Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
02-Feb-2010, 11:28 PM
#1 | |||||
| Skeptical of most recent scan |
| |
02-Feb-2010, 11:49 PM
#2 | ||||||
|
__________________ • Our help is free 'cause we like what we do, so at least, please reply in a timely manner... Thank you. • If we've solved your problem, please click on Mark Solved in the upper left corner of your thread. • How to Mark Your Own Thread as "Solved". |
03-Feb-2010, 08:56 PM
#6 | ||||||
| |
04-Feb-2010, 08:18 AM
#7 | |||||
| Hi, Melakward    Please download Malwarebytes' Anti-Malware from Here.Double Click mbam-setup.exe to install the application.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly. Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
04-Feb-2010, 09:17 PM
#9 | |||||
| Malwarebytes came up clean, but if it means anything, the full scan I did two days ago showed up the same thing. I can't thank you all enough for your help! The logs as requested: Malwarebytes' Anti-Malware 1.44 Database version: 3691 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.11 4/02/2010 7:08:24 PM mbam-log-2010-02-04 (19-08-24).txt Scan type: Quick Scan Objects scanned: 116553 Time elapsed: 6 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ComboFix 10-02-04.03 - Administrator 04/02/2010 19:30:59.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.1023.723 [GMT -5:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\fbk.sts c:\documents and settings\Administrator\My Documents\Backup.reg C:\LOGD9.tmp c:\program files\appatc~1 c:\program files\dns c:\program files\dns\affid.dat c:\program files\dns\uid.dat c:\program files\dns\urls.dat c:\program files\dns\version.txt c:\program files\outlook c:\program files\ymbols~1 c:\windows\scurit~1 c:\windows\system32\lo2.txtt c:\windows\system32\twain_32.dll c:\windows\system32\wnscptr.exe c:\windows\Tasks\pizrfzyb.job c:\windows\wiaserviv.log . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_WINDOWS_OVERLAY_COMPONENTS ((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 ))))))))))))))))))))))))))))))) . 2010-02-04 00:11 . 2010-02-04 00:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2010-02-04 00:11 . 2010-02-04 00:11 -------- d-----w- c:\program files\SUPERAntiSpyware 2010-02-04 00:11 . 2010-02-04 00:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2010-02-04 00:11 . 2010-02-04 00:11 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-01-28 00:08 . 2010-01-28 00:08 -------- d-----w- C:\21fa0eebb8ceacb04eeb 2010-01-26 13:36 . 2009-10-15 16:28 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll 2010-01-26 13:36 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll 2010-01-26 13:36 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll 2010-01-26 13:36 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe 2010-01-26 13:36 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll 2010-01-26 13:36 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll 2010-01-26 13:36 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe 2010-01-26 13:36 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll 2010-01-26 13:36 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll 2010-01-26 13:36 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll 2010-01-26 13:35 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll 2010-01-26 13:33 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2010-01-26 13:33 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-05 00:42 . 2009-11-18 02:11 -------- d-----w- c:\program files\Steam 2010-02-05 00:40 . 2009-04-21 23:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\WTablet 2010-02-05 00:20 . 2004-01-01 15:48 60216 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-02-04 00:18 . 2009-02-20 19:06 -------- d-----w- c:\program files\Yahoo! 2010-02-04 00:18 . 2006-04-28 19:48 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-02-04 00:12 . 2010-02-04 00:12 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-02-04 00:12 . 2010-02-04 00:12 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-02-04 00:08 . 2006-04-28 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-02-03 03:29 . 2006-05-03 18:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent 2010-01-26 04:19 . 2008-12-29 10:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-01-07 21:07 . 2008-12-29 10:56 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 21:07 . 2008-12-29 10:56 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-01-05 10:00 . 2003-09-02 10:30 832512 ----a-w- c:\windows\system32\wininet.dll 2010-01-05 10:00 . 2003-09-02 10:30 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-01-05 10:00 . 2003-09-02 10:30 17408 ----a-w- c:\windows\system32\corpol.dll 2009-12-11 01:12 . 2008-04-29 05:58 -------- d-----w- c:\documents and settings\Administrator\Application Data\iPhoneRingToneMaker 2009-11-21 15:51 . 2003-09-02 10:30 471552 ----a-w- c:\windows\AppPatch\aclayers.dll 2009-07-31 02:44 . 2009-07-30 07:00 31744 ----a-w- c:\program files\Common Files\alq.exe 1601-01-01 00:03 . 1601-01-01 00:03 52736 --sha-w- c:\windows\system32\dapavama.dll.tmp 1601-01-01 00:03 . 1601-01-01 00:03 52736 --sha-w- c:\windows\system32\nirepuna.dll.tmp 1601-01-01 00:03 . 1601-01-01 00:03 52736 --sha-w- c:\windows\system32\sohizaji.dll.tmp . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files\steam\steam.exe" [2009-11-18 1217808] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-01-05 2002160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\Shell ExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Weather.lnk] path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Weather.lnk backup=c:\windows\pss\Weather.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^gckro.exe] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\gckro.exe backup=c:\windows\pss\gckro.exeCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] ? ????? ??ź [?] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run] ? ????? ??ź [?] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] 2002-11-13 23:50 61440 ----a-w- c:\program files\AIM95\aim.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2009-05-14 00:58 177472 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Application Layer Gateway] 2009-07-31 02:44 31744 ----a-w- c:\program files\Common Files\alq.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA] 2006-02-22 00:05 344064 -c--a-w- c:\windows\system32\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPMonitor] 2009-04-20 15:10 84464 ----a-w- c:\program files\Roxio Creator 2009\5.0\CPMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] 2005-12-10 14:57 133016 -c--a-w- c:\program files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] 2009-04-29 17:55 3338240 ----a-w- c:\program files\Electronic Arts\EADM\Core.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint] 2006-07-07 23:15 600896 -c--a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-06-05 17:39 292136 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\itype] 2006-07-07 23:14 576320 -c--a-w- c:\program files\Microsoft IntelliType Pro\itype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] 2006-01-19 16:06 11776 ----a-w- c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] 2006-01-19 16:06 110592 ----a-w- c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2009-02-18 18:44 13680640 ----a-w- c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2009-02-18 18:44 86016 ----a-w- c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray] 2004-12-20 06:12 131072 -c--a-w- c:\program files\NVIDIA Corporation\NvMixer\NvMixerTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2009-02-18 18:44 1657376 ----a-w- c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-05-26 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray] 2008-08-14 05:23 240112 ----a-w- c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatchTray11.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2006-09-07 19:51 49263 -c--a-w- c:\program files\Java\jre1.5.0_09\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] 2006-03-30 20:45 313472 ----a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] 2004-11-11 04:15 111816 -c--a-w- c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2006-06-21 17:14 35328 -c--a-w- c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\AIM95\\aim.exe"= "c:\\Program Files\\uTorrent\\utorrent.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\StubInstaller.exe"= "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI\\RpcSandraSrv.exe"= "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI\\Win32\\RpcDataSrv.exe"= "c:\\Program Files\\Motorola\\RSD Lite\\SDL.exe"= "c:\\Program Files\\Gaim\\gaim.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Steam\\Steam.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"= R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/09/2006 3:37 PM 639224] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/01/2010 7:56 AM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/01/2010 7:56 AM 74480] R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [13/09/2006 1:39 PM 2368] R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [21/04/2009 6:25 PM 2789160] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/01/2010 7:56 AM 7408] S2 Roxio Upnp Server 11;Roxio Upnp Server 11;c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUpnpService11.exe [14/08/2008 12:25 AM 367088] S2 RoxLiveShare11;LiveShare P2P Server 11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe [14/08/2008 12:24 AM 309744] S2 RoxWatch11;Roxio Hard Drive Watcher 11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe [14/08/2008 12:24 AM 170480] S3 ATHER;Atheros AR5000 Based Wireless Network Adapter Service;c:\windows\system32\drivers\ar5210b.sys [22/04/2008 9:31 PM 276981] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [6/07/2007 1:38 PM 17792] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [6/07/2007 1:38 PM 7680] S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [19/02/2007 10:08 PM 40832] S3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [14/08/2008 12:25 AM 313840] S3 RoxMediaDB11;RoxMediaDB11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe [3/03/2009 9:58 PM 1122304] S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys --> c:\windows\system32\Drivers\vaxscsi.sys [?] S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [21/04/2009 6:25 PM 15656] . Contents of the 'Scheduled Tasks' folder 2009-04-09 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Trusted Zone: turbotax.com Trusted Zone: musicmatch.com\online TCP: {BDDCD34D-3087-4E83-804E-48596207E08A} = 4.2.2.1,4.2.2.2 TCP: {F9260797-182F-4005-8652-E724B315D7EA} = 205.152.144.23,205.152.132.23 Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\77que994.default\ FF - prefs.js: browser.search.selectedEngine - Amazon.com FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US  fficialFF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJPI150_09.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPOJI610.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - true. - - - - ORPHANS REMOVED - - - - BHO-{F54A6795-87BA-4C5D-BE9A-DB4443733453} - (no file) MSConfigStartUp-avast! - c:\progra~1\ALWILS~1\Avast4\ashDisp.exe MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe MSConfigStartUp-jjjjj - c:\windows\system32\nuxqho.exe MSConfigStartUp-mmfq - c:\progra~1\COMMON~1\mmfq\mmfqm.exe MSConfigStartUp-ms049669592-160 - c:\windows\ms049669592-160.exe MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Ahead\Lib\NeroCheck.exe MSConfigStartUp-nmcihm - c:\windows\system32\nuxqho.exe MSConfigStartUp-outlook - c:\program files\outlook\outlook.exe MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe MSConfigStartUp-TheMonitor - c:\windows\SYSC00.exe MSConfigStartUp-w0024b38 - w0024b38.dll MSConfigStartUp-win320992-16096695 - c:\windows\win320992-16096695.exe MSConfigStartUp-winlog - winlog.exe AddRemove-Episode 103 - The Mole, The Mob, and the Meatball - c:\program files\Telltale Games\Sam and Max - Season One\Uninstall Episode 103 - The Mole AddRemove-Episode 205 - What's New, Beelzebub? - c:\program files\Telltale Games\Sam and Max - Season Two\Uninstall Episode 205 - What's New AddRemove-XPv3.8.291 - c:\windows\Radeon Omega Drivers v3.8.291 AddRemove-XPv3.8.360 - c:\windows\Radeon Omega Drivers v3.8.360 AddRemove-XPv3.8.413 - c:\windows\Radeon Omega Drivers v3.8.413 ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-04 19:41 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys >>UNKNOWN [0x8738C7AC]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf74cbf28 \Driver\ACPI -> ACPI.sys @ 0xf726fcb8 \Driver\atapi -> atapi.sys @ 0xf7204b40 IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022 ParseProcedure -> ntkrnlpa.exe @ 0x80577c84 \Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022 ParseProcedure -> ntkrnlpa.exe @ 0x80577c84 NDIS: D-Link Xtreme N -> SendCompleteHandler -> NDIS.sys @ 0xf70e2bd4 PacketIndicateHandler -> NDIS.sys @ 0xf70eea21 SendHandler -> NDIS.sys @ 0xf70e2d44 user & kernel MBR OK ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1844237615-842925246-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:ba,3c,1c,68,e6,77,77,16,76,d8,cf,54,f6,73,26,f1,98,57,29,27,e3,b3, fe, c2,51,71,49,f3,ce,77,4a,2a,88,53,94,d6,f6,e5,b0,1e,60,d9,d5,fc,ea,45,de,ae, \ "??"=hex:c8,93,fc,d5,be,96,86,c3,92,7f,d9,dd,47,99,26,62 [HKEY_USERS\S-1-5-21-1844237615-842925246-725345543-500\Software\SecuROM\License information*] "datasecu"=hex:fd,1b,19,7b,3d,80,2a,1f,18,8d,cd,22,01,c6,b3,d8,78,c0,53,87, 2a, 9f,e4,71,7e,8a,11,11,4a,69,de,b6,24,9a,11,22,1a,a0,0d,b3,92,38,c4,07,d1,53, \ "rkeysecu"=hex:2e,d4,8e,0e,77,b0,16,60,00,d9,92,4d,57,b5,9c,93 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(568) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\WININET.dll c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(2152) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\WPDShServiceObj.dll c:\program files\SmartFTP Client 2.0\smarthook.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32\nvsvc32.exe c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\windows\system32\WTablet\Pen_TabletUser.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2010-02-04 19:50:38 - machine was rebooted ComboFix-quarantined-files.txt 2010-02-05 00:50 Pre-Run: 51,302,354,944 bytes free Post-Run: 51,871,387,648 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5 - - End Of File - - F903EB2D668AD4E1A239C365F6A9111A |
04-Feb-2010, 10:30 PM
#10 | |||||
Code: File:: c:\windows\system32\dapavama.dll.tmp c:\windows\system32\nirepuna.dll.tmp c:\windows\system32\sohizaji.dll.tmp Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]  Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
06-Feb-2010, 02:10 PM
#11 | |||||
| Newest log after the latest instructions. ComboFix 10-02-05.04 - Administrator 06/02/2010 12:57:16.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.1023.592 [GMT -5:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt FILE :: "c:\windows\system32\dapavama.dll.tmp" "c:\windows\system32\nirepuna.dll.tmp" "c:\windows\system32\sohizaji.dll.tmp" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\dapavama.dll.tmp c:\windows\system32\nirepuna.dll.tmp c:\windows\system32\sohizaji.dll.tmp . ((((((((((((((((((((((((( Files Created from 2010-01-06 to 2010-02-06 ))))))))))))))))))))))))))))))) . 2010-02-04 00:12 . 2010-02-04 00:12 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-02-04 00:12 . 2010-02-04 00:12 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-02-04 00:11 . 2010-02-04 00:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2010-02-04 00:11 . 2010-02-04 00:11 -------- d-----w- c:\program files\SUPERAntiSpyware 2010-02-04 00:11 . 2010-02-04 00:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2010-02-04 00:11 . 2010-02-04 00:11 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-01-28 00:08 . 2010-01-28 00:08 -------- d-----w- C:\21fa0eebb8ceacb04eeb 2010-01-26 13:36 . 2009-10-15 16:28 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll 2010-01-26 13:36 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll 2010-01-26 13:36 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll 2010-01-26 13:36 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe 2010-01-26 13:36 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll 2010-01-26 13:36 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll 2010-01-26 13:36 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe 2010-01-26 13:36 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll 2010-01-26 13:36 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll 2010-01-26 13:36 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll 2010-01-26 13:35 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll 2010-01-26 13:33 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2010-01-26 13:33 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-06 17:54 . 2009-11-18 02:11 -------- d-----w- c:\program files\Steam 2010-02-06 17:53 . 2009-04-21 23:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\WTablet 2010-02-05 02:19 . 2006-05-03 18:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent 2010-02-05 00:20 . 2004-01-01 15:48 60216 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-02-04 00:18 . 2009-02-20 19:06 -------- d-----w- c:\program files\Yahoo! 2010-02-04 00:18 . 2006-04-28 19:48 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-02-04 00:08 . 2006-04-28 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-01-26 04:19 . 2008-12-29 10:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-01-07 21:07 . 2008-12-29 10:56 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 21:07 . 2008-12-29 10:56 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-01-05 10:00 . 2003-09-02 10:30 832512 ------w- c:\windows\system32\wininet.dll 2010-01-05 10:00 . 2003-09-02 10:30 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-01-05 10:00 . 2003-09-02 10:30 17408 ----a-w- c:\windows\system32\corpol.dll 2009-12-11 01:12 . 2008-04-29 05:58 -------- d-----w- c:\documents and settings\Administrator\Application Data\iPhoneRingToneMaker 2009-11-21 15:51 . 2003-09-02 10:30 471552 ----a-w- c:\windows\AppPatch\aclayers.dll 2009-07-31 02:44 . 2009-07-30 07:00 31744 ----a-w- c:\program files\Common Files\alq.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files\steam\steam.exe" [2009-11-18 1217808] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-01-05 2002160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\Shell ExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Weather.lnk] path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Weather.lnk backup=c:\windows\pss\Weather.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^gckro.exe] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\gckro.exe backup=c:\windows\pss\gckro.exeCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM] 2002-11-13 23:50 61440 ----a-w- c:\program files\AIM95\aim.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2009-05-14 00:58 177472 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Application Layer Gateway] 2009-07-31 02:44 31744 ----a-w- c:\program files\Common Files\alq.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA] 2006-02-22 00:05 344064 -c--a-w- c:\windows\system32\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPMonitor] 2009-04-20 15:10 84464 ----a-w- c:\program files\Roxio Creator 2009\5.0\CPMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] 2005-12-10 14:57 133016 -c--a-w- c:\program files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] 2009-04-29 17:55 3338240 ----a-w- c:\program files\Electronic Arts\EADM\Core.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint] 2006-07-07 23:15 600896 -c--a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-06-05 17:39 292136 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\itype] 2006-07-07 23:14 576320 -c--a-w- c:\program files\Microsoft IntelliType Pro\itype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] 2006-01-19 16:06 11776 ----a-w- c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] 2006-01-19 16:06 110592 ----a-w- c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2009-02-18 18:44 13680640 ----a-w- c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2009-02-18 18:44 86016 ----a-w- c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray] 2004-12-20 06:12 131072 -c--a-w- c:\program files\NVIDIA Corporation\NvMixer\NvMixerTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2009-02-18 18:44 1657376 ----a-w- c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-05-26 21:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray] 2008-08-14 05:23 240112 ----a-w- c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatchTray11.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2006-09-07 19:51 49263 -c--a-w- c:\program files\Java\jre1.5.0_09\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] 2006-03-30 20:45 313472 ----a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] 2004-11-11 04:15 111816 -c--a-w- c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2006-06-21 17:14 35328 -c--a-w- c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\AIM95\\aim.exe"= "c:\\Program Files\\uTorrent\\utorrent.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\StubInstaller.exe"= "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI\\RpcSandraSrv.exe"= "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI\\Win32\\RpcDataSrv.exe"= "c:\\Program Files\\Motorola\\RSD Lite\\SDL.exe"= "c:\\Program Files\\Gaim\\gaim.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Steam\\Steam.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/01/2010 7:56 AM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/01/2010 7:56 AM 74480] R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [13/09/2006 1:39 PM 2368] R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [21/04/2009 6:25 PM 2789160] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/01/2010 7:56 AM 7408] S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/09/2006 3:37 PM 639224] S2 Roxio Upnp Server 11;Roxio Upnp Server 11;c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUpnpService11.exe [14/08/2008 12:25 AM 367088] S2 RoxLiveShare11;LiveShare P2P Server 11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe [14/08/2008 12:24 AM 309744] S2 RoxWatch11;Roxio Hard Drive Watcher 11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe [14/08/2008 12:24 AM 170480] S3 ATHER;Atheros AR5000 Based Wireless Network Adapter Service;c:\windows\system32\drivers\ar5210b.sys [22/04/2008 9:31 PM 276981] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [6/07/2007 1:38 PM 17792] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [6/07/2007 1:38 PM 7680] S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [19/02/2007 10:08 PM 40832] S3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;c:\program files\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [14/08/2008 12:25 AM 313840] S3 RoxMediaDB11;RoxMediaDB11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe [3/03/2009 9:58 PM 1122304] S3 vaxscsi;vaxscsi;c:\windows\system32\Drivers\vaxscsi.sys --> c:\windows\system32\Drivers\vaxscsi.sys [?] S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [21/04/2009 6:25 PM 15656] . Contents of the 'Scheduled Tasks' folder 2009-04-09 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Trusted Zone: turbotax.com Trusted Zone: musicmatch.com\online TCP: {BDDCD34D-3087-4E83-804E-48596207E08A} = 4.2.2.1,4.2.2.2 TCP: {F9260797-182F-4005-8652-E724B315D7EA} = 205.152.144.23,205.152.132.23 Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\77que994.default\ FF - prefs.js: browser.search.selectedEngine - Amazon.com FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US fficialFF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJPI150_09.dll FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPOJI610.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - true. ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-06 13:05 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1844237615-842925246-725345543-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:ba,3c,1c,68,e6,77,77,16,76,d8,cf,54,f6,73,26,f1,98,57,29,27,e3,b3, fe, c2,51,71,49,f3,ce,77,4a,2a,88,53,94,d6,f6,e5,b0,1e,60,d9,d5,fc,ea,45,de,ae, \ "??"=hex:c8,93,fc,d5,be,96,86,c3,92,7f,d9,dd,47,99,26,62 [HKEY_USERS\S-1-5-21-1844237615-842925246-725345543-500\Software\SecuROM\License information*] "datasecu"=hex:fd,1b,19,7b,3d,80,2a,1f,18,8d,cd,22,01,c6,b3,d8,78,c0,53,87, 2a, 9f,e4,71,7e,8a,11,11,4a,69,de,b6,24,9a,11,22,1a,a0,0d,b3,92,38,c4,07,d1,53, \ "rkeysecu"=hex:2e,d4,8e,0e,77,b0,16,60,00,d9,92,4d,57,b5,9c,93 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(392) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\WININET.dll c:\windows\system32\Ati2evxx.dll . Completion time: 2010-02-06 13:07:13 ComboFix-quarantined-files.txt 2010-02-06 18:06 ComboFix2.txt 2010-02-05 00:50 Pre-Run: 51,721,342,976 bytes free Post-Run: 51,681,783,808 bytes free Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5 - - End Of File - - A17F139CC700967E5539790D4FAEBB06 |
07-Feb-2010, 02:25 PM
#14 | |||||
| Hi, Lets give this a try. You will need a flash drive to move information from the sick computer to a working computer, so we can see the progress of our actions. Save these instructions in your flash drive as a text file (use notepad) so you can have access to these while in an external environment (PE). Here is what you need to do. Two programs to download First Download ISOBurner. Click Here for ISOBurner Instructions. Install the program, and follow the next set of steps. Second
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 01:19 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile