Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
31-Aug-2010, 06:03 PM
#1 | |||||
| Audio ads playing randomly |
| |
01-Sep-2010, 08:28 AM
#2 | |||||
| Hi, Please do the following: Download ComboFix from one of the following locations: Link 1 Link 2 VERY IMPORTANT !!! Save ComboFix.exe to your Desktop * IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
__________________ Microsoft MVP - 2010, 2011 |
02-Sep-2010, 04:03 PM
#5 | |||||
| Hi - Re run in Safe mode as above. Text of log pasted below. Thanks for your help. Do let me know what the next steps are. ComboFix 10-09-01.02 - Main 02/09/2010 19:27:20.3.1 - FAT32x86 MINIMAL Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1503.1108 [GMT 1:00] Running from: c:\documents and settings\Main\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: Sygate Personal Firewall *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . \\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF ((((((((((((((((((((((((( Files Created from 2010-08-02 to 2010-09-02 ))))))))))))))))))))))))))))))) . 2010-08-28 22:46 . 2010-07-17 04:00 423656 ----a-w- c:\windows\system32\deployJava1.dll 2010-08-28 12:42 . 2010-08-28 12:42 -------- d-----w- C:\FOUND.000 2010-08-27 06:34 . 2010-07-12 08:55 15880 ----a-w- c:\windows\system32\lsdelete.exe 2010-08-25 19:40 . 2010-08-25 19:40 -------- d-----w- c:\documents and settings\LocalService\Application Data\AdobeUM 2010-08-25 07:19 . 2010-08-25 07:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\qganeekov 2010-08-25 07:19 . 2010-08-25 07:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe 2010-08-24 13:33 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\dllcache\bthport.sys 2010-08-24 13:32 . 2010-06-21 15:27 354304 ------w- c:\windows\system32\dllcache\srv.sys 2010-08-24 13:31 . 2010-02-24 13:11 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys 2010-08-24 13:31 . 2009-11-21 15:51 471552 ------w- c:\windows\system32\dllcache\aclayers.dll 2010-08-24 13:31 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe 2010-08-24 13:28 . 2008-05-08 14:02 203136 ------w- c:\windows\system32\dllcache\rmcast.sys 2010-08-24 13:24 . 2008-10-15 16:34 337408 ------w- c:\windows\system32\dllcache\netapi32.dll 2010-08-24 13:23 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2010-08-24 13:23 . 2008-04-21 12:08 215552 ------w- c:\windows\system32\dllcache\wordpad.exe 2010-08-24 13:10 . 2010-08-24 13:10 -------- d-----w- c:\windows\system32\scripting 2010-08-24 13:10 . 2010-08-24 13:10 -------- d-----w- c:\windows\system32\en 2010-08-24 13:10 . 2010-08-24 13:10 -------- d-----w- c:\windows\l2schemas 2010-08-24 13:10 . 2010-08-24 13:10 -------- d-----w- c:\windows\system32\bits 2010-08-24 13:03 . 2010-08-24 13:03 -------- d-----w- c:\windows\EHome 2010-08-24 12:22 . 2008-04-14 00:12 4274816 ------w- c:\windows\system32\nv4_disp.dll 2010-08-24 12:22 . 2008-04-14 00:11 1888992 ------w- c:\windows\system32\ati3duag.dll 2010-08-24 12:22 . 2008-04-13 16:34 1897408 ------w- c:\windows\system32\drivers\nv4_mini.sys 2010-08-24 12:22 . 2008-04-14 00:12 1737856 ------w- c:\windows\system32\mtxparhd.dll 2010-08-24 12:22 . 2009-07-31 09:05 1372672 ------w- c:\windows\system32\dllcache\msxml6.dll 2010-08-24 12:22 . 2008-04-13 18:23 1309184 ------w- c:\windows\system32\drivers\mtlstrm.sys 2010-08-24 12:22 . 2008-04-13 18:23 1041536 ------w- c:\windows\system32\drivers\hsfdpsp2.sys 2010-08-24 12:22 . 2008-04-14 00:11 870784 ------w- c:\windows\system32\ati3d1ag.dll 2010-08-24 12:22 . 2008-04-13 16:34 701440 ------w- c:\windows\system32\drivers\ati2mtag.sys 2010-08-05 16:40 . 2010-08-05 16:40 664 ----a-w- c:\windows\system32\d3d9caps.dat 2010-08-04 13:13 . 2010-08-04 13:13 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM 2010-08-04 13:12 . 2010-08-04 13:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-28 22:47 . 2010-08-28 22:47 503808 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1804d9d1-n\msvcp71.dll 2010-08-28 22:47 . 2010-08-28 22:47 499712 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1804d9d1-n\jmc.dll 2010-08-28 22:47 . 2010-08-28 22:47 348160 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1804d9d1-n\msvcr71.dll 2010-08-28 22:47 . 2010-08-28 22:47 61440 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-487dce57-n\decora-sse.dll 2010-08-28 22:47 . 2010-08-28 22:47 12800 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-487dce57-n\decora-d3d.dll 2010-08-28 15:19 . 2010-07-29 22:03 63488 ----a-w- c:\documents and settings\Main\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll 2010-08-28 15:18 . 2010-07-29 22:03 117760 ----a-w- c:\documents and settings\Main\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-08-24 17:13 . 2006-01-23 21:38 111792 ----a-w- c:\documents and settings\Main\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-08-24 13:12 . 2005-04-19 10:43 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2010-08-22 17:04 . 2010-08-03 13:14 452104 ----a-w- c:\documents and settings\Main\Application Data\Real\Update\setup3.12\setup.exe 2010-07-30 21:45 . 2010-07-30 21:45 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2010-07-30 21:02 . 2010-07-30 21:02 -------- d--h--w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E} 2010-07-30 21:01 . 2010-07-30 21:01 -------- d-----w- c:\program files\Lavasoft 2010-07-30 21:01 . 2010-07-30 21:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2010-07-29 22:03 . 2010-07-29 22:03 52224 ----a-w- c:\documents and settings\Main\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-07-29 22:02 . 2010-07-29 22:02 -------- d-----w- c:\documents and settings\Main\Application Data\SUPERAntiSpyware.com 2010-07-29 22:02 . 2010-07-29 22:02 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2010-07-29 22:01 . 2010-07-29 22:01 -------- d-----w- c:\program files\SUPERAntiSpyware 2010-07-29 21:48 . 2010-07-29 21:48 388096 ----a-r- c:\documents and settings\Main\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-07-29 21:48 . 2010-07-29 21:48 -------- d-----w- c:\program files\Trend Micro 2010-07-22 09:50 . 2010-07-22 09:50 -------- d-----w- c:\program files\iPod 2010-07-22 09:49 . 2010-07-22 09:49 -------- d-----w- c:\program files\iTunes 2010-07-22 09:32 . 2010-07-22 09:32 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe 2010-07-22 08:12 . 2010-07-22 08:12 -------- d-----w- c:\program files\Emsisoft Anti-Malware 2010-07-22 06:25 . 2010-07-22 06:25 -------- d-----w- c:\documents and settings\LocalService\Application Data\VIRGINMEDIATOOLBAR 2010-07-21 17:03 . 2010-07-21 17:02 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\VIRGINMEDIATOOLBAR 2010-07-21 12:50 . 2010-07-21 12:50 -------- d-----w- c:\documents and settings\NetworkService\Application Data\VIRGINMEDIATOOLBAR 2010-07-17 08:25 . 2010-07-17 08:25 12536 ----a-w- c:\windows\system32\avgrsstx.dll 2010-07-17 08:24 . 2010-04-08 21:20 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-07-12 08:56 . 2010-07-30 21:02 2979280 ----a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe 2010-07-12 08:55 . 2010-07-30 21:46 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys 2010-07-01 22:47 . 2010-03-09 17:08 439816 ----a-w- c:\documents and settings\Main\Application Data\Real\Update\setup3.10\setup.exe 2010-07-01 09:17 . 2010-07-01 09:17 71992 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe 2010-06-30 12:31 . 2005-04-19 10:28 149504 ----a-w- c:\windows\system32\schannel.dll 2010-06-24 12:22 . 2005-04-19 10:28 916480 ----a-w- c:\windows\system32\wininet.dll 2010-06-23 13:44 . 2005-04-19 10:28 1851904 ----a-w- c:\windows\system32\win32k.sys 2010-06-23 11:42 . 2010-06-23 11:42 501936 ----a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb86A.tmp.exe 2010-06-21 15:27 . 2005-04-19 10:28 354304 ----a-w- c:\windows\system32\drivers\srv.sys 2010-06-18 15:46 . 2010-06-18 15:46 81 ----a-w- C:\CTX.DAT 2010-06-17 14:03 . 2005-04-19 10:28 80384 ----a-w- c:\windows\system32\iccvid.dll 2010-06-14 14:31 . 2005-04-19 10:42 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\HelpSvc.exe 2010-06-14 07:41 . 2005-04-19 10:28 1172480 ----a-w- c:\windows\system32\msxml3.dll 2006-04-29 16:17 . 2006-04-29 16:17 774144 ----a-w- c:\program files\RngInterstitial.dll 2007-10-02 22:07 . 2007-07-27 20:37 66408 ----a-w- c:\program files\mozilla firefox\components\jar50.dll 2007-10-02 22:07 . 2007-07-27 20:37 54112 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2007-10-02 22:07 . 2007-07-27 20:37 34688 ----a-w- c:\program files\mozilla firefox\components\myspell.dll 2007-10-02 22:07 . 2007-07-27 20:37 46456 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll 2007-10-02 22:07 . 2007-07-27 20:37 171880 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-CFC3-3CECC9AB2EDA}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "V Stuff Backup"="c:\program files\VirginMedia\V Stuff Backup\v_stuff_backup.exe" [2010-01-19 8262928] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2005-03-17 106496] "SoundMan"="SOUNDMAN.EXE" [2005-03-17 67584] "AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363] "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-17 2065760] "SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-07-08 185896] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 68856] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10h_Active X.exe" [2010-07-03 231888] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explo rer] "NoResolveTrack"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\Shell ExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-07-17 08:25 12536 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavaso ft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDef end] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BlueSoleil.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BlueSoleil.lnk backup=c:\windows\pss\BlueSoleil.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2005-12-16 11:57 94208 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-03-18 12:49 136176 ----a-w- c:\documents and settings\Main\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] 2004-08-04 04:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2010-07-16 06:41 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kdx] 2008-02-27 16:56 1032376 ----a-w- c:\program files\Kontiki\KHost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2010-04-29 14:39 437584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002] 2004-08-04 04:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A] 2004-08-04 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync] 2004-08-04 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-03-17 20:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer] 2008-07-08 17:53 214560 ----a-w- c:\program files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2004-07-15 00:07 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2007-09-13 12:31 22880040 ----a-r- c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-05-24 09:58 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] 2008-07-08 17:53 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] 2006-03-30 15:45 313472 ----a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=c:\windows\system32\ctfmon.exe "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "kdx"=c:\program files\Kontiki\KHost.exe -all "Google Update"="c:\documents and settings\Main\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" "SUPERAntiSpyware"=c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto "SiSPower"=Rundll32.exe SiSPower.dll,ModeAgent "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime "AVG9_TRAY"=c:\progra~1\AVG\AVG9\avgtray.exe "HsdClient.exe"="c:\program files\Virgin Media\Chat Extension\HsdClient.exe" /AUTORUN "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "DigitalHomeSupport.exe"="c:\program files\Virgin Media\Digital Home Support\DigitalHomeSupport.exe" /AUTORUN "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Real\\RealPlayer\\trueplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Documents and Settings\\Main\\Desktop\\Music & DVD\\utorrent.exe"= "c:\\Program Files\\Kontiki\\KService.exe"= "c:\\Program Files\\Spotify\\spotify.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Safari\\Safari.exe"= "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"= "c:\\Program Files\\Virgin Media\\Digital Home Support\\ServicepointService.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "7338:TCP"= 7338:TCP  pLive"3915:UDP"= 3915:UDP pLiveR0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [30/07/2010 22:46 64288] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/07/2010 09:55 1355416] S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [08/04/2010 22:20 216400] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656] S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [17/07/2010 09:25 308136] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [28/01/2010 23:36 135664] S2 HsdService;HsdService;c:\program files\Virgin Media\Chat Extension\HsdService.exe [31/05/2010 13:59 1410288] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [05/06/2010 17:06 304464] S2 ServicepointService;ServicepointService;c:\program files\Virgin Media\Digital Home Support\ServicepointService.exe [31/05/2010 13:58 689392] S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/06/2010 15:41 92008] S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [30/10/2009 15:05 1021256] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592] S3 DMSKSSRh;DMSKSSRh;\??\c:\docume~1\Main\LOCALS~1\Temp\DMSKSSRh.sys --> c:\docume~1\Main\LOCALS~1\Temp\DMSKSSRh.sys [?] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\drivers\k510bus.sys [10/12/2006 18:09 58288] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\drivers\k510mdfl.sys [10/12/2006 18:09 8336] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\drivers\k510mdm.sys [10/12/2006 18:09 94064] S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\k510mgmt.sys [10/12/2006 18:09 85408] S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\drivers\k510obex.sys [10/12/2006 18:09 83344] S3 lgmcbus;LGE Mobile driver (WDM);c:\windows\system32\DRIVERS\lgmcbus.sys --> c:\windows\system32\DRIVERS\lgmcbus.sys [?] S3 lgmcmdfl;LGE Mobile USB WMC Modem Filter;c:\windows\system32\DRIVERS\lgmcmdfl.sys --> c:\windows\system32\DRIVERS\lgmcmdfl.sys [?] S3 lgmcmdm;LGE Mobile USB WMC Modem Driver;c:\windows\system32\DRIVERS\lgmcmdm.sys --> c:\windows\system32\DRIVERS\lgmcmdm.sys [?] S3 lgmcmgmt;LGE Mobile USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\lgmcmgmt.sys --> c:\windows\system32\DRIVERS\lgmcmgmt.sys [?] S3 lgmcobex;LGE Mobile USB WMC OBEX Interface;c:\windows\system32\DRIVERS\lgmcobex.sys --> c:\windows\system32\DRIVERS\lgmcobex.sys [?] S3 lgmcunic;LGE Mobile USB WMC Ethernet ELDA (WDM);c:\windows\system32\DRIVERS\lgmcunic.sys --> c:\windows\system32\DRIVERS\lgmcunic.sys [?] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [05/06/2010 17:06 20952] S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14/10/2009 07:24 10064] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [03/12/2006 12:23 639224] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contents of the 'Scheduled Tasks' folder 2010-07-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2010-09-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-849584960-738971770-2466402417-1006Core.job - c:\documents and settings\Main\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-08 12:49] 2010-09-02 c:\windows\Tasks\Automatic troubleshooting.job - c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-10-30 14:12] 2010-09-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 21:48] 2010-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-28 22:36] 2010-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-28 22:36] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.virginmedia.com uInternet Connection Wizard,ShellNext = iexplore IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html TCP: {F13DDBD1-A104-41EC-870D-6269D93B92A9} = 194.168.4.100,194.168.8.100 DPF: {164B406B-0FD6-4E7F-BA7E-64D227D4CA37} - hxxp://www.digitalwebbooks.com/reader/dbplugin.cab DPF: {FD0EBBED-0C42-4D0F-82DA-44399B5C420A} - hxxp://downloads.virginmedia.com/CST/ver1/xp_mail.cab FF - ProfilePath - c:\documents and settings\Main\Application Data\Mozilla\Firefox\Profiles\udu11bgl.default\ FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.notify.interval - 600000 FF - user.js: content.switch.threshold - 600000 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: browser.blink_allowed - true FF - user.js: network.prefetch-next - true FF - user.js: layout.spellcheckDefault - 1 FF - user.js: browser.urlbar.autoFill - false FF - user.js: browser.search.openintab - false FF - user.js: browser.tabs.closeButtons - 1 FF - user.js: browser.tabs.opentabfor.middleclick - true FF - user.js: browser.tabs.tabMinWidth - 100 FF - user.js: browser.urlbar.hideGoButton - false . . ------- File Associations ------- . .txt= . - - - - ORPHANS REMOVED - - - - WebBrowser-{A057A204-BACC-4D26-8590-3AAE8EEE749D} - (no file) MSConfigStartUp-Advanced SystemCare 3 - c:\program files\IObit\Advanced SystemCare 3\AWC.exe MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe MSConfigStartUp-PC Connection Agent - c:\program files\Microsoft ActiveSync\wcescomm.exe MSConfigStartUp-MimBoot - c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe MSConfigStartUp-NI - c:\windows\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe MSConfigStartUp-ppmate - c:\program files\PPMate\PPMate\ppmate.exe MSConfigStartUp-Sony Ericsson PC Suite - c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe MSConfigStartUp-TuneUp MemOptimizer - c:\program files\TuneUp Utilities 2007\MemOptimizer.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-09-02 19:36 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant] "ImagePath"="" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01 ,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,92,05,1a,23,9f,de,e9,4e,87,6b,53, \ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01 ,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,92,05,1a,23,9f,de,e9,4e,87,6b,53, \ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_Ac tiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(232) c:\program files\SUPERAntiSpyware\SASWINLO.DLL c:\windows\system32\WININET.dll c:\windows\system32\l3codeca.acm c:\windows\system32\sirenacm.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll - - - - - - - > 'explorer.exe'(1740) c:\windows\system32\WININET.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\AVG\AVG9\avgchsvx.exe c:\windows\system32\wbem\unsecapp.exe . ************************************************************************** . Completion time: 2010-09-02 19:43:29 - machine was rebooted ComboFix-quarantined-files.txt 2010-09-02 18:43 Pre-Run: 4,572,577,792 bytes free Post-Run: 4,462,641,152 bytes free - - End Of File - - B859A11183A6BD3E6EB2572FE2A7AFAE |
02-Sep-2010, 06:31 PM
#6 | |||||
| Hi Please do the following:
Here's how to do that: Click Start > Run type Notepad click OK. This will open an empty notepad file: Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy') Code: http://forums.techguy.org/virus-other-malware-removal/947014-audio-ads-playing-randomly.html#post7580004 Collect:: c:\docume~1\Main\LOCALS~1\Temp\DMSKSSRh.sys Folder:: c:\documents and settings\LocalService\Local Settings\Application Data\qganeekov Driver:: DMSKSSRh Save this file to your desktop, Save this as "CFScript" Here's how to do that: 1.Click File; 2.Click Save As... Change the directory to your desktop; 3.Change the Save as type to "All Files"; 4.Type in the file name: CFScript 5.Click Save ... 
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall. NEXT
Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. NEXT **Vista/Win7 users - right click on the IE icon and run as administrator Run an on-line scan with Kaspersky Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.
__________________ Microsoft MVP - 2010, 2011 |
02-Sep-2010, 07:31 PM
#7 | |||||
| 1) CF script run in Combofix. Log pasted below 2) MBAM scan complete - all clear - Log pasted below. 3) Kaspersky - not run. Kaspersky site says I need Java Framework 1.5 or later and won;t progress to run without that. Following their link to Java takes me to Java site where their online analysis says: Your Java is working, Latest Java installed. Your Java configuration is as follows: Vendor: Sun Microsystems Inc. Version: Java 6 Update 21 Operating System: Windows XP 5.1 Architecture: x86 So I'm not clear on how to deal with that Java point. Any advice or is there a different scanner to use for a further check? Thanks again for the help, Logs follow. ComboFix 10-09-01.02 - Main 02/09/2010 22:39:02.4.1 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1503.772 [GMT 1:00] Running from: c:\documents and settings\Main\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Main\Desktop\cfscript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: Sygate Personal Firewall *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\LocalService\Local Settings\Application Data\qganeekov . \\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_DMSKSSRH -------\Service_DMSKSSRh ((((((((((((((((((((((((( Files Created from 2010-08-02 to 2010-09-02 ))))))))))))))))))))))))))))))) . 2010-08-28 22:47 . 2010-08-28 22:47 503808 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1804d9d1-n\msvcp71.dll 2010-08-28 22:47 . 2010-08-28 22:47 499712 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1804d9d1-n\jmc.dll 2010-08-28 22:47 . 2010-08-28 22:47 348160 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-1804d9d1-n\msvcr71.dll 2010-08-28 22:47 . 2010-08-28 22:47 61440 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-487dce57-n\decora-sse.dll 2010-08-28 22:47 . 2010-08-28 22:47 12800 ----a-w- c:\documents and settings\Main\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-487dce57-n\decora-d3d.dll 2010-08-28 22:46 . 2010-07-17 04:00 423656 ----a-w- c:\windows\system32\deployJava1.dll 2010-08-28 12:42 . 2010-08-28 12:42 -------- d-----w- C:\FOUND.000 2010-08-27 06:34 . 2010-07-12 08:55 15880 ----a-w- c:\windows\system32\lsdelete.exe 2010-08-25 19:40 . 2010-08-25 19:40 -------- d-----w- c:\documents and settings\LocalService\Application Data\AdobeUM 2010-08-25 07:19 . 2010-08-25 07:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe 2010-08-24 13:33 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\dllcache\bthport.sys 2010-08-24 13:32 . 2010-06-21 15:27 354304 ------w- c:\windows\system32\dllcache\srv.sys 2010-08-24 13:31 . 2010-02-24 13:11 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys 2010-08-24 13:31 . 2009-11-21 15:51 471552 ------w- c:\windows\system32\dllcache\aclayers.dll 2010-08-24 13:31 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe 2010-08-24 13:28 . 2008-05-08 14:02 203136 ------w- c:\windows\system32\dllcache\rmcast.sys 2010-08-24 13:24 . 2008-10-15 16:34 337408 ------w- c:\windows\system32\dllcache\netapi32.dll 2010-08-24 13:23 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2010-08-24 13:23 . 2008-04-21 12:08 215552 ------w- c:\windows\system32\dllcache\wordpad.exe 2010-08-24 13:10 . 2010-08-24 13:10 -------- d-----w- c:\windows\system32\scripting 2010-08-24 13:10 . 2010-08-24 13:10 -------- d-----w- c:\windows\system32\en 2010-08-24 13:10 . 2010-08-24 13:10 -------- d-----w- c:\windows\l2schemas 2010-08-24 13:10 . 2010-08-24 13:10 -------- d-----w- c:\windows\system32\bits 2010-08-24 13:03 . 2010-08-24 13:03 -------- d-----w- c:\windows\EHome 2010-08-24 12:22 . 2008-04-14 00:12 4274816 ------w- c:\windows\system32\nv4_disp.dll 2010-08-24 12:22 . 2008-04-14 00:11 1888992 ------w- c:\windows\system32\ati3duag.dll 2010-08-24 12:22 . 2008-04-13 16:34 1897408 ------w- c:\windows\system32\drivers\nv4_mini.sys 2010-08-24 12:22 . 2008-04-14 00:12 1737856 ------w- c:\windows\system32\mtxparhd.dll 2010-08-24 12:22 . 2009-07-31 09:05 1372672 ------w- c:\windows\system32\dllcache\msxml6.dll 2010-08-24 12:22 . 2008-04-13 18:23 1309184 ------w- c:\windows\system32\drivers\mtlstrm.sys 2010-08-24 12:22 . 2008-04-13 18:23 1041536 ------w- c:\windows\system32\drivers\hsfdpsp2.sys 2010-08-24 12:22 . 2008-04-14 00:11 870784 ------w- c:\windows\system32\ati3d1ag.dll 2010-08-24 12:22 . 2008-04-13 16:34 701440 ------w- c:\windows\system32\drivers\ati2mtag.sys 2010-08-05 16:40 . 2010-08-05 16:40 664 ----a-w- c:\windows\system32\d3d9caps.dat 2010-08-04 13:13 . 2010-08-04 13:13 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM 2010-08-04 13:12 . 2010-08-04 13:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-28 15:19 . 2010-07-29 22:03 63488 ----a-w- c:\documents and settings\Main\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll 2010-08-28 15:18 . 2010-07-29 22:03 117760 ----a-w- c:\documents and settings\Main\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-08-24 17:13 . 2006-01-23 21:38 111792 ----a-w- c:\documents and settings\Main\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-08-24 13:12 . 2005-04-19 10:43 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2010-08-22 17:04 . 2010-08-03 13:14 452104 ----a-w- c:\documents and settings\Main\Application Data\Real\Update\setup3.12\setup.exe 2010-07-30 21:45 . 2010-07-30 21:45 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2010-07-30 21:02 . 2010-07-30 21:02 -------- d--h--w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E} 2010-07-30 21:01 . 2010-07-30 21:01 -------- d-----w- c:\program files\Lavasoft 2010-07-30 21:01 . 2010-07-30 21:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2010-07-29 22:03 . 2010-07-29 22:03 52224 ----a-w- c:\documents and settings\Main\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-07-29 22:02 . 2010-07-29 22:02 -------- d-----w- c:\documents and settings\Main\Application Data\SUPERAntiSpyware.com 2010-07-29 22:02 . 2010-07-29 22:02 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2010-07-29 22:01 . 2010-07-29 22:01 -------- d-----w- c:\program files\SUPERAntiSpyware 2010-07-29 21:48 . 2010-07-29 21:48 388096 ----a-r- c:\documents and settings\Main\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-07-29 21:48 . 2010-07-29 21:48 -------- d-----w- c:\program files\Trend Micro 2010-07-22 09:50 . 2010-07-22 09:50 -------- d-----w- c:\program files\iPod 2010-07-22 09:49 . 2010-07-22 09:49 -------- d-----w- c:\program files\iTunes 2010-07-22 09:32 . 2010-07-22 09:32 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe 2010-07-22 08:12 . 2010-07-22 08:12 -------- d-----w- c:\program files\Emsisoft Anti-Malware 2010-07-22 06:25 . 2010-07-22 06:25 -------- d-----w- c:\documents and settings\LocalService\Application Data\VIRGINMEDIATOOLBAR 2010-07-21 17:03 . 2010-07-21 17:02 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\VIRGINMEDIATOOLBAR 2010-07-21 12:50 . 2010-07-21 12:50 -------- d-----w- c:\documents and settings\NetworkService\Application Data\VIRGINMEDIATOOLBAR 2010-07-17 08:25 . 2010-07-17 08:25 12536 ----a-w- c:\windows\system32\avgrsstx.dll 2010-07-17 08:24 . 2010-04-08 21:20 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2010-07-12 08:56 . 2010-07-30 21:02 2979280 ----a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe 2010-07-12 08:55 . 2010-07-30 21:46 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys 2010-07-01 22:47 . 2010-03-09 17:08 439816 ----a-w- c:\documents and settings\Main\Application Data\Real\Update\setup3.10\setup.exe 2010-07-01 09:17 . 2010-07-01 09:17 71992 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe 2010-06-30 12:31 . 2005-04-19 10:28 149504 ----a-w- c:\windows\system32\schannel.dll 2010-06-24 12:22 . 2005-04-19 10:28 916480 ----a-w- c:\windows\system32\wininet.dll 2010-06-23 13:44 . 2005-04-19 10:28 1851904 ----a-w- c:\windows\system32\win32k.sys 2010-06-23 11:42 . 2010-06-23 11:42 501936 ----a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb86A.tmp.exe 2010-06-21 15:27 . 2005-04-19 10:28 354304 ----a-w- c:\windows\system32\drivers\srv.sys 2010-06-18 15:46 . 2010-06-18 15:46 81 ----a-w- C:\CTX.DAT 2010-06-17 14:03 . 2005-04-19 10:28 80384 ----a-w- c:\windows\system32\iccvid.dll 2010-06-14 14:31 . 2005-04-19 10:42 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\HelpSvc.exe 2010-06-14 07:41 . 2005-04-19 10:28 1172480 ----a-w- c:\windows\system32\msxml3.dll 2006-04-29 16:17 . 2006-04-29 16:17 774144 ----a-w- c:\program files\RngInterstitial.dll 2007-10-02 22:07 . 2007-07-27 20:37 66408 ----a-w- c:\program files\mozilla firefox\components\jar50.dll 2007-10-02 22:07 . 2007-07-27 20:37 54112 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2007-10-02 22:07 . 2007-07-27 20:37 34688 ----a-w- c:\program files\mozilla firefox\components\myspell.dll 2007-10-02 22:07 . 2007-07-27 20:37 46456 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll 2007-10-02 22:07 . 2007-07-27 20:37 171880 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((( SnapShot@2010-09-02_18.36.42 ))))))))))))))))))))))))))))))))))))))))) . + 2010-09-02 21:46 . 2010-09-02 21:46 16384 c:\windows\temp\Perflib_Perfdata_770.dat + 2010-09-02 18:51 . 2010-09-02 18:51 16384 c:\windows\temp\Perflib_Perfdata_6e0.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-CFC3-3CECC9AB2EDA}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "V Stuff Backup"="c:\program files\VirginMedia\V Stuff Backup\v_stuff_backup.exe" [2010-01-19 8262928] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2005-03-17 106496] "SoundMan"="SOUNDMAN.EXE" [2005-03-17 67584] "AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363] "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-17 2065760] "SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-07-08 185896] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-24 68856] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10h_Active X.exe" [2010-07-03 231888] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explo rer] "NoResolveTrack"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\Shell ExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-07-17 08:25 12536 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavaso ft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDef end] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BlueSoleil.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BlueSoleil.lnk backup=c:\windows\pss\BlueSoleil.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2005-12-16 11:57 94208 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-03-18 12:49 136176 ----a-w- c:\documents and settings\Main\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] 2004-08-04 04:00 208952 ----a-w- c:\windows\ime\imjp8_1\imjpmig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2010-07-16 06:41 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kdx] 2008-02-27 16:56 1032376 ----a-w- c:\program files\Kontiki\KHost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2010-04-29 14:39 437584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002] 2004-08-04 04:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A] 2004-08-04 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync] 2004-08-04 04:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-03-17 20:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer] 2008-07-08 17:53 214560 ----a-w- c:\program files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2004-07-15 00:07 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2007-09-13 12:31 22880040 ----a-r- c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-05-24 09:58 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] 2008-07-08 17:53 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] 2006-03-30 15:45 313472 ----a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=c:\windows\system32\ctfmon.exe "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "kdx"=c:\program files\Kontiki\KHost.exe -all "Google Update"="c:\documents and settings\Main\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" "SUPERAntiSpyware"=c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto "SiSPower"=Rundll32.exe SiSPower.dll,ModeAgent "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime "AVG9_TRAY"=c:\progra~1\AVG\AVG9\avgtray.exe "HsdClient.exe"="c:\program files\Virgin Media\Chat Extension\HsdClient.exe" /AUTORUN "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "DigitalHomeSupport.exe"="c:\program files\Virgin Media\Digital Home Support\DigitalHomeSupport.exe" /AUTORUN "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Real\\RealPlayer\\trueplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Documents and Settings\\Main\\Desktop\\Music & DVD\\utorrent.exe"= "c:\\Program Files\\Kontiki\\KService.exe"= "c:\\Program Files\\Spotify\\spotify.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Safari\\Safari.exe"= "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"= "c:\\Program Files\\Virgin Media\\Digital Home Support\\ServicepointService.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "7338:TCP"= 7338:TCP pLive"3915:UDP"= 3915:UDP pLiveR0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [30/07/2010 22:46 64288] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [08/04/2010 22:20 216400] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656] R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [17/07/2010 09:25 308136] R2 HsdService;HsdService;c:\program files\Virgin Media\Chat Extension\HsdService.exe [31/05/2010 13:59 1410288] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/07/2010 09:55 1355416] R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [05/06/2010 17:06 304464] R2 ServicepointService;ServicepointService;c:\program files\Virgin Media\Digital Home Support\ServicepointService.exe [31/05/2010 13:58 689392] R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/06/2010 15:41 92008] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [30/10/2009 15:05 1021256] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [05/06/2010 17:06 20952] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14/10/2009 07:24 10064] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [28/01/2010 23:36 135664] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\drivers\k510bus.sys [10/12/2006 18:09 58288] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\drivers\k510mdfl.sys [10/12/2006 18:09 8336] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\drivers\k510mdm.sys [10/12/2006 18:09 94064] S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\k510mgmt.sys [10/12/2006 18:09 85408] S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\drivers\k510obex.sys [10/12/2006 18:09 83344] S3 lgmcbus;LGE Mobile driver (WDM);c:\windows\system32\DRIVERS\lgmcbus.sys --> c:\windows\system32\DRIVERS\lgmcbus.sys [?] S3 lgmcmdfl;LGE Mobile USB WMC Modem Filter;c:\windows\system32\DRIVERS\lgmcmdfl.sys --> c:\windows\system32\DRIVERS\lgmcmdfl.sys [?] S3 lgmcmdm;LGE Mobile USB WMC Modem Driver;c:\windows\system32\DRIVERS\lgmcmdm.sys --> c:\windows\system32\DRIVERS\lgmcmdm.sys [?] S3 lgmcmgmt;LGE Mobile USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\lgmcmgmt.sys --> c:\windows\system32\DRIVERS\lgmcmgmt.sys [?] S3 lgmcobex;LGE Mobile USB WMC OBEX Interface;c:\windows\system32\DRIVERS\lgmcobex.sys --> c:\windows\system32\DRIVERS\lgmcobex.sys [?] S3 lgmcunic;LGE Mobile USB WMC Ethernet ELDA (WDM);c:\windows\system32\DRIVERS\lgmcunic.sys --> c:\windows\system32\DRIVERS\lgmcunic.sys [?] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [03/12/2006 12:23 639224] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contents of the 'Scheduled Tasks' folder 2010-07-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2010-09-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-849584960-738971770-2466402417-1006Core.job - c:\documents and settings\Main\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-08 12:49] 2010-09-02 c:\windows\Tasks\Automatic troubleshooting.job - c:\program files\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-10-30 14:12] 2010-09-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 21:48] 2010-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-28 22:36] 2010-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-28 22:36] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.virginmedia.com uInternet Connection Wizard,ShellNext = iexplore IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html TCP: {F13DDBD1-A104-41EC-870D-6269D93B92A9} = 194.168.4.100,194.168.8.100 DPF: {164B406B-0FD6-4E7F-BA7E-64D227D4CA37} - hxxp://www.digitalwebbooks.com/reader/dbplugin.cab DPF: {FD0EBBED-0C42-4D0F-82DA-44399B5C420A} - hxxp://downloads.virginmedia.com/CST/ver1/xp_mail.cab FF - ProfilePath - c:\documents and settings\Main\Application Data\Mozilla\Firefox\Profiles\udu11bgl.default\ FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.notify.interval - 600000 FF - user.js: content.switch.threshold - 600000 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: browser.blink_allowed - true FF - user.js: network.prefetch-next - true FF - user.js: layout.spellcheckDefault - 1 FF - user.js: browser.urlbar.autoFill - false FF - user.js: browser.search.openintab - false FF - user.js: browser.tabs.closeButtons - 1 FF - user.js: browser.tabs.opentabfor.middleclick - true FF - user.js: browser.tabs.tabMinWidth - 100 FF - user.js: browser.urlbar.hideGoButton - false . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-09-02 22:48 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant] "ImagePath"="" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01 ,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,92,05,1a,23,9f,de,e9,4e,87,6b,53, \ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01 ,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,92,05,1a,23,9f,de,e9,4e,87,6b,53, \ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_Ac tiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(408) c:\program files\SUPERAntiSpyware\SASWINLO.DLL c:\windows\system32\WININET.dll - - - - - - - > 'explorer.exe'(932) c:\windows\system32\WININET.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll c:\windows\system32\ieframe.dll c:\windows\system32\SSSensor.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Sygate\SPF\smc.exe c:\program files\AVG\AVG9\avgchsvx.exe c:\program files\AVG\AVG9\avgrsx.exe c:\program files\AVG\AVG9\avgcsrvx.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE c:\program files\Java\jre6\bin\jqs.exe c:\program files\Kontiki\KService.exe c:\windows\SOUNDMAN.EXE c:\windows\AGRSMMSG.exe c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe c:\windows\system32\wscntfy.exe c:\program files\VirginMedia\V Stuff Backup\AGMailAgent.exe . ************************************************************************** . Completion time: 2010-09-02 22:52:02 - machine was rebooted ComboFix-quarantined-files.txt 2010-09-02 21:52 ComboFix2.txt 2010-09-02 18:43 Pre-Run: 4,365,025,280 bytes free Post-Run: 4,366,598,144 bytes free - - End Of File - - 3CA3A33278DA52810310296087497E9F Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4532 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 02/09/2010 23:06:10 mbam-log-2010-09-02 (23-06-10).txt Scan type: Quick scan Objects scanned: 139890 Time elapsed: 11 minute(s), 34 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) End of logs. |
02-Sep-2010, 08:21 PM
#8 | |||||
| It appears the MBR is not being fixed properly, so we will need to do it in the recovery console, please do the following: Earlier on ComboFix installed the Recovery Console. We're going to use that now. Reboot your machine and when the Boot Menu flashes up - select "Microsoft Windows Recovery Console" (you need to be very fast with the arrow key as you only have a couple of seconds before it defaults to the windows XP bootup)   When you get to the above screen, take note of the number that references your operating system. If it's '1' like the picture above, type 1 and press Enter  Next type FIXMBR  If it ask if you're sure you want to write a new MBR, answer 'Y' Then type EXIT to reboot the machine. NEXT Please run MBRCheck and post the log Please download MBRCheck.exe to your desktop.
__________________ Microsoft MVP - 2010, 2011 |
03-Sep-2010, 06:13 PM
#12 | |||||
| Hi Kaspersky has identified this file as infected, if it is in your Add/Remove programs uninstall it, if not > navigate to the DVDFab 5 folder and delete it C:\Program Files\DVDFab 5\DVDFab.exe The other items are in java cache which we can empty Please do the following:
J2SE Runtime Environment 5.0 Update 6 NEXT Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup) If you do not see the icon, look to your left and click 'Switch to Classic View'.
NEXT Visit ADOBEand download the latest version of Acrobat Reader (version 9.3) Having the latest updates ensures there are no security vulnerabilities in your system. NEXT You can delete the MBRCheck, DDS and GMER logs and programs from your desktop. NEXT Follow these steps to uninstall Combofix
 If there are any logs/tools remaining > right click and delete them. NEXT Below I have included a number of recommendations for how to protect your computer against malware infections.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Thank you for your patience, and performing all of the procedures requested. Please respond one last time so we can consider the thread resolved and close it, thank-you.
__________________ Microsoft MVP - 2010, 2011 |
03-Sep-2010, 06:44 PM
#13 | |||||
| Hi Catbyte, Thanks for that latest update, instructions and advice. I've gone through all the actions and am just working my way through the advisory parts now. TFC about to run. I just thought I'd confirm all done first and say thanks for all your help. It feels great to have that all fixed and I really do appreciate your guidance to get me there. Cheers!  EddieG |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
Similar Threads | ||||
| Title | Thread Starter | Forum | Replies | Last Post |
| Random Audio Ads playing on my computer (2nd attempted removal) | stompydon | Virus & Other Malware Removal | 1 | 08-Aug-2010 01:03 AM |
| Audio ads playing in the background | Oats16 | Virus & Other Malware Removal | 1 | 04-Mar-2010 07:58 PM |
| Audio ads playing in background | sutefaniidesu | Virus & Other Malware Removal | 15 | 15-Jan-2010 06:03 PM |
| Audios Ads No Browser open | nigeljs | Virus & Other Malware Removal | 0 | 27-Nov-2009 09:06 PM |
| Need help with random audio ads/search engine redirect/pop ups/slowed internet | rwrocks247 | Virus & Other Malware Removal | 0 | 08-Aug-2009 06:31 PM |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 03:28 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile