fe.lea.lycos TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@fe.lea.lycos[1].txt
00167744 Cookie/GoStats TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@gostats[1].txt
00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@toplist[1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@statcounter[1].txt
00167761 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@counter8.sextracker[1].txt
00167776 Cookie/Kount TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@kount[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@ad.yieldmanager[1].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@apmebf[2].txt
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@burstnet[1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@serving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@bs.serving-sys[2].txt
00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@www.burstbeacon[2].txt
00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@adtech[1].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@advertising[1].txt
00169286 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@sextracker[2].txt
00170087 Cookie/Hbmediapro TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@adopt.hbmediapro[1].txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@statse.webtrendslive[2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@ads.pointroll[2].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@overture[1].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@questionmarket[1].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@zedo[2].txt
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@bluestreak[2].txt
00173545 Cookie/Rn11 TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@rn11[2].txt
00173992 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@c5.zedo[1].txt
00184086 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@image.checkmystats.com[2].txt
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@adrevolver[2].txt
00186561 Cookie/Banner TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@banner[2].txt
00187951 Cookie/seeqA TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@www.seeq[2].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@go[1].txt
00196960 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@ath.belnk[2].txt
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@searchportal.information[1].txt
00207712 Cookie/360i TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@ct.360i[1].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@atwola[1].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@atwola[1].txt
00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@cgi-bin[1].txt
00590315 Rootkit/Agent.LNB HackTools No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP5\A0000293.sys
01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@enhance[2].txt
01281813 Adware/AntivirusXPPro Adware No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP1\A0000045.dll
01281813 Adware/AntivirusXPPro Adware No 0 Yes No C:\Qoobox\Quarantine\C\Documents and Settings\Mike\Application Data\Google\Shell32.dll.vir
01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@adserver.easyad[1].txt
01690516 Spyware/Virtumonde Spyware No 1 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_UAClvdwmxuhnkvoafd_.sys.zip[UAClvdwmxuhnkvoafd.sys]
02515974 Adware/PrivacyCenter Adware No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP5\A0000378.exe
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP0\A0000007.sys
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\WINDOWS\system32\xmlparse.dll
;===================================================================================================================================================================================
SUSPECTS
Sent Location p
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description p
;===================================================================================================================================================================================
212494 HIGH MS09-042 p
212493 HIGH MS09-041 p
212490 HIGH MS09-038 p
212530 HIGH MS09-034 p
211784 HIGH MS09-032 p
211781 HIGH MS09-029 p
210625 HIGH MS09-026 p
210624 HIGH MS09-025 p
210621 HIGH MS09-022 p
210618 HIGH MS09-019 p
208380 HIGH MS09-015 p
208379 HIGH MS09-014 p
208378 HIGH MS09-013 p
208377 HIGH MS09-012 p
206981 HIGH MS09-007 p
206980 HIGH MS09-006 p
204670 HIGH MS09-001 p
203806 HIGH MS08-078 p
203508 HIGH MS08-073 p
203505 HIGH MS08-071 p
202465 HIGH MS08-068 p
201683 HIGH MS08-067 p
201258 HIGH MS08-066 p
201256 HIGH MS08-064 p
201255 HIGH MS08-063 p
201253 HIGH MS08-061 p
201250 HIGH MS08-058 p
209275 HIGH MS08-049 p
209273 HIGH MS08-045 p
196455 MEDIUM MS08-037 p
194862 HIGH MS08-032 p
194861 HIGH MS08-031 p
194860 HIGH MS08-030 p
191618 HIGH MS08-025 p
191617 HIGH MS08-024 p
191616 HIGH MS08-023 p
191614 HIGH MS08-021 p
191613 HIGH MS08-020 p
187735 HIGH MS08-010 p
187733 HIGH MS08-008 p
184380 MEDIUM MS08-002 p
184379 MEDIUM MS08-001 p
;===================================================================================================================================================================================
Download KillBox from the following link :
http://www.bleepingcomputer.com/files/killbox.php
Unzip the folder to your Desktop.
- Please double-click Killbox.exe to run it.
- Select:
- Delete on Reboot
- then click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):- Return to Killbox, go to the File menu, and choose Paste from Clipboard.
- Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
Please reboot the computer, and post a new Panda ActiveScan log upon reboot.