Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads

Constant Pop-ups in Firefox... adware?

This is a discussion on Constant Pop-ups in Firefox... adware? within the Resolved HJT Threads forums, part of the Tech Support Forum category. Hello. I think I have some adware (or something worse for all I know) on my computer. I'm constantly getting


 
 
Thread Tools Search this Thread
Old 06-16-2010, 06:00 PM   #1
Security Team
Analyst
 
Piper's Avatar
 
Join Date: Jun 2010
Location: California
Posts: 971
OS: Windows XP Service Pack 3



Hello.

I think I have some adware (or something worse for all I know) on my computer. I'm constantly getting Pop-ups when Firefox is open (which open in a new tabs, not in new windows). This started last night after Adobe Reader tried to open something on its own. I was not home when this happened, so I don't have any other details-- just letting you know what my mom said happened while I was gone.

I did several scans with Avast Antivirus, Malwarebytes, Ad-Aware, Spybot Search & Destroy, and Sophos Anti-Rootkit. Ad-Aware and Spybot found and removed some things (I can't remember the names of any except for "eZula Hot Text," but there were quite a few; I believe Ad-Aware found 11 or so, and Spybot found 45 including "eZula Hot Text". ...Wow that's a lot...! ).

Even after all that, the pop-ups are still coming up on Firefox. Also, a few times, Windows Explorer has told me that it has experienced a problem and needs to close. I get the option to send an error report (which I do) then the task bar and desktop icons disappear momentarily and then come back and the computer acts as if nothing happened.

So, since the problem is still there and I have no idea what to do about it, I decided it is time to ask for help.

I read and followed the instructions for posting. I have attached the Attach.zip file (with Attach.txt and Ark.txt) that was asked for, and I pasted the contents of DDS.txt below. Any help would be greatly appreciated!

Oh, also, I do not have a Windows Install disc or Boot CD.

Thanks in advance!



Contents of DDS.txt:

DDS (Ver_10-03-17.01) - NTFSx86
Run by HP_Administrator at 16:44:35.14 on Wed 06/16/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.483 [GMT -7:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Lexmark 8300 Series\ezprint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\lxcjcoms.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\AGRSMMSG.exe
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Documents and Settings\HP_Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ho_home
uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearch Bar = hxxp://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ho_search
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uWindow Title = Microsoft Internet Explorer provided by Verizon Online
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: CNavExtBho Class: {bdf3e430-b101-42ad-a544-fadc6b084872} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: HP view: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hp\digital imaging\bin\HPDTLK02.dll
TB: {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Motive SmartBridge] c:\progra~1\verizo~1\smartb~1\MotiveSB.exe
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [lxcjmon.exe] "c:\program files\lexmark 8300 series\lxcjmon.exe"
mRun: [EzPrint] "c:\program files\lexmark 8300 series\ezprint.exe"
mRun: [LXCJCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCJtime.dll,_RunDLLEntry@16
StartupFolder: c:\docume~1\hp_adm~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\309731\program\Updates from HP.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\verizo~1.lnk - c:\program files\verizon online\bin\matcli.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: AtiExtEvent - Ati2evxx.dll
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\hp_adm~1\applic~1\mozilla\firefox\profiles\5phb5arb.default\
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-5-15 164048]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-5-15 19024]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-5-15 40384]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2010-5-15 54760]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-5-15 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-5-15 40384]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\1b.tmp --> c:\windows\system32\1B.tmp [?]

=============== Created Last 30 ================

2010-06-16 23:20:36 0 d-----w- c:\program files\Hijack This
2010-06-16 18:21:34 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-06-16 18:21:34 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-06-16 09:47:53 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-06-13 17:51:11 0 d-----w- c:\program files\Sophos
2010-06-11 00:40:22 917504 ----a-w- c:\windows\system32\FLASH.OCX
2010-06-11 00:40:22 0 d-sh--w- c:\windows\ftpcache
2010-06-10 02:42:21 0 d-----w- c:\docume~1\hp_adm~1\applic~1\AnvSoft
2010-06-10 02:42:18 0 d-----w- c:\program files\AnvSoft
2010-06-10 02:25:54 0 d-----w- c:\program files\DVD Decrypter
2010-06-10 00:44:21 0 d-----w- c:\program files\Audacity
2010-06-08 19:21:26 0 d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
2010-06-08 19:19:49 0 d-----w- c:\windows\system32\color
2010-06-08 19:19:49 0 d-----w- c:\program files\Lexmark Applications
2010-06-08 19:19:39 257 ----a-w- c:\windows\setup.iss
2010-06-08 19:18:50 12686 ----a-w- c:\windows\system32\LexFiles.ulf
2010-06-08 19:18:31 0 d-----w- c:\program files\Lx_cats
2010-06-08 19:18:01 7654 ----a-w- c:\windows\system32\lxcjhelp.cnt
2010-06-08 19:18:01 1585 ----a-r- c:\windows\system32\lxcj.loc
2010-06-08 19:18:01 1488037 ----a-w- c:\windows\system32\lxcjhelp.hlp
2010-06-08 19:17:20 0 d-----w- c:\temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}
2010-06-08 19:15:42 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-06-08 19:15:42 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys
2010-06-08 19:15:30 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-06-08 19:15:30 15104 ----a-w- c:\windows\system32\dllcache\usbscan.sys
2010-06-08 19:15:30 0 d-----w- c:\program files\Lexmark 8300 Series
2010-06-08 19:15:26 87040 ----a-w- c:\windows\system32\wiafbdrv.dll
2010-06-08 19:15:26 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-06-08 19:12:44 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-06-08 19:12:44 32128 ----a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-05-21 19:11:39 0 d-----w- c:\windows\pss
2010-05-21 16:48:50 0 d-----w- c:\docume~1\hp_adm~1\applic~1\OpenOffice.org
2010-05-21 16:47:06 0 d-----w- c:\program files\JRE
2010-05-21 16:46:48 0 d-----w- c:\program files\OpenOffice.org 3

==================== Find3M ====================

2010-05-16 05:45:42 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-04 23:24:33 1832 --sha-r- c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF527_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.12_T050411_WXP2_L409_M895_J250_7AMD_8Athlon 64_92.19_#050802_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK
2010-04-29 22:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 22:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-28 14:44:02 54760 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2010-04-17 07:04:40 306032 ----a-w- c:\windows\WLXPGSS.SCR
2010-04-17 05:12:18 48464 ----a-w- c:\windows\system32\sirenacm.dll

============= FINISH: 16:45:22.62 ===============
Attached Files
File Type: zip Attach.zip (4.8 KB, 3 views)

__________________
Piper is offline  
Old 06-16-2010, 07:14 PM   #2
Security Team
Analyst
 
AdvancedSetup's Avatar
 
Join Date: Apr 2008
Location: US
Posts: 566
OS: Win7 Pro x64



Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum.

---------------------------------------------------------------------------------------------


  1. Download ComboFix from below:

    Combofix download


    * IMPORTANT !!! Place combofix.exe on your Desktop
  2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.


    You can get help on disabling your protection programs here
  3. Double click on combofix.exe & follow the prompts.
  4. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.

    Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





    The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

    With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.

    Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.

    ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:

    The Recovery Console was successfully installed.



    Click on Yes, to continue scanning for malware.
  5. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  6. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


    ---------------------------------------------------------------------------------------------
  7. Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ---------------------------------------------------------------------------------------------

__________________
AdvancedSetup is offline  
Old 06-16-2010, 08:06 PM   #3
Security Team
Analyst
 
Piper's Avatar
 
Join Date: Jun 2010
Location: California
Posts: 971
OS: Windows XP Service Pack 3



Hello AdvancedSetup. Thank you for your help.

I followed the steps you provided and ComboFix informed me that it found a RootKit. So I guess this is more than just adware after all.
But I'm glad ComboFix was able to find it!


Here is the ComboFix Log:

ComboFix 10-06-16.02 - HP_Administrator 06/16/2010 19:49:55.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.584 [GMT -7:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\xpsp1hfm.log

Infected copy of c:\windows\system32\drivers\netbt.sys was found and disinfected
Restored copy from - Kitty had a snack :p
.
((((((((((((((((((((((((( Files Created from 2010-05-17 to 2010-06-17 )))))))))))))))))))))))))))))))
.

2010-06-16 23:20 . 2010-06-16 23:21 -------- d-----w- c:\program files\Hijack This
2010-06-16 18:21 . 2010-06-16 19:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-06-16 18:21 . 2010-06-16 18:27 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-16 09:47 . 2010-06-16 09:47 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-06-16 09:43 . 2010-06-16 23:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-06-16 06:19 . 2010-06-16 06:19 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM
2010-06-16 06:19 . 2010-06-16 06:19 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-06-13 17:51 . 2010-06-13 17:51 -------- d-----w- c:\program files\Sophos
2010-06-11 00:40 . 2010-06-11 00:40 -------- d-sh--w- c:\windows\ftpcache
2010-06-10 02:42 . 2010-06-10 02:42 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\AnvSoft
2010-06-10 02:42 . 2010-06-10 02:42 -------- d-----w- c:\program files\AnvSoft
2010-06-10 02:25 . 2010-06-10 02:25 -------- d-----w- c:\program files\DVD Decrypter
2010-06-10 01:55 . 2010-06-10 01:55 -------- d-----w- c:\windows\Sun
2010-06-10 00:44 . 2010-06-15 21:07 -------- d-----w- c:\program files\Audacity
2010-06-08 19:22 . 2003-01-17 03:37 11264 ------w- c:\windows\system32\Spool\prtprocs\w32x86\lxPrint2000.dll
2010-06-08 19:21 . 2010-06-08 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\BVRP Software
2010-06-08 19:21 . 2010-06-08 19:21 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
2010-06-08 19:19 . 2010-06-08 19:21 -------- d-----w- c:\program files\Lexmark Applications
2010-06-08 19:19 . 2010-06-08 19:19 -------- d-----w- c:\windows\system32\color
2010-06-08 19:18 . 2010-06-14 18:23 -------- d-----w- c:\program files\Lx_cats
2010-06-08 19:15 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-06-08 19:15 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys
2010-06-08 19:15 . 2010-06-08 23:25 -------- d-----w- c:\program files\Lexmark 8300 Series
2010-06-08 19:15 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-06-08 19:15 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\dllcache\usbscan.sys
2010-06-08 19:15 . 2001-08-18 05:36 87040 ----a-w- c:\windows\system32\wiafbdrv.dll
2010-06-08 19:15 . 2001-08-18 05:36 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-06-08 19:12 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-06-08 19:12 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-06-01 20:26 . 2010-06-01 20:26 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Adobe
2010-06-01 20:26 . 2010-06-01 20:26 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\AdobeUM
2010-05-28 17:00 . 2010-05-28 17:00 503808 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c702136-n\msvcp71.dll
2010-05-28 17:00 . 2010-05-28 17:00 499712 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c702136-n\jmc.dll
2010-05-28 17:00 . 2010-05-28 17:00 348160 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c702136-n\msvcr71.dll
2010-05-28 17:00 . 2010-05-28 17:00 61440 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3dbc38f7-n\decora-sse.dll
2010-05-28 17:00 . 2010-05-28 17:00 12800 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3dbc38f7-n\decora-d3d.dll
2010-05-21 16:48 . 2010-06-09 18:48 1 ----a-w- c:\documents and settings\HP_Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-21 16:48 . 2010-05-21 16:48 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\OpenOffice.org
2010-05-21 16:47 . 2010-05-21 16:47 -------- d-----w- c:\program files\JRE
2010-05-21 16:46 . 2010-05-21 16:47 -------- d-----w- c:\program files\OpenOffice.org 3
2010-05-21 15:03 . 2010-05-21 15:03 -------- d-----w- c:\program files\Common Files\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-17 02:44 . 2010-05-16 05:05 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\U3
2010-06-08 19:22 . 2005-05-26 17:33 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-06 05:47 . 2010-05-16 05:47 439816 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Real\Update\setup3.10\setup.exe
2010-06-03 23:26 . 2005-05-26 17:46 -------- d-----w- c:\program files\Easy Internet signup
2010-05-21 19:31 . 2010-05-12 19:07 58048 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-21 16:46 . 2005-05-26 17:02 -------- d-----w- c:\program files\Java
2010-05-17 00:25 . 2010-05-17 00:25 -------- d-----w- c:\program files\MSBuild
2010-05-17 00:25 . 2010-05-17 00:25 -------- d-----w- c:\program files\Reference Assemblies
2010-05-17 00:17 . 2010-05-16 03:38 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-17 00:14 . 2010-05-17 00:14 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-05-16 05:46 . 2010-05-16 05:46 503808 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-15c87b3d-n\msvcp71.dll
2010-05-16 05:46 . 2010-05-16 05:46 499712 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-15c87b3d-n\jmc.dll
2010-05-16 05:46 . 2010-05-16 05:46 348160 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-15c87b3d-n\msvcr71.dll
2010-05-16 05:45 . 2010-05-16 05:45 61440 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-550a5d23-n\decora-sse.dll
2010-05-16 05:45 . 2010-05-16 05:45 12800 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-550a5d23-n\decora-d3d.dll
2010-05-16 05:45 . 2010-05-16 05:45 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-16 03:58 . 2010-05-16 03:58 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-05-16 03:37 . 2010-05-16 03:33 -------- d-----w- c:\program files\Windows Live
2010-05-16 03:35 . 2010-05-16 03:35 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-05-16 03:34 . 2010-05-16 03:34 -------- d-----w- c:\program files\Microsoft
2010-05-16 03:33 . 2010-05-16 03:33 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-05-16 03:26 . 2010-05-16 03:26 -------- d-----w- c:\program files\Common Files\Windows Live
2010-05-16 03:25 . 2010-05-16 03:25 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2010-05-16 03:25 . 2010-05-16 03:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-16 03:25 . 2010-05-16 03:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-16 03:21 . 2010-05-16 03:21 -------- d-----w- c:\program files\Alwil Software
2010-05-16 03:21 . 2010-05-16 03:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-05-16 03:07 . 2005-01-28 09:40 93511 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-05-16 03:07 . 2010-05-16 03:07 45056 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2010-05-16 03:07 . 2010-05-16 03:07 44032 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2010-05-16 02:39 . 2010-05-16 02:39 -------- d-----w- c:\program files\MSXML 4.0
2010-05-16 02:09 . 2010-05-16 01:55 -------- d-----w- c:\program files\Verizon Online
2010-05-16 02:09 . 2005-05-26 17:58 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-05-16 02:09 . 2005-05-26 17:58 -------- d-----w- c:\program files\Symantec
2010-05-16 01:59 . 2010-05-16 01:59 0 ----a-w- c:\windows\nsreg.dat
2010-05-16 01:57 . 2010-05-16 01:57 -------- d-----w- c:\program files\VZBB Toolbar
2010-05-16 01:55 . 2010-05-16 01:45 -------- d-----w- c:\program files\Common Files\Motive
2010-05-16 01:55 . 2010-05-16 01:55 -------- d-----w- c:\program files\Motive
2010-05-16 01:54 . 2010-05-16 01:54 -------- d-----w- c:\documents and settings\All Users\Application Data\MSN6
2010-05-16 01:54 . 2010-05-16 01:45 -------- d-----w- c:\program files\Common Files\Verizon Online
2010-05-16 01:53 . 2010-05-16 01:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2010-05-16 01:46 . 2010-05-16 01:46 2232 ----a-w- c:\windows\java\Packages\Data\RT3NJLJ7.DAT
2010-05-16 01:46 . 2010-05-16 01:46 155995 ----a-w- c:\windows\java\Packages\UK2F9JZ5.ZIP
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\4PFPJ779.DAT
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\MPZ1RPN1.DAT
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\Y977B9Z1.DAT
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\X3LRBVV5.DAT
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\ULFVJ79F.DAT
2010-05-12 19:00 . 2010-05-12 19:00 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Sonic
2010-05-12 18:59 . 2010-05-12 18:59 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Leadertech
2010-05-06 20:59 . 2010-05-16 03:21 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-05-06 20:59 . 2010-05-16 03:21 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-05-06 20:39 . 2010-05-16 03:21 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-05-06 20:39 . 2010-05-16 03:21 164048 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-05-06 20:34 . 2010-05-16 03:21 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-05-06 20:33 . 2010-05-16 03:21 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-05-06 20:33 . 2010-05-16 03:21 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-05-06 20:33 . 2010-05-16 03:21 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-05-06 20:33 . 2010-05-16 03:21 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-05-04 23:24 . 2010-05-04 23:24 1832 --sha-r- c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF527_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.12_T050411_WXP2_L409_M895_J250_7AMD_8Athlon 64_92.19_#050802_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK
2010-05-04 23:22 . 2010-05-04 23:22 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-04-29 22:39 . 2010-05-16 03:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 22:39 . 2010-05-16 03:25 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-28 14:44 . 2010-05-16 03:37 54760 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2010-04-17 07:04 . 2010-04-17 07:04 306032 ----a-w- c:\windows\WLXPGSS.SCR
2010-04-17 05:12 . 2010-04-17 05:12 48464 ----a-w- c:\windows\system32\sirenacm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-18 339968]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-05-26 180269]
"Motive SmartBridge"="c:\progra~1\VERIZO~1\SMARTB~1\MotiveSB.exe" [2002-05-18 327680]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"lxcjmon.exe"="c:\program files\Lexmark 8300 Series\lxcjmon.exe" [2005-09-30 200704]
"EzPrint"="c:\program files\Lexmark 8300 Series\ezprint.exe" [2006-04-19 94208]
"LXCJCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCJtime.dll" [2006-02-24 73728]

c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-5 258048]
Updates from HP.lnk - c:\program files\Updates from HP\309731\Program\Updates from HP.exe [2005-5-26 45056]
Verizon Online Support Center.lnk - c:\program files\Verizon Online\bin\matcli.exe [2010-5-15 204800]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\WINDOWS\\system32\\lxcjcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxcjpswx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5/15/2010 8:21 PM 164048]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/15/2010 8:21 PM 19024]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\1B.tmp --> c:\windows\system32\1B.tmp [?]
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ho_home
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\5phb5arb.default\
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-06-16 19:54
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCJCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCJtime.dll,_RunDLLEntry@16??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\1B.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-06-16 19:56:37
ComboFix-quarantined-files.txt 2010-06-17 02:56

Pre-Run: 216,628,711,424 bytes free
Post-Run: 216,616,595,456 bytes free

- - End Of File - - E4572521D6D5B5B6674C0C0E9144876E
__________________
Piper is offline  
Old 06-16-2010, 10:54 PM   #4
Security Team
Analyst
 
AdvancedSetup's Avatar
 
Join Date: Apr 2008
Location: US
Posts: 566
OS: Win7 Pro x64



STEP 01
Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines
Code:
DDS::
uInternet Settings,ProxyOverride = 127.0.0.1
Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:
  • Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
  • Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
  • A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
    When the scan completes Notepad will open with with your results log open. Do a File, Exit.
A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.


STEP 02
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 20 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 20 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u20 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u20-windows-i586.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

STEP 03
Please visit this site and restore Firefox back to the factory default settings.
Restore Firefox Default Settings Without Uninstalling It

STEP 04
What we need to do now is run this online scan to search for any remnants. It can take several hours, so please be patient and allow it to run it's full course.

Establish an internet connection & perform an online scan with Firefox or Internet Explorer at Kaspersky Online Scanner

**Note**

To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan.
Click Accept, when prompted to download and install the program files and database of malware definitions.
  • Click Run at the Security prompt.
  • The program will then begin downloading and installing and will also update the database.
  • Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.
  • Click the Save Report As... button.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
__________________
AdvancedSetup is offline  
Old 06-17-2010, 06:38 PM   #5
Security Team
Analyst
 
Piper's Avatar
 
Join Date: Jun 2010
Location: California
Posts: 971
OS: Windows XP Service Pack 3



Okay. Here are the ComboFix log and the Kaspersky Report.




ComboFix Log:


ComboFix 10-06-17.01 - HP_Administrator 06/17/2010 12:05:42.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.570 [GMT -7:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFscript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\win.com

.
((((((((((((((((((((((((( Files Created from 2010-05-17 to 2010-06-17 )))))))))))))))))))))))))))))))
.

2010-06-16 23:20 . 2010-06-16 23:21 -------- d-----w- c:\program files\Hijack This
2010-06-16 18:21 . 2010-06-16 19:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-06-16 18:21 . 2010-06-16 18:27 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-16 09:47 . 2010-06-16 09:47 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-06-16 09:43 . 2010-06-16 23:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-06-16 06:19 . 2010-06-16 06:19 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM
2010-06-16 06:19 . 2010-06-16 06:19 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-06-13 17:51 . 2010-06-13 17:51 -------- d-----w- c:\program files\Sophos
2010-06-11 00:40 . 2010-06-11 00:40 -------- d-sh--w- c:\windows\ftpcache
2010-06-10 02:42 . 2010-06-10 02:42 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\AnvSoft
2010-06-10 02:42 . 2010-06-10 02:42 -------- d-----w- c:\program files\AnvSoft
2010-06-10 02:25 . 2010-06-10 02:25 -------- d-----w- c:\program files\DVD Decrypter
2010-06-10 01:55 . 2010-06-10 01:55 -------- d-----w- c:\windows\Sun
2010-06-10 00:44 . 2010-06-15 21:07 -------- d-----w- c:\program files\Audacity
2010-06-08 19:22 . 2003-01-17 03:37 11264 ------w- c:\windows\system32\Spool\prtprocs\w32x86\lxPrint2000.dll
2010-06-08 19:21 . 2010-06-08 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\BVRP Software
2010-06-08 19:21 . 2010-06-08 19:21 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint
2010-06-08 19:19 . 2010-06-08 19:21 -------- d-----w- c:\program files\Lexmark Applications
2010-06-08 19:19 . 2010-06-08 19:19 -------- d-----w- c:\windows\system32\color
2010-06-08 19:18 . 2010-06-14 18:23 -------- d-----w- c:\program files\Lx_cats
2010-06-08 19:15 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-06-08 19:15 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys
2010-06-08 19:15 . 2010-06-08 23:25 -------- d-----w- c:\program files\Lexmark 8300 Series
2010-06-08 19:15 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-06-08 19:15 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\dllcache\usbscan.sys
2010-06-08 19:15 . 2001-08-18 05:36 87040 ----a-w- c:\windows\system32\wiafbdrv.dll
2010-06-08 19:15 . 2001-08-18 05:36 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-06-08 19:12 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-06-08 19:12 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-06-01 20:26 . 2010-06-01 20:26 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Adobe
2010-06-01 20:26 . 2010-06-01 20:26 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\AdobeUM
2010-05-28 17:00 . 2010-05-28 17:00 503808 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c702136-n\msvcp71.dll
2010-05-28 17:00 . 2010-05-28 17:00 499712 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c702136-n\jmc.dll
2010-05-28 17:00 . 2010-05-28 17:00 348160 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c702136-n\msvcr71.dll
2010-05-28 17:00 . 2010-05-28 17:00 61440 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3dbc38f7-n\decora-sse.dll
2010-05-28 17:00 . 2010-05-28 17:00 12800 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3dbc38f7-n\decora-d3d.dll
2010-05-21 16:48 . 2010-06-09 18:48 1 ----a-w- c:\documents and settings\HP_Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-21 16:48 . 2010-05-21 16:48 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\OpenOffice.org
2010-05-21 16:47 . 2010-05-21 16:47 -------- d-----w- c:\program files\JRE
2010-05-21 16:46 . 2010-05-21 16:47 -------- d-----w- c:\program files\OpenOffice.org 3
2010-05-21 15:03 . 2010-05-21 15:03 -------- d-----w- c:\program files\Common Files\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-17 02:59 . 2010-05-16 05:05 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\U3
2010-06-08 19:22 . 2005-05-26 17:33 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-06 05:47 . 2010-05-16 05:47 439816 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Real\Update\setup3.10\setup.exe
2010-06-03 23:26 . 2005-05-26 17:46 -------- d-----w- c:\program files\Easy Internet signup
2010-05-21 19:31 . 2010-05-12 19:07 58048 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-21 16:46 . 2005-05-26 17:02 -------- d-----w- c:\program files\Java
2010-05-17 00:25 . 2010-05-17 00:25 -------- d-----w- c:\program files\MSBuild
2010-05-17 00:25 . 2010-05-17 00:25 -------- d-----w- c:\program files\Reference Assemblies
2010-05-17 00:17 . 2010-05-16 03:38 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-17 00:14 . 2010-05-17 00:14 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-05-16 05:46 . 2010-05-16 05:46 503808 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-15c87b3d-n\msvcp71.dll
2010-05-16 05:46 . 2010-05-16 05:46 499712 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-15c87b3d-n\jmc.dll
2010-05-16 05:46 . 2010-05-16 05:46 348160 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-15c87b3d-n\msvcr71.dll
2010-05-16 05:45 . 2010-05-16 05:45 61440 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-550a5d23-n\decora-sse.dll
2010-05-16 05:45 . 2010-05-16 05:45 12800 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-550a5d23-n\decora-d3d.dll
2010-05-16 05:45 . 2010-05-16 05:45 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-16 03:58 . 2010-05-16 03:58 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-05-16 03:37 . 2010-05-16 03:33 -------- d-----w- c:\program files\Windows Live
2010-05-16 03:35 . 2010-05-16 03:35 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-05-16 03:34 . 2010-05-16 03:34 -------- d-----w- c:\program files\Microsoft
2010-05-16 03:33 . 2010-05-16 03:33 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-05-16 03:26 . 2010-05-16 03:26 -------- d-----w- c:\program files\Common Files\Windows Live
2010-05-16 03:25 . 2010-05-16 03:25 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2010-05-16 03:25 . 2010-05-16 03:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-16 03:25 . 2010-05-16 03:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-16 03:21 . 2010-05-16 03:21 -------- d-----w- c:\program files\Alwil Software
2010-05-16 03:21 . 2010-05-16 03:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-05-16 03:07 . 2005-01-28 09:40 93511 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-05-16 03:07 . 2010-05-16 03:07 45056 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2010-05-16 03:07 . 2010-05-16 03:07 44032 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2010-05-16 02:39 . 2010-05-16 02:39 -------- d-----w- c:\program files\MSXML 4.0
2010-05-16 02:09 . 2010-05-16 01:55 -------- d-----w- c:\program files\Verizon Online
2010-05-16 02:09 . 2005-05-26 17:58 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-05-16 02:09 . 2005-05-26 17:58 -------- d-----w- c:\program files\Symantec
2010-05-16 01:59 . 2010-05-16 01:59 0 ----a-w- c:\windows\nsreg.dat
2010-05-16 01:57 . 2010-05-16 01:57 -------- d-----w- c:\program files\VZBB Toolbar
2010-05-16 01:55 . 2010-05-16 01:45 -------- d-----w- c:\program files\Common Files\Motive
2010-05-16 01:55 . 2010-05-16 01:55 -------- d-----w- c:\program files\Motive
2010-05-16 01:54 . 2010-05-16 01:54 -------- d-----w- c:\documents and settings\All Users\Application Data\MSN6
2010-05-16 01:54 . 2010-05-16 01:45 -------- d-----w- c:\program files\Common Files\Verizon Online
2010-05-16 01:53 . 2010-05-16 01:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2010-05-16 01:46 . 2010-05-16 01:46 2232 ----a-w- c:\windows\java\Packages\Data\RT3NJLJ7.DAT
2010-05-16 01:46 . 2010-05-16 01:46 155995 ----a-w- c:\windows\java\Packages\UK2F9JZ5.ZIP
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\4PFPJ779.DAT
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\MPZ1RPN1.DAT
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\Y977B9Z1.DAT
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\X3LRBVV5.DAT
2010-05-16 01:46 . 2010-05-16 01:46 2678 ----a-w- c:\windows\java\Packages\Data\ULFVJ79F.DAT
2010-05-12 19:00 . 2010-05-12 19:00 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Sonic
2010-05-12 18:59 . 2010-05-12 18:59 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Leadertech
2010-05-06 20:59 . 2010-05-16 03:21 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-05-06 20:59 . 2010-05-16 03:21 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-05-06 20:39 . 2010-05-16 03:21 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-05-06 20:39 . 2010-05-16 03:21 164048 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-05-06 20:34 . 2010-05-16 03:21 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-05-06 20:33 . 2010-05-16 03:21 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-05-06 20:33 . 2010-05-16 03:21 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-05-06 20:33 . 2010-05-16 03:21 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-05-06 20:33 . 2010-05-16 03:21 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-05-04 23:24 . 2010-05-04 23:24 1832 --sha-r- c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF527_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.12_T050411_WXP2_L409_M895_J250_7AMD_8Athlon 64_92.19_#050802_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK
2010-05-04 23:22 . 2010-05-04 23:22 -------- d---a-w- c:\program files\Common Files\LightScribe
2010-04-29 22:39 . 2010-05-16 03:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 22:39 . 2010-05-16 03:25 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-28 14:44 . 2010-05-16 03:37 54760 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2010-04-17 07:04 . 2010-04-17 07:04 306032 ----a-w- c:\windows\WLXPGSS.SCR
2010-04-17 05:12 . 2010-04-17 05:12 48464 ----a-w- c:\windows\system32\sirenacm.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-06-17_02.55.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-17 18:54 . 2010-06-17 18:54 16384 c:\windows\Temp\Perflib_Perfdata_600.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-18 339968]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-05-26 180269]
"Motive SmartBridge"="c:\progra~1\VERIZO~1\SMARTB~1\MotiveSB.exe" [2002-05-18 327680]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"lxcjmon.exe"="c:\program files\Lexmark 8300 Series\lxcjmon.exe" [2005-09-30 200704]
"EzPrint"="c:\program files\Lexmark 8300 Series\ezprint.exe" [2006-04-19 94208]
"LXCJCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCJtime.dll" [2006-02-24 73728]

c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-5 258048]
Updates from HP.lnk - c:\program files\Updates from HP\309731\Program\Updates from HP.exe [2005-5-26 45056]
Verizon Online Support Center.lnk - c:\program files\Verizon Online\bin\matcli.exe [2010-5-15 204800]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\WINDOWS\\system32\\lxcjcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxcjpswx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5/15/2010 8:21 PM 164048]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/15/2010 8:21 PM 19024]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\1B.tmp --> c:\windows\system32\1B.tmp [?]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ho_home
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\5phb5arb.default\
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-06-17 12:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCJCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCJtime.dll,_RunDLLEntry@16??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\1B.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-06-17 12:11:35
ComboFix-quarantined-files.txt 2010-06-17 19:11
ComboFix2.txt 2010-06-17 02:56

Pre-Run: 216,508,497,920 bytes free
Post-Run: 216,497,352,704 bytes free

- - End Of File - - C7A78CE5EF59C260AC1BA3C0B08385DD









Kaspersky Report:


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, June 17, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, June 17, 2010 15:53:22
Records in database: 4288810
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\

Scan statistics:
Objects scanned: 96828
Threats found: 2
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 02:35:41


File name / Threat / Threats count
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP49\A0026275.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.b 1
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP50\A0026620.sys Infected: Rootkit.Win32.TDSS.ap 1

Selected area has been scanned.
__________________
Piper is offline  
Old 06-17-2010, 07:03 PM   #6
Security Team
Analyst
 
AdvancedSetup's Avatar
 
Join Date: Apr 2008
Location: US
Posts: 566
OS: Win7 Pro x64



The files found by Kaspersky will be removed when we finish up with Combofix. Those files are in the System Recovery area.

Please run CF one more time as shown below.

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines
Code:
http://www.techsupportforum.com/f50/constant-pop-ups-in-firefox-adware-490701.html#post2767480
collect::
c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF527_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.12_T050411_WXP2_L409_M895_J250_7AMD_8Athlon 64_92.19_#050802_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK
Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:
  • Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
  • Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
  • A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
    When the scan completes Notepad will open with with your results log open. Do a File, Exit.
A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.
__________________
AdvancedSetup is offline  
Old 06-18-2010, 11:36 AM   #7
Security Team
Analyst
 
Piper's Avatar
 
Join Date: Jun 2010
Location: California
Posts: 971
OS: Windows XP Service Pack 3



Wait-- before I use that code, I just want to double-check...

I am really supposed to use that whole thing? Because the first part of it looks like a link to a new post for this thread. Is that actually a part of the code? I just wanted to ask to be sure, since I wouldn't want anything to go wrong with ComboFix. Better safe than sorry!
__________________
Piper is offline  
Old 06-18-2010, 02:18 PM   #8
Security Team
Analyst
 
AdvancedSetup's Avatar
 
Join Date: Apr 2008
Location: US
Posts: 566
OS: Win7 Pro x64



Yes it's actually correct but after further researching that file name looks like it might be ok so for now hold off and do not run it.

Not a very well chosen name but it appears the listed file may be related to your LightScribe software for burning labels with your CD/DVD burner.

I don't have this driver name on any of my systems and neither do some others that I've checked with, but other logs do seem to indicate that its possible to have this file.

If you can, please browse to that location and see if you can zip a copy of it and attach it or get more details about it for me.

How is the computer running otherwise now?
__________________
AdvancedSetup is offline  
Old 06-18-2010, 03:01 PM   #9
Security Team
Analyst
 
Piper's Avatar
 
Join Date: Jun 2010
Location: California
Posts: 971
OS: Windows XP Service Pack 3



I would be happy to zip a copy of the file for you. But I can browse only as far as the drivers folder as I am not really sure what to do next. What exactly is the name of the driver I am looking for? I'm a bit confused. Is that whole long part after "drivers\" the name? Because I don't see anything with that name in the drivers folder (even if I use the "Show Hidden Files/Folders" option).

My computer seems to be running fine, though. No problems so far! =)
__________________
Piper is offline  
Old 06-18-2010, 04:40 PM   #10
Security Team
Analyst
 
AdvancedSetup's Avatar
 
Join Date: Apr 2008
Location: US
Posts: 566
OS: Win7 Pro x64



The file name starts out as: 103C_HP_CPC_

The full name and path is as shown according to the logs. With such a long name that is very abnormal.

c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF527_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.12_T050411_WXP2_L409_M895_J250_7AMD_8Athlon 64_92.19_#050802_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK



Reconfigure Windows XP to show hidden files:
To enable the viewing of Hidden files follow these steps:

* Close all programs so that you are at your desktop.
* Double-click on the My Computer icon.
* Select the Tools menu and click Folder Options.
* After the new window appears select the View tab.
* Put a checkmark in the checkbox labeled Display the contents of system folders.
* Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
* Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
* Remove the checkmark from the checkbox labeled Hide protected operating system files.
* Press the Apply button and then the OK button and exit My Computer.
* Now your computer is configured to show all hidden files.
__________________
AdvancedSetup is offline  
Old 06-19-2010, 12:13 PM   #11
Security Team
Analyst
 
Piper's Avatar
 
Join Date: Jun 2010
Location: California
Posts: 971
OS: Windows XP Service Pack 3



Okay. That is why I was confused; the file name just seemed too long.

I did what you instructed and managed to find the file. But there's a new problem now: it can't be copied.

When I try to copy it, it says:

Quote:
Cannot copy 103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF527_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.12_T050411_WXP2_L409_M895_J250_7AMD_8Athlon 64_92.19_#050802_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216: The file name you specified is not valid or too long. Specify a different file name.
Should I zip the original file (I'm guessing probably not, but if you tell me it is okay to do that, I will), or is there a way to make it possible to copy it?


Also, I looked at the file's properties, just in case that information might be useful to you in some way. Here is what it says under the General tab (everything under the Summary tab is blank):

Type of file: MRK File
Opens with: Unknown application
Location: C:\WINDOWS\system32\drivers
Size: 1.78 KB (1,832 bytes)
Size on disk: 4.00 KB (4,096 bytes)
Created: Tuesday, May 04, 2010, 4:24:30 PM
Modified: Tuesday, May 04, 2010, 4:24:33 PM
Accessed: Today, June 19, 2010, 12:07:28 PM
Attributes: Read Only (checked) Hidden (checked)
__________________
Piper is offline  
Old 06-19-2010, 02:09 PM   #12
Security Team
Analyst
 
Piper's Avatar
 
Join Date: Jun 2010
Location: California
Posts: 971
OS: Windows XP Service Pack 3



Sorry for double-posting, but I found a way to make a copy of the file. I copied it onto a USB (and for some reason, it worked that way). Then I zipped the copy like you asked and I have attached it to this post.
__________________
Piper is offline  
Old 06-19-2010, 05:26 PM   #13
Security Team
Analyst
 
AdvancedSetup's Avatar
 
Join Date: Apr 2008
Location: US
Posts: 566
OS: Win7 Pro x64



I see what it is. Its basically just a manufacturer hardware inventory script.
It is safe and is only a text file.


WMI,Win32_ComputerSystemProduct,Vendor,HP Pavilion 061
WMI,Win32_ComputerSystemProduct,Name,PX769AA-ABA a1130n
WMI,Win32_SystemEnclosure,ChassisTypes,3
WMI,Win32_ComputerSystemProduct,Vendor,HP Pavilion 061
WMI,Win32_ComputerSystemProduct,IdentifyingNumber,MXF5270344 NA570
FILE,HPSoftwareBuildID,C:\hp\support\build.txt,53NAsyEPC2
WMI,Win32_BaseBoard,Product,ALBACORE
WMI,Win32_BaseBoard,Manufacturer,MSI
WMI,Win32_BaseBoard,Version,1.0
WMI,win32_BIOS,SMBIOSBIOSVersion,3.12
WMI,win32_BIOS,ReleaseDate,20050411000000.000000+000
WMI,Win32_OperatingSystem,Caption,Microsoft Windows XP Professional
WMI,Win32_OperatingSystem,ServicePackMajorVersion,2
WMI,Win32_OperatingSystem,OSLanguage,1033
WMI,Win32_OperatingSystem,TotalVisibleMemorySize,915952
WMI,win32_DiskDrive,Size,250056253440;;;;
WMI,win32_Processor,Manufacturer,AuthenticAMD
WMI,win32_Processor,Name,AMD Athlon(tm) 64 Processor 3500+
WMI,win32_Processor,MaxClockSpeed,2188
WMI,win32_NetworkAdapter,PnPDeviceID,10EC8139
WMI,win32_POTSModem,PnPDeviceID,11C1048C
WMI,win32_VideoController,PnPDeviceID,10025954
WMI,win32_CDROMDrive,Name,HP DVD Writer 640c;IDE-DVD DROM6216
WMI,win32_DesktopMonitor,PNPDeviceID,DISPLAY\GWY06E6\5&2E52724E&0&10000080&01&05
WMI,win32_DiskDrive,Model,ST3250823AS;Generic USB CF Reader USB Device;Generic USB MS Reader USB Device;Generic USB SD Reader USB Device;Generic USB SM Reader USB Device
WMI,win32_VideoController,DriverVersion,6.14.10.6525
WMI,win32_SoundDevice,PnPDeviceID,10024370
WMI,Win32_ComputerSystemProduct,Vendor,HP Pavilion 061
WMI,Win32_ComputerSystemProduct,Version,0ny1114RE101ALBAC00
WMI,win32_USBController,PnPDeviceID,10024374
WMI,win32_1394Controller,PnPDeviceID,11063044
WMI,win32_PCMCIAController,PnPDeviceID,
WMI,win32_SCSIController,PnPDeviceID,






We should be done here. Some final housekeeping instructions, and protection information for you.

Your logs appear clean.You should be good to go. We still have a few items to address.

Disable your AntiVirus temporarily so that it does not block removal of Combofix.

Press the Windows key + R -> in the Run box which opens -> copy/paste in the following single line command & click OK

ComboFix /Uninstall



This will uninstall ComboFix. It will also implement some cleanup procedures.

Re-enable your AntiVirus now.

Delete any remaining tools we've used (DDS and GMER) and logs from them.

Empty your Recycle Bin.


============================================

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:
  • Microsoft Windows Update -

    To update Windows, click on Start > Windows Update (or Start > All Programs > Windows Update if you are using the new Vista Start Menu). If the Windows Update is not found there, go to this link - http://update.microsoft.com/ .

    This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites - green to go, yellow for caution and red to stop, helping you avoid the dangerous sites. WOT has an addon available for both Firefox and IE.

  • Winpatrol

    Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.

    You can get a free copy of Winpatrol or use the Plus version for more features.

    You can read Winpatrol's FAQ if you run into problems.

  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  • ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

    Do not install more than one AntiVirus program because they will conflict with each other.

  • Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

  • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

Review the security settings for Internet Explorer here
Securing Your Web Browser

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
AdvancedSetup is offline  
Old 06-19-2010, 08:56 PM   #14
Security Team
Analyst
 
Piper's Avatar
 
Join Date: Jun 2010
Location: California
Posts: 971
OS: Windows XP Service Pack 3



Good to know that the file is harmless. =)

Thank you SO much for all the time and effort you put into helping me! I'm glad that my computer is back to normal and I really appreciate the links you gave me for those useful programs and articles.

I have uninstalled ComboFix and removed the other programs and files. Right now I am getting the Windows Updates I need and, after that, I'm sure I'll be installing some of those programs you listed.

Thanks again for all of your help! You saved my computer from one problem and even helped me learn how to prevent future ones. I can't thank you enough!!
__________________
Piper is offline  
Old 06-20-2010, 02:05 PM   #15
Security Team
Analyst
 
AdvancedSetup's Avatar
 
Join Date: Apr 2008
Location: US
Posts: 566
OS: Win7 Pro x64



You're very welcome. Take care and stay safe out there.

__________________
AdvancedSetup is offline  
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2


All times are GMT -7. The time now is 12:35 PM.


Copyright 2001 - 2014, Tech Support Forum

Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts