Options

HELP! url.urtbk.com Virus? Spyware? Trojan?

Unknown
edited September 2009 in Spyware & Virus Removal
Please Help!

I am operating XP SP2.

Yesterday afternoon, my pc began popping up internet explorer windows one after another filling up the screen faster than I could X them out. The links begin with "url.urtbk.com". I think I may have caught some type of virus. I've tried everything from McAfee to Malawarebytes Anti-malaware. They either start and then close after a few seconds, or they won't start at all. I've even tried in safe mode with no luck. Now my computer is slow. Practically can't do anything. I'm having trouble even getting it to process this post.

Please help ASAP!

Thanks in advance!!!!

Comments

  • chiazchiaz
    edited September 2009
    Hey there, welcome. :)

    Please download Malwarebytes' Anti-Malware by clicking the link below:
    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * You'll be required to post the contents of this log later.

    Please Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.



    Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include the MBAM log and C:\ComboFix.txt for further review, so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • KINNEY0201
    edited September 2009
    chiaz wrote:
    Hey there, welcome. :)

    Please download Malwarebytes' Anti-Malware by clicking the link below:
    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * You'll be required to post the contents of this log later.

    Please Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.



    Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include the MBAM log and C:\ComboFix.txt for further review, so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.


    Thank you for your willingness to help! Here are the logs that you requested:

    Malwarebytes' Anti-Malware 1.40
    Database version: 2737
    Windows 5.1.2600 Service Pack 2
    9/3/2009 5:38:12 PM
    mbam-log-2009-09-03 (17-38-12).txt
    Scan type: Quick Scan
    Objects scanned: 102568
    Time elapsed: 4 minute(s), 6 second(s)
    Memory Processes Infected: 0
    Memory Modules Infected: 4
    Registry Keys Infected: 4
    Registry Values Infected: 4
    Registry Data Items Infected: 5
    Folders Infected: 0
    Files Infected: 8
    Memory Processes Infected:
    (No malicious items detected)
    Memory Modules Infected:
    C:\WINDOWS\system32\fasapako.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\luyehije.dll (Trojan.Vundo.H) -> Delete on reboot.
    c:\WINDOWS\system32\werepolo.dll (Trojan.Vundo.H) -> Delete on reboot.
    c:\WINDOWS\system32\deporare.dll (Trojan.Vundo) -> Delete on reboot.
    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3958fe57-abb1-4b3c-874d-a6b354d1e86f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{3958fe57-abb1-4b3c-874d-a6b354d1e86f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3958fe57-abb1-4b3c-874d-a6b354d1e86f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{6f05cc67-ea03-401b-b007-d514e19aa4f0} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pumayidaja (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\merigijid (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{6f05cc67-ea03-401b-b007-d514e19aa4f0} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\remupasez (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\werepolo.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\werepolo.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: c:\windows\system32\deporare.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: system32\deporare.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    Folders Infected:
    (No malicious items detected)
    Files Infected:
    C:\WINDOWS\system32\luyehije.dll (Trojan.Vundo.H) -> Delete on reboot.
    c:\WINDOWS\system32\werepolo.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\fasapako.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\blyuwrjl.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\pvewnn.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\pejejuwu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\deporare.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\mebarepo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.


    ComboFix 09-09-03.02 - Owner 09/03/2009 17:48.4.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2037.1549 [GMT -4:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    .
    ((((((((((((((((((((((((( Files Created from 2009-08-03 to 2009-09-03 )))))))))))))))))))))))))))))))
    .
    2009-09-03 21:32 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-09-03 21:32 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-09-03 20:48 . 2009-09-03 20:57
    d-s---w- C:\kahdah
    2009-09-02 01:05 . 2009-09-02 01:05
    d
    w- c:\documents and settings\Owner\Application Data\Yahoo!
    2009-09-01 23:36 . 2009-09-01 23:36
    d
    w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-09-01 23:36 . 2009-09-01 23:36
    d
    w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
    2009-09-01 23:29 . 2009-09-01 23:29
    d
    w- c:\documents and settings\Administrator\Local Settings\Application Data\toaster
    2009-09-01 23:25 . 2009-09-01 23:25
    d
    w- c:\documents and settings\Administrator\Application Data\Yahoo!
    2009-09-01 23:25 . 2009-09-02 01:07
    d
    w- c:\program files\Yahoo!
    2009-09-01 21:27 . 2009-09-01 21:27
    d
    w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2009-09-01 21:18 . 2009-09-01 21:18
    d
    w- c:\program files\MBblah
    2009-09-01 21:16 . 2009-09-03 21:32
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-31 10:42 . 2009-08-31 10:42 73216 ----a-w- C:\jLg.exe
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-09-03 21:53 . 2009-04-12 16:26
    d
    w- c:\program files\Steam
    2009-09-03 20:50 . 2009-03-05 13:54
    d
    w- c:\windows\system32\config\systemprofile\Application Data\SampleView
    2009-09-02 20:39 . 2009-03-05 06:18
    d
    w- c:\documents and settings\All Users\Application Data\McAfee
    2009-09-02 20:39 . 2009-03-05 06:18
    d
    w- c:\program files\McAfee
    2009-09-01 23:22 . 2009-04-05 19:04 7912 ----a-w- c:\windows\system32\d3d9caps.dat
    2009-08-31 22:38 . 2009-04-26 19:31
    d
    w- c:\documents and settings\All Users\Application Data\DVD Shrink
    .
    Sigcheck
    [-] 2005-03-14 01:17 359936 6129E70F3D2F1E60860C930EBEAF92C2 c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
    [-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2gdr\tcpip.sys
    [-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2qfe\tcpip.sys
    [-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3gdr\tcpip.sys
    [-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3qfe\tcpip.sys
    [-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\tcpip.sys
    [-] 2005-03-14 00:55 359808 0E66B538096A6529D1AC66E78EB0D5C8 c:\windows\system32\drivers\tcpip.sys
    .
    ((((((((((((((((((((((((((((( SnapShot_2009-09-03_20.55.35 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-09-03 21:53 . 2009-09-03 21:53 16384 c:\windows\temp\Perflib_Perfdata_70c.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
    "Steam"="c:\program files\Steam\Steam.exe" [2009-06-13 1217784]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
    "SpybotSD TeaTimer"="c:\dvd programs\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "AOL Fast Start"="c:\program files\America Online 9.0\AOL.EXE" [2005-07-26 50776]
    "SUPERAntiSpyware"="c:\dvd programs\SUPERAntiSpyware.exe" [2009-08-05 1830128]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2007-01-22 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2007-01-22 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2007-01-22 114688]
    "HostManager"="c:\program files\Common Files\AOL\1236233593\ee\AOLSoftware.exe" [2006-03-10 48280]
    "readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-08-27 139264]
    "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 139264]
    "IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2005-10-28 8740864]
    "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-13 1121792]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]
    c:\documents and settings\Owner\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    WinZip Quick Pick.lnk - c:\dvd programs\WZQKPICK.EXE [2008-9-10 525664]
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\dvd programs\SASSEH.DLL" [2008-05-13 77824]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 16:05 356352 ----a-w- c:\dvd programs\SASWINLO.dll
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfehidk]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfehidk.sys]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mferkdk]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mferkdk.sys]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfetdik]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfetdik.sys]
    @=&quot;"
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
    "c:\\Program Files\\America Online 9.0\\waol.exe"=
    "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
    "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1236233593\\EE\\AOLServiceHost.exe"=
    "c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
    "c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\DVD PROGRAMS\\BitTornado\\btdownloadgui.exe"=
    "c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
    "c:\\WINDOWS\\system32\\spoolsv.exe"=
    "c:\\Program Files\\Intel Audio Studio\\IntelAudioStudio.exe"=
    R1 SASDIFSV;SASDIFSV;c:\dvd programs\sasdifsv.sys [8/5/2009 4:06 PM 9968]
    R1 SASKUTIL;SASKUTIL;c:\dvd programs\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
    R3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\drivers\PAC7302.SYS [4/12/2009 12:47 PM 457856]
    S3 SASENUM;SASENUM;c:\dvd programs\SASENUM.SYS [8/5/2009 4:06 PM 7408]
    --- Other Services/Drivers In Memory ---
    *NewlyCreated* - ATWPKT2
    *Deregistered* - ATWPKT2
    .
    Contents of the 'Scheduled Tasks' folder
    2009-09-03 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    2009-03-08 c:\windows\Tasks\ISP signup reminder 1.job
    - c:\windows\system32\OOBE\oobebaln.exe [2006-12-12 19:00]
    2009-03-16 c:\windows\Tasks\ISP signup reminder 2.job
    - c:\windows\system32\OOBE\oobebaln.exe [2006-12-12 19:00]
    2009-03-21 c:\windows\Tasks\ISP signup reminder 3.job
    - c:\windows\system32\OOBE\oobebaln.exe [2006-12-12 19:00]
    .
    - - - - ORPHANS REMOVED - - - -
    BHO-{3958fe57-abb1-4b3c-874d-a6b354d1e86f} - (no file)

    .
    Supplementary Scan
    .
    mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5064
    uInternet Connection Wizard,ShellNext = hxxp://clienturls.aol.com/safety/us/securitycenter/migration_asp2retired
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-09-03 17:53
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'winlogon.exe'(748)
    c:\dvd programs\SASWINLO.dll
    - - - - - - - > 'explorer.exe'(1956)
    c:\windows\system32\msi.dll
    .
    Other Running Processes
    .
    c:\program files\Common Files\AOL\ACS\AOLacsd.exe
    c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
    c:\program files\America Online 9.0\waol.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
    c:\windows\ehome\ehRecvr.exe
    c:\windows\ehome\ehSched.exe
    c:\program files\Common Files\AOL\1236233593\EE\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe
    c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    c:\windows\system32\wdfmgr.exe
    c:\program files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
    c:\windows\ehome\mcrdsvc.exe
    c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\windows\system32\dllhost.exe
    c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\ehome\ehmsas.exe
    c:\program files\America Online 9.0\shellmon.exe
    .
    **************************************************************************
    .
    Completion time: 2009-09-03 17:55 - machine was rebooted
    ComboFix-quarantined-files-A.txt 2009-09-03 20:57
    ComboFix-quarantined-files.txt 2009-09-03 21:55
    Pre-Run: 182,959,226,880 bytes free
    Post-Run: 182,678,945,792 bytes free
    193 --- E O F --- 2009-03-06 12:00
  • chiazchiaz
    edited September 2009
    Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
    It's IMPORTANT to carry out the instructions in the sequence listed below.
    1. Close any open browsers.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    Open *notepad* and copy/paste the text in the codebox below into it:
    Dirlook::
C:\kahdah
c:\program files\MBblah

File::
C:\jLg.exe


    Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.

    CFScript.gif
    Refering to the picture above, drag CFScript.txt into ComboFix.exe

    When finished, it shall produce a log for you at C:\ComboFix.txt
    Please copy and paste the ComboFix.txt in your next reply please. Also let me know how your PC is running now.

    *Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Altering this script in anyway could damage your computer.*
  • KINNEY0201
    edited September 2009
    chiaz wrote:
    Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
    It's IMPORTANT to carry out the instructions in the sequence listed below.
    1. Close any open browsers.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    Open *notepad* and copy/paste the text in the codebox below into it:
    Dirlook::
C:\kahdah
c:\program files\MBblah
 
File::
C:\jLg.exe


    Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.

    CFScript.gif
    Refering to the picture above, drag CFScript.txt into ComboFix.exe

    When finished, it shall produce a log for you at C:\ComboFix.txt
    Please copy and paste the ComboFix.txt in your next reply please. Also let me know how your PC is running now.

    *Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Altering this script in anyway could damage your computer.*


    To be honest, I'm not sure if it's running better or not. I haven't been browsing other than to reply to these posts in hopes of not further infecting my pc.

    Here is the log you requested:

    ComboFix 09-09-03.02 - Owner 09/04/2009 21:51.5.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2037.1544 [GMT -4:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
    FILE ::
    "C:\jLg.exe"
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    C:\jLg.exe
    .
    ((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 )))))))))))))))))))))))))))))))
    .
    2009-09-04 20:53 . 2009-09-04 20:53
    d
    w- c:\program files\ESET
    2009-09-03 21:32 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-09-03 21:32 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-09-03 20:48 . 2009-09-03 20:57
    d-s---w- C:\kahdah
    2009-09-02 01:05 . 2009-09-02 01:05
    d
    w- c:\documents and settings\Owner\Application Data\Yahoo!
    2009-09-01 23:36 . 2009-09-01 23:36
    d
    w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-09-01 23:36 . 2009-09-01 23:36
    d
    w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
    2009-09-01 23:29 . 2009-09-01 23:29
    d
    w- c:\documents and settings\Administrator\Local Settings\Application Data\toaster
    2009-09-01 23:25 . 2009-09-01 23:25
    d
    w- c:\documents and settings\Administrator\Application Data\Yahoo!
    2009-09-01 23:25 . 2009-09-02 01:07
    d
    w- c:\program files\Yahoo!
    2009-09-01 21:27 . 2009-09-01 21:27
    d
    w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2009-09-01 21:18 . 2009-09-01 21:18
    d
    w- c:\program files\MBblah
    2009-09-01 21:16 . 2009-09-03 21:32
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-09-04 20:48 . 2009-04-12 16:26
    d
    w- c:\program files\Steam
    2009-09-03 20:50 . 2009-03-05 13:54
    d
    w- c:\windows\system32\config\systemprofile\Application Data\SampleView
    2009-09-02 20:39 . 2009-03-05 06:18
    d
    w- c:\documents and settings\All Users\Application Data\McAfee
    2009-09-02 20:39 . 2009-03-05 06:18
    d
    w- c:\program files\McAfee
    2009-09-01 23:22 . 2009-04-05 19:04 7912 ----a-w- c:\windows\system32\d3d9caps.dat
    2009-08-31 22:38 . 2009-04-26 19:31
    d
    w- c:\documents and settings\All Users\Application Data\DVD Shrink
    .
    (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    ---- Directory of C:\kahdah ----

    ---- Directory of c:\program files\MBblah ----
    2009-09-01 21:18 . 2009-09-01 21:18 10498 ----a-w- c:\program files\MBblah\unins000.msg
    2009-09-01 21:18 . 2009-08-03 17:36 232720 ----a-w- c:\program files\MBblah\mbamservice.exe
    2009-09-01 21:18 . 2009-08-03 17:36 419088 ----a-w- c:\program files\MBblah\mbamgui.exe
    2009-09-01 21:18 . 2009-08-03 17:36 496912 ----a-w- c:\program files\MBblah\vbalsgrid6.ocx
    2009-09-01 21:18 . 2009-08-03 17:36 46352 ----a-w- c:\program files\MBblah\ssubtmr6.dll
    2009-09-01 21:18 . 2009-08-03 17:36 79632 ----a-w- c:\program files\MBblah\zlib.dll
    2009-09-01 21:18 . 2009-08-03 17:36 70928 ----a-w- c:\program files\MBblah\mbamext.dll
    2009-09-01 21:18 . 2009-08-03 17:36 1295632 ----a-w- c:\program files\MBblah\mbam.exe
    2009-09-01 21:18 . 2008-10-31 21:54 13097 ----a-w- c:\program files\MBblah\Languages\ukrainian.lng
    2009-09-01 21:18 . 2008-11-09 21:19 12175 ----a-w- c:\program files\MBblah\Languages\swedish.lng
    2009-09-01 21:18 . 2009-04-15 09:00 13808 ----a-w- c:\program files\MBblah\Languages\turkish.lng
    2009-09-01 21:18 . 2008-07-11 18:26 12876 ----a-w- c:\program files\MBblah\Languages\spanish.lng
    2009-09-01 21:18 . 2008-03-04 03:28 11205 ----a-w- c:\program files\MBblah\Languages\slovenian.lng
    2009-09-01 21:18 . 2008-03-03 10:03 12114 ----a-w- c:\program files\MBblah\Languages\serbian.lng
    2009-09-01 21:18 . 2008-07-26 13:58 11599 ----a-w- c:\program files\MBblah\Languages\slovak.lng
    2009-09-01 21:18 . 2008-07-04 04:58 11779 ----a-w- c:\program files\MBblah\Languages\russian.lng
    2009-09-01 21:18 . 2008-03-13 23:09 12672 ----a-w- c:\program files\MBblah\Languages\romanian.lng
    2009-09-01 21:18 . 2008-03-04 23:56 12245 ----a-w- c:\program files\MBblah\Languages\portugueseBR.lng
    2009-09-01 21:18 . 2008-06-15 17:04 12345 ----a-w- c:\program files\MBblah\Languages\portuguesePT.lng
    2009-09-01 21:18 . 2009-01-11 04:56 11623 ----a-w- c:\program files\MBblah\Languages\polish.lng
    2009-09-01 21:18 . 2009-06-10 17:39 11593 ----a-w- c:\program files\MBblah\Languages\norwegian.lng
    2009-09-01 21:18 . 2008-09-11 02:29 13314 ----a-w- c:\program files\MBblah\Languages\macedonian.lng
    2009-09-01 21:18 . 2009-07-23 23:46 9269 ----a-w- c:\program files\MBblah\Languages\korean.lng
    2009-09-01 21:18 . 2008-12-19 20:30 11457 ----a-w- c:\program files\MBblah\Languages\latvian.lng
    2009-09-01 21:18 . 2008-03-05 00:03 13019 ----a-w- c:\program files\MBblah\Languages\italian.lng
    2009-09-01 21:18 . 2008-03-03 21:39 12048 ----a-w- c:\program files\MBblah\Languages\hungarian.lng
    2009-09-01 21:18 . 2008-10-06 02:25 13557 ----a-w- c:\program files\MBblah\Languages\german.lng
    2009-09-01 21:18 . 2008-10-07 19:15 13234 ----a-w- c:\program files\MBblah\Languages\greek.lng
    2009-09-01 21:18 . 2008-03-04 23:57 13353 ----a-w- c:\program files\MBblah\Languages\french.lng
    2009-09-01 21:18 . 2008-05-17 14:09 11624 ----a-w- c:\program files\MBblah\Languages\finnish.lng
    2009-09-01 21:18 . 2009-07-31 13:20 11213 ----a-w- c:\program files\MBblah\Languages\estonian.lng
    2009-09-01 21:18 . 2008-03-02 23:33 11232 ----a-w- c:\program files\MBblah\Languages\english.lng
    2009-09-01 21:18 . 2009-02-18 00:27 11893 ----a-w- c:\program files\MBblah\Languages\danish.lng
    2009-09-01 21:18 . 2008-03-04 23:56 12255 ----a-w- c:\program files\MBblah\Languages\dutch.lng
    2009-09-01 21:18 . 2008-06-25 03:49 11551 ----a-w- c:\program files\MBblah\Languages\czech.lng
    2009-09-01 21:18 . 2008-12-27 20:41 11977 ----a-w- c:\program files\MBblah\Languages\croatian.lng
    2009-09-01 21:18 . 2008-08-01 13:03 8045 ----a-w- c:\program files\MBblah\Languages\chineseSI.lng
    2009-09-01 21:18 . 2008-08-04 16:58 8141 ----a-w- c:\program files\MBblah\Languages\chineseTR.lng
    2009-09-01 21:18 . 2008-03-05 00:05 12595 ----a-w- c:\program files\MBblah\Languages\catalan.lng
    2009-09-01 21:18 . 2009-01-17 00:08 12533 ----a-w- c:\program files\MBblah\Languages\bulgarian.lng
    2009-09-01 21:18 . 2009-08-01 20:14 12636 ----a-w- c:\program files\MBblah\Languages\bosnian.lng
    2009-09-01 21:18 . 2009-04-10 04:53 10331 ----a-w- c:\program files\MBblah\Languages\arabic.lng
    2009-09-01 21:18 . 2008-07-03 14:10 13924 ----a-w- c:\program files\MBblah\Languages\albanian.lng
    2009-09-01 21:18 . 2009-08-03 17:36 381712 ----a-w- c:\program files\MBblah\mbam-dor.exe
    2009-09-01 21:18 . 2009-08-03 17:36 91408 ----a-w- c:\program files\MBblah\mbam.dll
    2009-09-01 21:18 . 2009-08-01 19:26 15942 ----a-w- c:\program files\MBblah\changes.rtf
    2009-09-01 21:18 . 2009-01-04 23:31 4124 ----a-w- c:\program files\MBblah\license.txt
    2009-09-01 21:18 . 2009-07-30 19:27 59015 ----a-w- c:\program files\MBblah\mbam.chm
    2009-09-01 21:18 . 2009-09-01 21:18 8903 ----a-w- c:\program files\MBblah\unins000.dat
    2009-09-01 21:18 . 2009-09-01 21:17 692496 ----a-w- c:\program files\MBblah\unins000.exe
    Sigcheck
    [-] 2005-03-14 01:17 359936 6129E70F3D2F1E60860C930EBEAF92C2 c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
    [-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2gdr\tcpip.sys
    [-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp2qfe\tcpip.sys
    [-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3gdr\tcpip.sys
    [-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\sp3qfe\tcpip.sys
    [-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\tcpip.sys
    [-] 2005-03-14 00:55 359808 0E66B538096A6529D1AC66E78EB0D5C8 c:\windows\system32\drivers\tcpip.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
    "Steam"="c:\program files\Steam\Steam.exe" [2009-06-13 1217784]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
    "SpybotSD TeaTimer"="c:\dvd programs\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "AOL Fast Start"="c:\program files\America Online 9.0\AOL.EXE" [2005-07-26 50776]
    "SUPERAntiSpyware"="c:\dvd programs\SUPERAntiSpyware.exe" [2009-08-05 1830128]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2007-01-22 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2007-01-22 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2007-01-22 114688]
    "HostManager"="c:\program files\Common Files\AOL\1236233593\ee\AOLSoftware.exe" [2006-03-10 48280]
    "readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-08-27 139264]
    "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-12 139264]
    "IntelAudioStudio"="c:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2005-10-28 8740864]
    "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-13 1121792]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]
    c:\documents and settings\Owner\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    WinZip Quick Pick.lnk - c:\dvd programs\WZQKPICK.EXE [2008-9-10 525664]
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\dvd programs\SASSEH.DLL" [2008-05-13 77824]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 16:05 356352 ----a-w- c:\dvd programs\SASWINLO.dll
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfehidk]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfehidk.sys]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mferkdk]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mferkdk.sys]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfetdik]
    @=&quot;"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfetdik.sys]
    @=&quot;"
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
    "c:\\Program Files\\America Online 9.0\\waol.exe"=
    "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
    "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1236233593\\EE\\AOLServiceHost.exe"=
    "c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
    "c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\DVD PROGRAMS\\BitTornado\\btdownloadgui.exe"=
    "c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
    "c:\\WINDOWS\\system32\\spoolsv.exe"=
    "c:\\Program Files\\Intel Audio Studio\\IntelAudioStudio.exe"=
    R1 SASDIFSV;SASDIFSV;c:\dvd programs\sasdifsv.sys [8/5/2009 4:06 PM 9968]
    R1 SASKUTIL;SASKUTIL;c:\dvd programs\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
    R3 PAC7302;PAC7302 VGA USB Camera;c:\windows\system32\drivers\PAC7302.SYS [4/12/2009 12:47 PM 457856]
    S3 SASENUM;SASENUM;c:\dvd programs\SASENUM.SYS [8/5/2009 4:06 PM 7408]
    .
    Contents of the 'Scheduled Tasks' folder
    2009-09-03 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    2009-03-08 c:\windows\Tasks\ISP signup reminder 1.job
    - c:\windows\system32\OOBE\oobebaln.exe [2006-12-12 19:00]
    2009-03-16 c:\windows\Tasks\ISP signup reminder 2.job
    - c:\windows\system32\OOBE\oobebaln.exe [2006-12-12 19:00]
    2009-03-21 c:\windows\Tasks\ISP signup reminder 3.job
    - c:\windows\system32\OOBE\oobebaln.exe [2006-12-12 19:00]
    .
    - - - - ORPHANS REMOVED - - - -
    BHO-{3958fe57-abb1-4b3c-874d-a6b354d1e86f} - (no file)

    .
    Supplementary Scan
    .
    mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5064
    uInternet Connection Wizard,ShellNext = hxxp://clienturls.aol.com/safety/us/securitycenter/migration_asp2retired
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-09-04 21:54
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'winlogon.exe'(752)
    c:\dvd programs\SASWINLO.dll
    .
    Completion time: 2009-09-05 21:55
    ComboFix-quarantined-files-A.txt 2009-09-03 20:57
    ComboFix-quarantined-files.txt 2009-09-05 01:55
    ComboFix2.txt 2009-09-03 21:55
    Pre-Run: 182,511,636,480 bytes free
    Post-Run: 182,519,918,592 bytes free
    221 --- E O F --- 2009-03-06 12:00
  • chiazchiaz
    edited September 2009
    OK as a final scan let's have you go HERE to run Panda ActiveScan 2.0
    • Click the big green Scan now button
    • If it wants to install an ActiveX component allow it
    • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    • Once the scan is completed, please hit the notepad icon next to the text Export to:
    • Save it to a convenient location such as your Desktop
    • Post the contents of the ActiveScan.txt in your next reply.
  • KINNEY0201
    edited September 2009
    chiaz wrote:
    OK as a final scan let's have you go HERE to run Panda ActiveScan 2.0
    • Click the big green Scan now button
    • If it wants to install an ActiveX component allow it
    • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    • Once the scan is completed, please hit the notepad icon next to the text Export to:
    • Save it to a convenient location such as your Desktop
    • Post the contents of the ActiveScan.txt in your next reply.

    Here you go. I attached it instead of pasting it. When I pasted it was all distorted.
  • chiazchiaz
    edited September 2009
    Looks good to me.

    It's time to remove ComboFix.

    Go to to Start > Run
    Type in box

    combofix /u

    Note: the space between the X and the /u

    Press Enter.

    This command will:

    Delete the following:
    ComboFix and its associated files and folders.
    VundoFix backups, if present
    The C:\Deckard folder, if present
    The C:_OtMoveIt folder, if present

    Reset the clock settings.
    Hide file extensions, if required.
    Hide System/Hidden files, if required.
    Reset System Restore.


    Even if you have no more queries, I would appreciate if you can reply once more to this thread so that I will be able to have this archived. Thanks. :)
  • KINNEY0201
    edited September 2009
    chiaz wrote:
    Looks good to me.

    It's time to remove ComboFix.

    Go to to Start > Run
    Type in box

    combofix /u

    Note: the space between the X and the /u

    Press Enter.

    This command will:

    Delete the following:
    ComboFix and its associated files and folders.
    VundoFix backups, if present
    The C:\Deckard folder, if present
    The C:_OtMoveIt folder, if present

    Reset the clock settings.
    Hide file extensions, if required.
    Hide System/Hidden files, if required.
    Reset System Restore.


    Even if you have no more queries, I would appreciate if you can reply once more to this thread so that I will be able to have this archived. Thanks. :)


    Completed! Thank you very much for all of your help! :D
  • chiazchiaz
    edited September 2009
    Glad we could be of assistance! This topic is now closed.

    If I have helped you, please consider making a personal donation (Paypal) to me at parasite[AT]parasitedb.com.
    To support Icrontic, click here:
    http://icrontic.com/support
    Donations are entirely voluntary in nature and will have no bearing on the future help that you may receive.

    If you wish to reopen your topic, please send a Private Message (PM) to Trogan or me with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
Sign In or Register to comment.