Possible Sasser infection

SPIKE09SPIKE09 Scatland
edited August 2009 in Spyware & Virus Removal
PC in this case is a Q6600 running XP HOME SP3, It has been running fine until this morning when it was powered down. upon restart it got into a loop of windows needs to close the error code suggested a sasser infection and spysweeper trial version suggests also winvestigator is on the PC.
I had a similar problem last week with another system and in a fit of pique wiped it and loaded Mandriva. This system is more important and has all my steam games etc on it. :( the culprit it seem is an ext. hdd a muppet friend of a friend (ain't it always) who was a torrent queen, the ext hdd arrived described as broke , i scanned it and removed a fair few infections , but obviously not all.

edit/ ran a few more scans and it gets to xp desktop , and update#s PCtools AV and spybot sd etc but i now get an error in open office saying user K is already using OO :zombie:
edit2/ looks like this is a known bug according to the OO forums 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:30:05, on 19/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\spike\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Atari Launcher 2] C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Atari icon.exe
O4 - HKLM\..\Run: [AtariBanner] "C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Banner.exe" /0
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe"  /startintray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MCW Startup] "C:\Program Files\Monitor Calibration Wizard\MCW.exe" /s /p
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240060975328
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} (GameTap Web Updater) - http://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DeinoMPI process manager service (DeinoPM) - Deino Software - C:\Program Files\DeinoMPI\bin\DeinoPM.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: MPICH2 Process Manager, Argonne National Lab (mpich2_smpd) - Unknown owner - C:\Program Files\Folding@Home Windows SMP Client V1.01\smpd.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 6460 bytes

Comments

  • chiazchiaz
    edited August 2009
    Hey there. :)

    Please download Malwarebytes' Anti-Malware by clicking the link below:
    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * You'll be required to post the contents of this log later.

    Please Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.



    Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include the MBAM log, C:\ComboFix.txt as well as a new HijackThis log for further review, so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • SPIKE09SPIKE09 Scatland
    edited August 2009
    Hey thanks for looking I have already run MBAM last week after a thourough read of some threads here. Buggrit just had a series of crashes with error code 1073741819 :(
    Malwarebytes' Anti-Malware 1.40
Database version: 2655
Windows 5.1.2600 Service Pack 3
24/08/2009 07:08:51
mbam-log-2009-08-24 (07-08-51).txt
Scan type: Quick Scan
Objects scanned: 88227
Time elapsed: 12 minute(s), 24 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
  • chiazchiaz
    edited August 2009
    OK please carry on with ComboFix.
  • SPIKE09SPIKE09 Scatland
    edited August 2009
    interim MBAM full scan 
    Malwarebytes' Anti-Malware 1.40
Database version: 2700
Windows 5.1.2600 Service Pack 3
26/08/2009 23:47:26
mbam-log-2009-08-26 (23-47-26).txt
Scan type: Full Scan (C:\|)
Objects scanned: 214332
Time elapsed: 2 hour(s), 54 minute(s), 18 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
  • SPIKE09SPIKE09 Scatland
    edited August 2009
    combofix
    ]ComboFix 09-08-26.05 - spike 26/08/2009 23:58.1.4 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2047.1358 [GMT 1:00]
    Running from: c:\documents and settings\spike\Desktop\ComboFix.exe
    AV: PC Tools AntiVirus 6.0.0.19 *On-access scanning enabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98}
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\documents and settings\spike\Application Data\Microsoft\Internet Explorer\Quick Launch\PC Tools AntiVirus.lnk
    c:\documents and settings\spike\Desktop\Core Temp.exe
    .
    ((((((((((((((((((((((((( Files Created from 2009-07-26 to 2009-08-26 )))))))))))))))))))))))))))))))
    .
    2009-08-25 16:28 . 2009-08-25 16:36
    d
    w- c:\documents and settings\spike\Application Data\Mumble
    2009-08-25 16:28 . 2009-08-25 16:28
    d
    w- c:\program files\Mumble
    2009-08-19 20:01 . 2009-08-19 20:05
    d
    w- c:\windows\BDOSCAN8
    2009-08-19 14:21 . 2009-08-19 14:21
    d
    w- c:\documents and settings\spike\Application Data\Malwarebytes
    2009-08-19 14:21 . 2009-08-03 12:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-19 14:21 . 2009-08-19 14:21
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-08-19 14:21 . 2009-08-19 14:21
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-19 14:21 . 2009-08-03 12:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-19 14:11 . 2009-08-19 14:11
    d
    w- C:\Webroot
    2009-08-19 13:23 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
    2009-08-19 13:00 . 2009-08-19 13:00
    d
    w- c:\documents and settings\LocalService\Application Data\Webroot
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\documents and settings\NetworkService\Application Data\Webroot
    2009-08-19 10:45 . 2006-08-03 18:33 15360 ----a-w- c:\windows\system32\drivers\sshrmd.sys
    2009-08-19 10:45 . 2006-08-03 18:33 14848 ----a-w- c:\windows\system32\drivers\sskbfd.sys
    2009-08-19 10:45 . 2006-08-03 18:33 13824 ----a-w- c:\windows\system32\drivers\SSFS0509.sys
    2009-08-19 10:45 . 2006-08-03 18:33 117248 ----a-w- c:\windows\system32\drivers\ssidrv.sys
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\program files\Webroot
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\documents and settings\spike\Application Data\Webroot
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\documents and settings\All Users\Application Data\Webroot
    2009-08-12 21:04 . 2009-08-12 21:04
    d
    w- c:\documents and settings\spike\Application Data\Ventrilo
    2009-08-09 10:02 . 2009-08-09 10:02 54 ----a-w- c:\windows\system32\rp_stats.dat
    2009-08-09 10:02 . 2009-08-09 10:02 39 ----a-w- c:\windows\system32\rp_rules.dat
    2009-08-01 11:34 . 2009-08-01 11:34
    d
    w- c:\windows\system32\drivers\UMDF
    2009-08-01 11:34 . 2009-08-01 11:34
    d
    w- c:\windows\system32\LogFiles
    2009-07-29 04:37 . 2009-07-29 04:37 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
    2009-07-29 04:37 . 2009-07-29 04:37 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-26 22:52 . 2008-03-02 10:34
    d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-08-26 22:47 . 2008-08-27 11:37 127 ----a-w- c:\windows\popcinfot.dat
    2009-08-26 22:21 . 2008-07-30 22:20
    d
    w- c:\program files\Steam
    2009-08-26 19:32 . 2008-03-02 10:34
    d
    w- c:\program files\SpywareBlaster
    2009-08-26 19:30 . 2008-10-22 17:12
    d
    w- c:\program files\PC Tools AntiVirus
    2009-08-26 19:18 . 2009-08-26 19:20 2205696 ----a-w- c:\windows\Internet Logs\xDB10.tmp
    2009-08-26 19:12 . 2007-10-09 16:15 1005322 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
    2009-08-25 01:22 . 2007-06-26 15:32
    d
    w- c:\program files\Spybot - Search & Destroy
    2009-08-25 01:18 . 2009-08-25 01:23 2199040 ----a-w- c:\windows\Internet Logs\xDB9.tmp
    2009-08-23 22:41 . 2008-12-01 23:45
    d
    w- c:\program files\EMCO Malware Destroyer
    2009-08-23 22:34 . 2009-08-23 22:35 2198016 ----a-w- c:\windows\Internet Logs\xDB8.tmp
    2009-08-23 22:34 . 2009-08-23 22:35 122368 ----a-w- c:\windows\Internet Logs\xDB7.tmp
    2009-08-23 22:05 . 2009-08-23 22:28 2201088 ----a-w- c:\windows\Internet Logs\xDB34.tmp
    2009-08-23 10:56 . 2008-08-22 23:17
    d
    w- c:\documents and settings\spike\Application Data\uTorrent
    2009-08-19 11:39 . 2007-06-26 15:32
    d
    w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-08-19 07:05 . 2009-08-19 13:10 2170880 ----a-w- c:\windows\Internet Logs\xDBF.tmp
    2009-08-19 07:05 . 2009-08-19 13:10 3365376 ----a-w- c:\windows\Internet Logs\xDB6.tmp
    2009-08-19 07:04 . 2008-08-17 17:22
    d
    w- c:\documents and settings\spike\Application Data\OpenOffice.org2
    2009-08-06 19:32 . 2007-06-26 16:11
    d
    w- c:\documents and settings\spike\Application Data\dvdcss
    2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-07-29 04:37 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-07-29 04:37 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-07-23 18:05 . 2009-01-20 18:08
    d
    w- c:\program files\Common Files\PC Tools
    2009-07-20 20:23 . 2009-07-20 20:23
    d
    w- c:\program files\XIDER
    2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll
    2009-07-17 11:45 . 2009-07-17 12:13 2097664 ----a-w- c:\windows\Internet Logs\xDBE.tmp
    2009-07-12 11:21 . 2004-08-04 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-07-05 18:03 . 2008-09-21 20:44 1 ----a-w- c:\documents and settings\spike\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
    2009-06-29 16:12 . 2004-08-04 12:00 827392 ----a-w- c:\windows\system32\wininet.dll
    2009-06-29 16:12 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-29 16:12 . 2004-08-04 12:00 17408
    w- c:\windows\system32\corpol.dll
    2009-06-25 18:13 . 2009-06-25 18:14 2099712 ----a-w- c:\windows\Internet Logs\xDB5.tmp
    2009-06-25 08:25 . 2004-08-04 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
    2009-06-25 08:25 . 2004-08-04 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
    2009-06-25 08:25 . 2004-08-04 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
    2009-06-25 08:25 . 2004-08-04 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
    2009-06-25 08:25 . 2004-08-04 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
    2009-06-25 08:25 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
    2009-06-24 11:18 . 2004-08-04 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
    2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
    2009-06-10 08:19 . 2007-06-26 14:48 2066432 ----a-w- c:\windows\system32\mstscax.dll
    2009-06-10 06:14 . 2004-08-04 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
    2009-06-04 17:56 . 2009-06-04 18:00 2083328 ----a-w- c:\windows\Internet Logs\xDBC.tmp
    2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
    2009-05-31 17:52 . 2009-05-31 17:52 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
    2009-05-31 17:52 . 2009-04-19 18:02 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2006-02-23 07:16 . 2009-04-17 22:20 34048 ----a-w- c:\program files\mozilla firefox\plugins\upd62i9x.dll
    2006-02-23 07:16 . 2009-04-17 22:20 45056 ----a-w- c:\program files\mozilla firefox\plugins\upd62int.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
    2008-10-16 17:22 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar1.dll
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar1.dll" [2008-10-16 333192]
    [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
    [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar1.dll" [2008-10-16 333192]
    [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
    [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "Steam"="c:\program files\steam\steam.exe" [2009-06-10 1217784]
    "MCW Startup"="c:\program files\Monitor Calibration Wizard\MCW.exe" [2002-12-20 321024]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]
    "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-12 520024]
    "PCTAVApp"="c:\program files\PC Tools AntiVirus\PCTAV.exe" [2009-02-19 1374096]
    "SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2006-08-03 3909632]
    "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
    "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-09-12 16264192]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    c:\documents and settings\spike\Start Menu\Programs\Startup\
    PowerReg Scheduler.exe [2009-4-19 256000]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk /r \??\f:\0autocheck autochk *\0lsdelete
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @=&quot;Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
    @=&quot;Service"
    [HKLM\~\startupfolder\C:^Documents and Settings^spike^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk]
    path=c:\documents and settings\spike\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk
    backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\AeriaGames\\ProjectTorque\\ProjectTorque.bin"=
    "c:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForeverLauncher.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\peggle deluxe\\Peggle.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\peggle extreme\\PeggleExtreme.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\trials 2 second edition demo\\launcher.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\bioshock\\Builds\\Release\\Bioshock.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\bejeweled twist\\BejeweledTwist.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\peggle nights\\PeggleNights.exe"=
    "c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
    "c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament 2004\\System\\UT2004.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament\\System\\UnrealTournament.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/04/2009 18:52 64160]
    R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [23/07/2009 19:05 130936]
    R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [26/06/2007 16:01 11264]
    R2 DeinoPM;DeinoMPI process manager service;c:\program files\DeinoMPI\bin\DeinoPM.exe [17/01/2007 04:53 20480]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 1029456]
    R2 mpich2_smpd;MPICH2 Process Manager, Argonne National Lab;c:\program files\Folding@Home Windows SMP Client V1.01\smpd.exe [02/02/2008 14:14 1135616]
    R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\drivers\Amps2prt.sys [18/10/2008 19:48 14336]
    S3 cpuz130;cpuz130;\??\c:\docume~1\spike\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\spike\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
    S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [23/04/2007 14:54 83208]
    S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [23/04/2007 14:54 15112]
    S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [23/04/2007 14:54 108680]
    S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [23/04/2007 14:54 100488]
    S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [23/04/2007 14:54 98568]
    S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [01/02/2009 00:41 464264]
    --- Other Services/Drivers In Memory ---
    *Deregistered* - mchInjDrv
    .
    Contents of the 'Scheduled Tasks' folder
    2009-08-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 18:03]
    .
    - - - - ORPHANS REMOVED - - - -
    HKLM-Run-SpeedTouch USB Diagnostics - c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe

    .
    Supplementary Scan
    .
    LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
    DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
    DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
    FF - ProfilePath - c:\documents and settings\spike\Application Data\Mozilla\Firefox\Profiles\9xdxz0ya.default\
    FF - prefs.js: browser.startup.homepage - chrome://ietab/content/reloaded.html?url=hxxp://forum.micromart.co.uk/messages.aspx?ForumID=52|chrome://ietab/content/reloaded.html?url=http://icrontic.com/forum/index.php|http://foldingforum.org/index.php|http://fah-web.stanford.edu/cgi-bin/main.py?qtype=teampage&teamnum=46590|http://fah-web.stanford.edu/cgi-bin/main.py?qtype=userpage&username=SPIKE09|http://www.bbc.co.uk/iplayer/categories/?filter=category%3A100003&order=aztitle%3Aalphabetical|http://folding.extremeoverclocking.com/user_list.php?s=&t=46590|http://kakaostats.com/t.php?t=46590|about:blank|http://www.hardfolding.com/index.php?go=1000&tm=46590|http://www.google.co.uk/search?hl=en&safe=off&q=7zip&btnG=Search&meta=|http://forum.thedczone.com/index.php|http://fah-web.stanford.edu/psummary.html|http://kakaostats.com/t.php?t=93|chrome://ietab/content/reloaded.html?url=http://folding.extremeoverclocking.com/user_list.php?s=&a=1&t=93&p=1|http://fah-web.stanford.edu/serverstat.html|http://www.bbc.co.uk/
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\NPZoneSB.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-27 00:05
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'winlogon.exe'(776)
    c:\windows\system32\Ati2evxx.dll
    c:\windows\system32\WRLogonNTF.dll
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    - - - - - - - > 'lsass.exe'(832)
    c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    - - - - - - - > 'csrss.exe'(744)
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    .
    Completion time: 2009-08-26 0:08
    ComboFix-quarantined-files.txt 2009-08-26 23:08
    Pre-Run: 81,516,470,272 bytes free
    Post-Run: 81,576,706,048 bytes free
    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
    Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
    274
  • chiazchiaz
    edited August 2009
    There is a potentially unwanted piece of software detected on your PC called AskBar.

    More information here:
    http://www.antispyware.com/glossary_details.php?ID=2717

    We usually deem this optional to remove. You may do so by going to Control Panel > Add / Remove Programs and uninstalling it. Reboot your PC after uninstallation is complete.

    Then, navigate to the following directory and delete it if it is still present:
    c:\program files\AskBarDis


    ===========================================================


    Now download: CCleaner (freeware)
    http://www.majorgeeks.com/download4191.html
    Run the installer, and uncheck the option to install Yahoo toolbar (unless you want Yahoo toolbar).
    Once installed, run CCleaner click the Windows [tab]
    The following should be selected by default, if not, please select:
    CCleanerA.png
    Next: click Options click the Settings tab
    Uncheck: "Only delete files older than 48 hrs.", click Ok
    Then click Run Cleaner (bottom right) then Exit.


    ===========================================================


    Finally, please go to http://virusscan.jotti.org , click on Browse, and upload the following files for analysis: You will only be able to have one file scanned at a time.

    c:\windows\system32\rp_stats.dat
    c:\windows\system32\rp_rules.dat

    Then click Submit. Allow the files to be scanned individually, and then please Copy/Paste the results here for me to see, along with a new ComboFix log. Also let me know if you had removed Askbar.

    If Jotti is busy, please go to http://www.virustotal.com.
  • SPIKE09SPIKE09 Scatland
    edited August 2009
    Askbar isn't installed I believe its part of a freeware prog that give's you the option to install the ask jeeves toolbar. Updated CC from vers 1.28 126MB of crap cleaned.
    jotti results
    [HTMLhttp://virusscan.jotti.org/en/scanresult/27c26ff605260416cbb9f8f6f587536dc3501a51][/HTML]

    [HTMLhttp://virusscan.jotti.org/en/scanresult/fc04531978b334a3f477af447b2ea7ca3d09df37][/HTML]
  • SPIKE09SPIKE09 Scatland
    edited August 2009
    sorry missed your request to run combofix again

    edit removed the askbardis folder

    [code][ComboFix 09-08-26.05 - spike 27/08/2009 19:14.2.4 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2047.1260 [GMT 1:00]
    Running from: c:\documents and settings\spike\Desktop\ComboFix.exe
    AV: PC Tools AntiVirus 6.0.0.19 *On-access scanning enabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98}
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    .
    ((((((((((((((((((((((((( Files Created from 2009-07-27 to 2009-08-27 )))))))))))))))))))))))))))))))
    .
    2009-08-27 17:16 . 2009-08-27 17:16
    d
    w- c:\program files\CCleaner
    2009-08-25 16:28 . 2009-08-25 16:36
    d
    w- c:\documents and settings\spike\Application Data\Mumble
    2009-08-25 16:28 . 2009-08-25 16:28
    d
    w- c:\program files\Mumble
    2009-08-19 20:01 . 2009-08-19 20:05
    d
    w- c:\windows\BDOSCAN8
    2009-08-19 14:21 . 2009-08-19 14:21
    d
    w- c:\documents and settings\spike\Application Data\Malwarebytes
    2009-08-19 14:21 . 2009-08-03 12:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-19 14:21 . 2009-08-19 14:21
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-08-19 14:21 . 2009-08-19 14:21
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-19 14:21 . 2009-08-03 12:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-19 14:11 . 2009-08-19 14:11
    d
    w- C:\Webroot
    2009-08-19 13:23 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
    2009-08-19 13:00 . 2009-08-19 13:00
    d
    w- c:\documents and settings\LocalService\Application Data\Webroot
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\documents and settings\NetworkService\Application Data\Webroot
    2009-08-19 10:45 . 2006-08-03 18:33 15360 ----a-w- c:\windows\system32\drivers\sshrmd.sys
    2009-08-19 10:45 . 2006-08-03 18:33 14848 ----a-w- c:\windows\system32\drivers\sskbfd.sys
    2009-08-19 10:45 . 2006-08-03 18:33 13824 ----a-w- c:\windows\system32\drivers\SSFS0509.sys
    2009-08-19 10:45 . 2006-08-03 18:33 117248 ----a-w- c:\windows\system32\drivers\ssidrv.sys
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\program files\Webroot
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\documents and settings\spike\Application Data\Webroot
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\documents and settings\All Users\Application Data\Webroot
    2009-08-12 21:04 . 2009-08-12 21:04
    d
    w- c:\documents and settings\spike\Application Data\Ventrilo
    2009-08-09 10:02 . 2009-08-09 10:02 54 ----a-w- c:\windows\system32\rp_stats.dat
    2009-08-09 10:02 . 2009-08-09 10:02 39 ----a-w- c:\windows\system32\rp_rules.dat
    2009-08-01 11:34 . 2009-08-01 11:34
    d
    w- c:\windows\system32\drivers\UMDF
    2009-08-01 11:34 . 2009-08-01 11:34
    d
    w- c:\windows\system32\LogFiles
    2009-07-29 04:37 . 2009-07-29 04:37 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
    2009-07-29 04:37 . 2009-07-29 04:37 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-27 18:12 . 2008-03-02 10:34
    d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-08-27 18:07 . 2008-08-27 11:37 127 ----a-w- c:\windows\popcinfot.dat
    2009-08-27 17:37 . 2008-07-30 22:20
    d
    w- c:\program files\Steam
    2009-08-27 17:19 . 2008-03-02 10:34
    d
    w- c:\program files\SpywareBlaster
    2009-08-27 17:18 . 2007-06-26 15:32
    d
    w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-08-26 23:09 . 2008-10-22 17:12
    d
    w- c:\program files\PC Tools AntiVirus
    2009-08-26 19:18 . 2009-08-26 19:20 2205696 ----a-w- c:\windows\Internet Logs\xDB10.tmp
    2009-08-26 19:12 . 2007-10-09 16:15 1005322 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
    2009-08-25 01:22 . 2007-06-26 15:32
    d
    w- c:\program files\Spybot - Search & Destroy
    2009-08-25 01:18 . 2009-08-25 01:23 2199040 ----a-w- c:\windows\Internet Logs\xDB9.tmp
    2009-08-23 22:41 . 2008-12-01 23:45
    d
    w- c:\program files\EMCO Malware Destroyer
    2009-08-23 22:34 . 2009-08-23 22:35 2198016 ----a-w- c:\windows\Internet Logs\xDB8.tmp
    2009-08-23 22:34 . 2009-08-23 22:35 122368 ----a-w- c:\windows\Internet Logs\xDB7.tmp
    2009-08-23 22:05 . 2009-08-23 22:28 2201088 ----a-w- c:\windows\Internet Logs\xDB34.tmp
    2009-08-23 10:56 . 2008-08-22 23:17
    d
    w- c:\documents and settings\spike\Application Data\uTorrent
    2009-08-19 07:05 . 2009-08-19 13:10 2170880 ----a-w- c:\windows\Internet Logs\xDBF.tmp
    2009-08-19 07:05 . 2009-08-19 13:10 3365376 ----a-w- c:\windows\Internet Logs\xDB6.tmp
    2009-08-19 07:04 . 2008-08-17 17:22
    d
    w- c:\documents and settings\spike\Application Data\OpenOffice.org2
    2009-08-06 19:32 . 2007-06-26 16:11
    d
    w- c:\documents and settings\spike\Application Data\dvdcss
    2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-07-29 04:37 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-07-29 04:37 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-07-23 18:05 . 2009-01-20 18:08
    d
    w- c:\program files\Common Files\PC Tools
    2009-07-20 20:23 . 2009-07-20 20:23
    d
    w- c:\program files\XIDER
    2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll
    2009-07-17 11:45 . 2009-07-17 12:13 2097664 ----a-w- c:\windows\Internet Logs\xDBE.tmp
    2009-07-12 11:21 . 2004-08-04 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-07-05 18:03 . 2008-09-21 20:44 1 ----a-w- c:\documents and settings\spike\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
    2009-06-29 16:12 . 2004-08-04 12:00 827392
    w- c:\windows\system32\wininet.dll
    2009-06-29 16:12 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-29 16:12 . 2004-08-04 12:00 17408
    w- c:\windows\system32\corpol.dll
    2009-06-25 18:13 . 2009-06-25 18:14 2099712 ----a-w- c:\windows\Internet Logs\xDB5.tmp
    2009-06-25 08:25 . 2004-08-04 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
    2009-06-25 08:25 . 2004-08-04 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
    2009-06-25 08:25 . 2004-08-04 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
    2009-06-25 08:25 . 2004-08-04 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
    2009-06-25 08:25 . 2004-08-04 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
    2009-06-25 08:25 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
    2009-06-24 11:18 . 2004-08-04 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
    2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
    2009-06-10 08:19 . 2007-06-26 14:48 2066432 ----a-w- c:\windows\system32\mstscax.dll
    2009-06-10 06:14 . 2004-08-04 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
    2009-06-04 17:56 . 2009-06-04 18:00 2083328 ----a-w- c:\windows\Internet Logs\xDBC.tmp
    2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
    2009-05-31 17:52 . 2009-05-31 17:52 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
    2009-05-31 17:52 . 2009-04-19 18:02 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2006-02-23 07:16 . 2009-04-17 22:20 34048 ----a-w- c:\program files\mozilla firefox\plugins\upd62i9x.dll
    2006-02-23 07:16 . 2009-04-17 22:20 45056 ----a-w- c:\program files\mozilla firefox\plugins\upd62int.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "Steam"="c:\program files\steam\steam.exe" [2009-06-10 1217784]
    "MCW Startup"="c:\program files\Monitor Calibration Wizard\MCW.exe" [2002-12-20 321024]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]
    "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-12 520024]
    "PCTAVApp"="c:\program files\PC Tools AntiVirus\PCTAV.exe" [2009-02-19 1374096]
    "SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2006-08-03 3909632]
    "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
    "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-09-12 16264192]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    c:\documents and settings\spike\Start Menu\Programs\Startup\
    PowerReg Scheduler.exe [2009-4-19 256000]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk /r \??\f:\0autocheck autochk *\0lsdelete
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @=&quot;Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
    @=&quot;Service"
    [HKLM\~\startupfolder\C:^Documents and Settings^spike^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk]
    path=c:\documents and settings\spike\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk
    backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\AeriaGames\\ProjectTorque\\ProjectTorque.bin"=
    "c:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForeverLauncher.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\peggle deluxe\\Peggle.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\peggle extreme\\PeggleExtreme.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\trials 2 second edition demo\\launcher.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\bioshock\\Builds\\Release\\Bioshock.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\bejeweled twist\\BejeweledTwist.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\peggle nights\\PeggleNights.exe"=
    "c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
    "c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament 2004\\System\\UT2004.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament\\System\\UnrealTournament.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/04/2009 18:52 64160]
    R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [23/07/2009 19:05 130936]
    R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [26/06/2007 16:01 11264]
    R2 DeinoPM;DeinoMPI process manager service;c:\program files\DeinoMPI\bin\DeinoPM.exe [17/01/2007 04:53 20480]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 1029456]
    R2 mpich2_smpd;MPICH2 Process Manager, Argonne National Lab;c:\program files\Folding@Home Windows SMP Client V1.01\smpd.exe [02/02/2008 14:14 1135616]
    R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\drivers\Amps2prt.sys [18/10/2008 19:48 14336]
    S3 cpuz130;cpuz130;\??\c:\docume~1\spike\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\spike\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
    S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [23/04/2007 14:54 83208]
    S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [23/04/2007 14:54 15112]
    S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [23/04/2007 14:54 108680]
    S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [23/04/2007 14:54 100488]
    S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [23/04/2007 14:54 98568]
    S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe --> c:\program files\AskBarDis\bar\bin\AskService.exe [?]
    --- Other Services/Drivers In Memory ---
    *Deregistered* - mchInjDrv
    .
    Contents of the 'Scheduled Tasks' folder
    2009-08-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 18:03]
    .
    - - - - ORPHANS REMOVED - - - -
    BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\AskBarDis\bar\bin\askBar1.dll
    Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\AskBarDis\bar\bin\askBar1.dll
    WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar1.dll

    .
    Supplementary Scan
    .
    LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
    DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
    DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
    FF - ProfilePath - c:\documents and settings\spike\Application Data\Mozilla\Firefox\Profiles\9xdxz0ya.default\
    FF - prefs.js: browser.startup.homepage - chrome://ietab/content/reloaded.html?url=hxxp://forum.micromart.co.uk/messages.aspx?ForumID=52|chrome://ietab/content/reloaded.html?url=http://icrontic.com/forum/index.php|http://foldingforum.org/index.php|http://fah-web.stanford.edu/cgi-bin/main.py?qtype=teampage&teamnum=46590|http://fah-web.stanford.edu/cgi-bin/main.py?qtype=userpage&username=SPIKE09|http://www.bbc.co.uk/iplayer/categories/?filter=category:100003&amp;order=aztitle:alphabetical|http://folding.extremeoverclocking.com/user_list.php?s=&t=46590|http://kakaostats.com/t.php?t=46590|about:blank|http://www.hardfolding.com/index.php?go=1000&tm=46590|http://www.google.co.uk/search?hl=en&safe=off&q=7zip&btnG=Search&meta=|http://forum.thedczone.com/index.php|http://fah-web.stanford.edu/psummary.html|http://kakaostats.com/t.php?t=93|chrome://ietab/content/reloaded.html?url=http://folding.extremeoverclocking.com/user_list.php?s=&a=1&t=93&p=1|http://fah-web.stanford.edu/serverstat.html|http://www.bbc.co.uk/
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\NPZoneSB.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-27 19:21
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...

    c:\docume~1\spike\LOCALS~1\Temp\RGIB4.tmp 7075 bytes
    scan completed successfully
    hidden files: 1
    **************************************************************************
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'winlogon.exe'(776)
    c:\windows\system32\Ati2evxx.dll
    c:\windows\system32\WRLogonNTF.dll
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    - - - - - - - > 'lsass.exe'(832)
    c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    - - - - - - - > 'explorer.exe'(2184)
    c:\windows\system32\WININET.dll
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    - - - - - - - > 'csrss.exe'(744)
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    .
    Completion time: 2009-08-27 19:23
    ComboFix-quarantined-files.txt 2009-08-27 18:23
    ComboFix2.txt 2009-08-26 23:08
    Pre-Run: 81,622,745,088 bytes free
    Post-Run: 81,605,976,064 bytes free
    Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
    264
    /CODE]
  • chiazchiaz
    edited August 2009
    Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
    It's IMPORTANT to carry out the instructions in the sequence listed below.
    1. Close any open browsers.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    Open *notepad* and copy/paste the text in the codebox below into it:
    KILLALL::

Driver::
ASKService

File::
c:\documents and settings\spike\Local Settings\Temp\RGIB4.tmp


    Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.

    CFScript.gif
    Refering to the picture above, drag CFScript.txt into ComboFix.exe

    When finished, it shall produce a log for you at C:\ComboFix.txt
    Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please.

    *Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in anyway could damage your computer*
  • SPIKE09SPIKE09 Scatland
    edited August 2009
    combo2
    ComboFix 09-08-27.A3 - spike 28/08/2009 17:46.3.4 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2047.1428 [GMT 1:00]
    Running from: c:\documents and settings\spike\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\spike\Desktop\CFScript.txt
    AV: PC Tools AntiVirus 6.0.0.19 *On-access scanning enabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98}
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    * Created a new restore point
    .
    ((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-28 )))))))))))))))))))))))))))))))
    .
    2009-08-27 18:36 . 2009-08-27 18:36
    d
    w- c:\program files\AskBardis
    2009-08-27 17:16 . 2009-08-27 17:16
    d
    w- c:\program files\CCleaner
    2009-08-25 16:28 . 2009-08-25 16:36
    d
    w- c:\documents and settings\spike\Application Data\Mumble
    2009-08-25 16:28 . 2009-08-25 16:28
    d
    w- c:\program files\Mumble
    2009-08-19 20:01 . 2009-08-19 20:05
    d
    w- c:\windows\BDOSCAN8
    2009-08-19 14:21 . 2009-08-19 14:21
    d
    w- c:\documents and settings\spike\Application Data\Malwarebytes
    2009-08-19 14:21 . 2009-08-03 12:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-19 14:21 . 2009-08-19 14:21
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-08-19 14:21 . 2009-08-19 14:21
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-19 14:21 . 2009-08-03 12:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-19 14:11 . 2009-08-19 14:11
    d
    w- C:\Webroot
    2009-08-19 13:23 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
    2009-08-19 13:00 . 2009-08-19 13:00
    d
    w- c:\documents and settings\LocalService\Application Data\Webroot
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\documents and settings\NetworkService\Application Data\Webroot
    2009-08-19 10:45 . 2006-08-03 18:33 15360 ----a-w- c:\windows\system32\drivers\sshrmd.sys
    2009-08-19 10:45 . 2006-08-03 18:33 14848 ----a-w- c:\windows\system32\drivers\sskbfd.sys
    2009-08-19 10:45 . 2006-08-03 18:33 13824 ----a-w- c:\windows\system32\drivers\SSFS0509.sys
    2009-08-19 10:45 . 2006-08-03 18:33 117248 ----a-w- c:\windows\system32\drivers\ssidrv.sys
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\program files\Webroot
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\documents and settings\spike\Application Data\Webroot
    2009-08-19 10:45 . 2009-08-19 10:45
    d
    w- c:\documents and settings\All Users\Application Data\Webroot
    2009-08-12 21:04 . 2009-08-12 21:04
    d
    w- c:\documents and settings\spike\Application Data\Ventrilo
    2009-08-09 10:02 . 2009-08-09 10:02 54 ----a-w- c:\windows\system32\rp_stats.dat
    2009-08-09 10:02 . 2009-08-09 10:02 39 ----a-w- c:\windows\system32\rp_rules.dat
    2009-08-01 11:34 . 2009-08-01 11:34
    d
    w- c:\windows\system32\drivers\UMDF
    2009-08-01 11:34 . 2009-08-01 11:34
    d
    w- c:\windows\system32\LogFiles
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-28 16:37 . 2008-03-02 10:34
    d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-08-28 16:33 . 2008-08-22 23:17
    d
    w- c:\documents and settings\spike\Application Data\uTorrent
    2009-08-28 06:11 . 2008-07-30 22:20
    d
    w- c:\program files\Steam
    2009-08-27 22:45 . 2008-08-27 11:37 127 ----a-w- c:\windows\popcinfot.dat
    2009-08-27 18:35 . 2008-03-02 10:34
    d
    w- c:\program files\SpywareBlaster
    2009-08-27 18:32 . 2008-10-22 17:12
    d
    w- c:\program files\PC Tools AntiVirus
    2009-08-27 18:24 . 2007-06-26 15:32
    d
    w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-08-26 19:18 . 2009-08-26 19:20 2205696 ----a-w- c:\windows\Internet Logs\xDB10.tmp
    2009-08-26 19:12 . 2007-10-09 16:15 1005322 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
    2009-08-25 01:22 . 2007-06-26 15:32
    d
    w- c:\program files\Spybot - Search & Destroy
    2009-08-25 01:18 . 2009-08-25 01:23 2199040 ----a-w- c:\windows\Internet Logs\xDB9.tmp
    2009-08-23 22:41 . 2008-12-01 23:45
    d
    w- c:\program files\EMCO Malware Destroyer
    2009-08-23 22:34 . 2009-08-23 22:35 2198016 ----a-w- c:\windows\Internet Logs\xDB8.tmp
    2009-08-23 22:34 . 2009-08-23 22:35 122368 ----a-w- c:\windows\Internet Logs\xDB7.tmp
    2009-08-23 22:05 . 2009-08-23 22:28 2201088 ----a-w- c:\windows\Internet Logs\xDB34.tmp
    2009-08-19 07:05 . 2009-08-19 13:10 2170880 ----a-w- c:\windows\Internet Logs\xDBF.tmp
    2009-08-19 07:05 . 2009-08-19 13:10 3365376 ----a-w- c:\windows\Internet Logs\xDB6.tmp
    2009-08-19 07:04 . 2008-08-17 17:22
    d
    w- c:\documents and settings\spike\Application Data\OpenOffice.org2
    2009-08-06 19:32 . 2007-06-26 16:11
    d
    w- c:\documents and settings\spike\Application Data\dvdcss
    2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-07-29 04:37 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-07-29 04:37 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-07-23 18:05 . 2009-01-20 18:08
    d
    w- c:\program files\Common Files\PC Tools
    2009-07-20 20:23 . 2009-07-20 20:23
    d
    w- c:\program files\XIDER
    2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll
    2009-07-17 11:45 . 2009-07-17 12:13 2097664 ----a-w- c:\windows\Internet Logs\xDBE.tmp
    2009-07-12 11:21 . 2004-08-04 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-07-05 18:03 . 2008-09-21 20:44 1 ----a-w- c:\documents and settings\spike\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
    2009-06-29 16:12 . 2004-08-04 12:00 827392
    w- c:\windows\system32\wininet.dll
    2009-06-29 16:12 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-29 16:12 . 2004-08-04 12:00 17408
    w- c:\windows\system32\corpol.dll
    2009-06-25 18:13 . 2009-06-25 18:14 2099712 ----a-w- c:\windows\Internet Logs\xDB5.tmp
    2009-06-25 08:25 . 2004-08-04 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
    2009-06-25 08:25 . 2004-08-04 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
    2009-06-25 08:25 . 2004-08-04 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
    2009-06-25 08:25 . 2004-08-04 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
    2009-06-25 08:25 . 2004-08-04 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
    2009-06-25 08:25 . 2004-08-04 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
    2009-06-24 11:18 . 2004-08-04 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
    2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
    2009-06-10 08:19 . 2007-06-26 14:48 2066432 ----a-w- c:\windows\system32\mstscax.dll
    2009-06-10 06:14 . 2004-08-04 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
    2009-06-04 17:56 . 2009-06-04 18:00 2083328 ----a-w- c:\windows\Internet Logs\xDBC.tmp
    2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
    2009-05-31 17:52 . 2009-05-31 17:52 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
    2009-05-31 17:52 . 2009-04-19 18:02 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2006-02-23 07:16 . 2009-04-17 22:20 34048 ----a-w- c:\program files\mozilla firefox\plugins\upd62i9x.dll
    2006-02-23 07:16 . 2009-04-17 22:20 45056 ----a-w- c:\program files\mozilla firefox\plugins\upd62int.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "Steam"="c:\program files\steam\steam.exe" [2009-06-10 1217784]
    "MCW Startup"="c:\program files\Monitor Calibration Wizard\MCW.exe" [2002-12-20 321024]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]
    "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-12 520024]
    "PCTAVApp"="c:\program files\PC Tools AntiVirus\PCTAV.exe" [2009-02-19 1374096]
    "SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2006-08-03 3909632]
    "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
    "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-09-12 16264192]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "GrpConv"="grpconv -o" [X]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    c:\documents and settings\spike\Start Menu\Programs\Startup\
    PowerReg Scheduler.exe [2009-4-19 256000]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk /r \??\f:\0autocheck autochk *\0lsdelete
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @=&quot;Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
    @=&quot;Service"
    [HKLM\~\startupfolder\C:^Documents and Settings^spike^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk]
    path=c:\documents and settings\spike\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk
    backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\AeriaGames\\ProjectTorque\\ProjectTorque.bin"=
    "c:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForeverLauncher.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\peggle deluxe\\Peggle.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\peggle extreme\\PeggleExtreme.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\trials 2 second edition demo\\launcher.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\bioshock\\Builds\\Release\\Bioshock.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\bejeweled twist\\BejeweledTwist.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\peggle nights\\PeggleNights.exe"=
    "c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
    "c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament 2004\\System\\UT2004.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament\\System\\UnrealTournament.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/04/2009 18:52 64160]
    R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [23/07/2009 19:05 130936]
    R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [26/06/2007 16:01 11264]
    R2 DeinoPM;DeinoMPI process manager service;c:\program files\DeinoMPI\bin\DeinoPM.exe [17/01/2007 04:53 20480]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 1029456]
    R2 mpich2_smpd;MPICH2 Process Manager, Argonne National Lab;c:\program files\Folding@Home Windows SMP Client V1.01\smpd.exe [02/02/2008 14:14 1135616]
    R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\drivers\Amps2prt.sys [18/10/2008 19:48 14336]
    S3 cpuz130;cpuz130;\??\c:\docume~1\spike\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\spike\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
    S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [23/04/2007 14:54 83208]
    S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [23/04/2007 14:54 15112]
    S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [23/04/2007 14:54 108680]
    S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [23/04/2007 14:54 100488]
    S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [23/04/2007 14:54 98568]
    S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe --> c:\program files\AskBarDis\bar\bin\AskService.exe [?]
    --- Other Services/Drivers In Memory ---
    *Deregistered* - mchInjDrv
    .
    Contents of the 'Scheduled Tasks' folder
    2009-08-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 18:03]
    .
    - - - - ORPHANS REMOVED - - - -
    BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)

    .
    Supplementary Scan
    .
    LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
    DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
    DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
    FF - ProfilePath - c:\documents and settings\spike\Application Data\Mozilla\Firefox\Profiles\9xdxz0ya.default\
    FF - prefs.js: browser.startup.homepage - chrome://ietab/content/reloaded.html?url=hxxp://forum.micromart.co.uk/messages.aspx?ForumID=52|chrome://ietab/content/reloaded.html?url=http://icrontic.com/forum/index.php|http://foldingforum.org/index.php|http://fah-web.stanford.edu/cgi-bin/main.py?qtype=teampage&teamnum=46590|http://fah-web.stanford.edu/cgi-bin/main.py?qtype=userpage&username=SPIKE09|http://www.bbc.co.uk/iplayer/categories/?filter=category%3A100003&order=aztitle%3Aalphabetical|http://folding.extremeoverclocking.com/user_list.php?s=&t=46590|http://kakaostats.com/t.php?t=46590|about:blank|http://www.hardfolding.com/index.php?go=1000&tm=46590|http://www.google.co.uk/search?hl=en&safe=off&q=7zip&btnG=Search&meta=|http://forum.thedczone.com/index.php|http://fah-web.stanford.edu/psummary.html|http://kakaostats.com/t.php?t=93|chrome://ietab/content/reloaded.html?url=http://folding.extremeoverclocking.com/user_list.php?s=&a=1&t=93&p=1|http://fah-web.stanford.edu/serverstat.html|http://www.bbc.co.uk/
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\NPZoneSB.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
    c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-28 17:54
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'winlogon.exe'(776)
    c:\windows\system32\Ati2evxx.dll
    c:\windows\system32\WRLogonNTF.dll
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    - - - - - - - > 'lsass.exe'(832)
    c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    - - - - - - - > 'explorer.exe'(712)
    c:\windows\system32\WININET.dll
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    - - - - - - - > 'csrss.exe'(744)
    c:\program files\PC Tools AntiVirus\PCTAVHook.dll
    .
    Completion time: 2009-08-28 17:57
    ComboFix-quarantined-files.txt 2009-08-28 16:57
    ComboFix2.txt 2009-08-27 18:23
    ComboFix3.txt 2009-08-26 23:08
    Pre-Run: 81,040,601,088 bytes free
    Post-Run: 80,988,831,744 bytes free
    Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
    265
  • SPIKE09SPIKE09 Scatland
    edited August 2009
    hjt2
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:59:39, on 28/08/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\DeinoMPI\bin\DeinoPM.exe
    C:\Program Files\Folding@Home Windows SMP Client V1.01\smpd.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Monitor Calibration Wizard\MCW.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wbem\unsecapp.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Documents and Settings\spike\Desktop\HiJackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [WheelMouse] "C:\Program Files\A4Tech\Mouse\Amoumain.exe"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [Ad-Watch] "C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe"
    O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
    O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
    O4 - HKLM\..\RunOnce: [GrpConv] grpconv -o
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [MCW Startup] "C:\Program Files\Monitor Calibration Wizard\MCW.exe" /s /p
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240060975328
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} (GameTap Web Updater) - http://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: DeinoMPI process manager service (DeinoPM) - Deino Software - C:\Program Files\DeinoMPI\bin\DeinoPM.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: MPICH2 Process Manager, Argonne National Lab (mpich2_smpd) - Unknown owner - C:\Program Files\Folding@Home Windows SMP Client V1.01\smpd.exe
    O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    --
    End of file - 6686 bytes
  • chiazchiaz
    edited August 2009
    Can I know how your PC is running now?
  • SPIKE09SPIKE09 Scatland
    edited August 2009
    It seems to be running well snappy responsive etc etc
  • chiazchiaz
    edited August 2009
    I think our work is done here - your PC should be clean now.

    It's time to remove ComboFix.

    Go to to Start > Run
    Type in box

    combofix /u

    Note: the space between the X and the /u

    Press Enter.

    This command will:

    Delete the following:
    ComboFix and its associated files and folders.
    VundoFix backups, if present
    The C:\Deckard folder, if present
    The C:_OtMoveIt folder, if present

    Reset the clock settings.
    Hide file extensions, if required.
    Hide System/Hidden files, if required.
    Reset System Restore.


    Even if you have no more queries, I would appreciate if you can reply once more to this thread so that I will be able to have this archived. Thanks. :)
  • SPIKE09SPIKE09 Scatland
    edited August 2009
    TYVM for your time and patience Chiaz it is much appreciated :)
  • chiazchiaz
    edited August 2009
    Glad we could be of assistance! This topic is now closed.

    If I have helped you, please consider making a personal donation (Paypal) to me at parasite[AT]parasitedb.com.
    To support Icrontic, click here:
    http://icrontic.com/support
    Donations are entirely voluntary in nature and will have no bearing on the future help that you may receive.

    If you wish to reopen your topic, please send a Private Message (PM) to Trogan or me with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
Sign In or Register to comment.