Cannot update virus definitions or goto certain sites

misbhavin · 12-29-2008, 03:46 PM

I tried to run the "first steps" as instructed by Amateur.
Below is the result of the DDS.txt:

DDS (Version 1.1.0) - NTFSx86
Run by Vinnie Cherrone at 14:57:06.70 on Mon 12/29/2008
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.634 [GMT -6:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
E:\Tools\dds.scr

============== Pseudo HJT Report ===============

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uWindow Title = Windows Internet Explorer provided by Road Runner High Speed Online
uStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
uDefault_Page_URL = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
mDefault_Page_URL = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
mStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
BHO: NoExplorer - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar4.dll
TB: {A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [Yahoo! Pager] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [CTHelper] CTHELPER.EXE
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe
mRun: [CTDVDDET] "c:\program files\creative\sound blaster x-fi\dvdaudio\CTDVDDET.EXE"
mRun: [VolPanel] "c:\program files\creative\sound blaster x-fi\volume panel\VolPanel.exe" /r
mRun: [AudioDrvEmulator] "c:\program files\creative\shared files\module loader\dllml.exe" -1 audiodrvemulator "c:\program files\creative\shared files\module loader\audio emulator\AudDrvEm.dll"
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [<NO NAME>]
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [MMTray] "c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe"
mRun: [DLCCCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCCtime.dll,_RunDLLEntry@16
mRun: [dlccmon.exe] "c:\program files\dell photo aio printer 924\dlccmon.exe"
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [YMailAdvisor] "c:\program files\yahoo!\common\YMailAdvisor.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
AppInit_DLLs: karna.dat
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\vinnie~1\applic~1\mozilla\firefox\profiles\u4ylf2yb.default\
FF - plugin: c:\progra~1\netscape\commun~1\program\plugins\NP32DSW.DLL
FF - plugin: c:\progra~1\netscape\commun~1\program\plugins\npaudio.dll
FF - plugin: c:\progra~1\netscape\commun~1\program\plugins\npavi32.dll
FF - plugin: c:\progra~1\netscape\commun~1\program\plugins\NPBeatSP.dll
FF - plugin: c:\progra~1\netscape\commun~1\program\plugins\npdrmv2.dll
FF - plugin: c:\progra~1\netscape\commun~1\program\plugins\npdsplay.dll
FF - plugin: c:\progra~1\netscape\commun~1\program\plugins\npnul32.dll
FF - plugin: c:\progra~1\netscape\commun~1\program\plugins\NPSWF32.dll
FF - plugin: c:\progra~1\netscape\commun~1\program\plugins\npwmsdrm.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\program files\yahoo!\common\npyaxmpb.dll
FF - plugin: c:\program files\yahoo!\shared\npYState.dll

============= SERVICES / DRIVERS ===============

=============== Created Last 30 ================

2008-12-14 21:38 <DIR> --d----- c:\windows\system32\NtmsData
2008-12-14 18:01 <DIR> --d----- c:\program files\Trend Micro
2008-12-14 16:46 73 a------- c:\windows\st_affiliate.ini

==================== Find3M ====================

2008-10-24 05:21 455,296 -------- c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 06:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-23 06:36 286,720 -------- c:\windows\system32\dllcache\gdi32.dll
2008-10-17 02:08 3,593,216 -------- c:\windows\system32\dllcache\mshtml.dll
2008-10-16 14:13 1,809,944 a------- c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:13 202,776 a------- c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:12 323,608 a------- c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:12 561,688 a------- c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:09 92,696 a------- c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 51,224 a------- c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:08 34,328 a------- c:\windows\system32\dllcache\wups.dll
2008-10-16 07:11 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 07:11 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2008-10-15 10:34 337,408 -------- c:\windows\system32\dllcache\netapi32.dll
2008-10-15 01:06 633,632 -------- c:\windows\system32\dllcache\iexplore.exe
2008-10-15 01:04 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2008-10-03 19:05 4,184 a--sh--- c:\windows\system32\KGyGaAvL.sys
2008-10-03 04:02 247,326 a------- c:\windows\system32\strmdll.dll
2008-10-03 04:02 247,326 -------- c:\windows\system32\dllcache\strmdll.dll
2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll
2008-01-08 18:32 56 ---shr-- c:\windows\system32\0DC36E3687.sys
2008-08-21 14:18 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082120080822\index.dat

============= FINISH: 14:58:22.12 ===============

I was unable to run gmer.exe with success, so it is not attached.
I did attach a screen shot of the processes so that you can see it was running. I even tried changing the priority to get it to go with no success. I figured if you saw which process was blocking its progress I could try to end it and run again.
I apologize in advance if I messed this up again.
I've never posted before the first time below.
I got an error when trying to post to malware , so I posted it to security
Please let me know if there is anything additional needed.
I appreciate the assistance as does my friend.

This is my original post:
I have a friend who called me because his McAfee wouldn't update. After some time on the phone, we realized he also could not get to certain sites e.g McAfee.com and norton.com. It seems he has a browser hijacker acting as a proxy maybe. I had him D/L firefox with the same results. He seems to be experiencing blocking and can't get a good scan of the system. I'm attaching his HiJackThis log. I do mostly H/W and don't think this is H/W related. Any help would be GREATLY appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:17:59 PM, on 12/14/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Documents and Settings\Vinnie Cherrone\Desktop\HJTInstall.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.rr.com/browsers/redirect/...1HPRR&d=homerr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/browsers/redirect/...1HPRR&d=homerr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.rr.com/browsers/redirect/...1HPRR&d=homerr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/browsers/redirect/...1HPRR&d=homerr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Road Runner High Speed Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O20 - AppInit_DLLs: karna.dat
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: dlcc_device - - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

MIS

misbhavin · 01-02-2009, 08:48 AM

BUMP, please

**chemist** · 01-02-2009, 07:00 PM

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

Download Combo-Fix and the Microsoft file to a USB drive on another computer and transfer the files to your desktop.

------------------------------------------------------

Download Combo-Fix.exe and Save it to your Desktop.

* IMPORTANT !!! Save Combo-Fix.exe to your Desktop

------------------------------------------------------

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Download the file from this Microsoft page:

http://www.microsoft.com/downloads/d...displaylang=en

Do not be concerned that this file is for SP2 and you have SP3. It will work just fine on your system.

Save it as it is originally named to your Desktop.

------------------------------------------------------

Transfer all files you just downloaded to the desktop of the infected computer.

------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools.

Drag the setup package onto Combo-Fix.exe and drop it.
Follow the prompts to start Combo-Fix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
At the next prompt, click Yes to run the full Combo-Fix scan.
When the tool is finished, it shall produce a log for you.

Please post the C:\ComboFix.txt in your next reply.

------------------------------------------------------

misbhavin · 01-05-2009, 04:12 PM

Chemist,

Thank you so much for your help!

I ran the ComboFix twice because I got an error on the console install the first time.
below find the logs with ComboFixLog.txt being without the console installed and ComboFixLog2.txt after. I am sorry for the redundancy but didn't want to accidently lose any important info. I know my friend plays online poker, but have his permission to remove it if this is the cause (or a contributor) of his problems, which I told him I expected.

ComboFix 09-01-02.01 - Vinnie Cherrone 2009-01-05 16:51:06.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.724 [GMT -6:00]
Running from: c:\documents and settings\Vinnie Cherrone\Desktop\Combo-Fix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\_scui.cpl
c:\windows\system32\DelSelf.bat
c:\windows\system32\drivers\TDSSpqlt.sys
c:\windows\system32\TDSShrsr.dll
c:\windows\system32\TDSSkkai.log
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSoiqn.dll
c:\windows\system32\TDSSorvd.dat
c:\windows\system32\TDSSrhyp.log
c:\windows\system32\TDSSrtqp.dll
c:\windows\system32\TDSSsihc.dll
c:\windows\system32\TDSSxfum.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys

((((((((((((((((((((((((( Files Created from 2008-12-05 to 2009-01-05 )))))))))))))))))))))))))))))))
.

2008-12-29 15:27 . 2008-12-29 15:27 <DIR> d-------- C:\Tools
2008-12-14 21:38 . 2008-12-14 21:38 <DIR> d-------- c:\windows\system32\NtmsData
2008-12-14 18:01 . 2008-12-14 18:01 <DIR> d-------- c:\program files\Trend Micro
2008-12-14 16:46 . 2008-12-14 16:46 73 --a------ c:\windows\st_affiliate.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-29 20:49 --------- d-----w c:\program files\Dl_cats
2008-12-14 22:53 --------- d-----w c:\program files\McAfee.com
2008-12-14 22:53 --------- d-----w c:\program files\McAfee
2008-12-14 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2008-11-29 11:50 --------- d--h--r c:\documents and settings\Vinnie Cherrone\Application Data\yahoo!
2008-11-29 11:50 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo!
2008-11-24 01:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2008-11-14 23:10 --------- d-----w c:\program files\AntivirusPro2009
2008-11-14 22:55 18,003 ----a-w c:\program files\Common Files\ukat.bin
2008-11-14 22:55 17,890 ----a-w c:\windows\asuvy.dll
2008-11-14 22:55 15,746 ----a-w c:\documents and settings\All Users\Application Data\hudud.exe
2008-11-14 22:55 13,534 ----a-w c:\program files\Common Files\iluc.dll
2008-11-14 22:55 13,183 ----a-w c:\windows\ebuq.pif
2008-11-14 22:55 13,139 ----a-w c:\documents and settings\Vinnie Cherrone\Application Data\uwacoqiz.dat
2008-11-14 22:55 12,752 ----a-w c:\windows\ydotileci.exe
2008-11-14 22:55 12,678 ----a-w c:\windows\iwaquxeh.bat
2008-11-14 22:55 12,664 ----a-w c:\program files\Common Files\uxiwutugez.bat
2008-11-14 22:55 10,426 ----a-w c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe
2008-11-14 22:55 10,280 ----a-w c:\windows\azuduniby.reg
2008-11-12 03:51 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Apple Computer
2008-11-12 03:50 --------- d-----w c:\program files\Apple Software Update
2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Sonic
2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Leadertech
2008-01-09 00:32 56 --sh--r c:\windows\system32\0DC36E3687.sys
2008-10-04 01:05 88 --sh--r c:\windows\system32\87366EC30D.sys
2008-10-04 01:05 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys
2008-08-21 20:18 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
"CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-07-10 169984]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-09-08 110592]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 73728]
"dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"CTHelper"="CTHELPER.EXE" [2005-11-08 c:\windows\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-10 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - (no file)

.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
mStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-05 16:53:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3953387213-346972422-2963791592-1006\Software\Microsoft\SystemCertificates\AddressBook*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\CTXFISPI.EXE
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe
c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
c:\windows\system32\dlcccoms.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-05 16:55:37 - machine was rebooted [Vinnie Cherrone]
ComboFix-quarantined-files.txt 2009-01-05 22:55:35

Pre-Run: 144,459,833,344 bytes free
Post-Run: 144,424,075,264 bytes free

165 --- E O F --- 2008-12-14 23:28:36

ComboFixLog2.txt
ComboFix 09-01-05.03 - Vinnie Cherrone 2009-01-05 16:59:50.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.627 [GMT -6:00]
Running from: c:\documents and settings\Vinnie Cherrone\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Vinnie Cherrone\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-05 to 2009-01-05 )))))))))))))))))))))))))))))))
.

2008-12-29 15:27 . 2008-12-29 15:27 <DIR> d-------- C:\Tools
2008-12-14 21:38 . 2008-12-14 21:38 <DIR> d-------- c:\windows\system32\NtmsData
2008-12-14 18:01 . 2008-12-14 18:01 <DIR> d-------- c:\program files\Trend Micro
2008-12-14 16:46 . 2008-12-14 16:46 73 --a------ c:\windows\st_affiliate.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-29 20:49 --------- d-----w c:\program files\Dl_cats
2008-12-14 22:53 --------- d-----w c:\program files\McAfee.com
2008-12-14 22:53 --------- d-----w c:\program files\McAfee
2008-12-14 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2008-11-29 11:50 --------- d--h--r c:\documents and settings\Vinnie Cherrone\Application Data\yahoo!
2008-11-29 11:50 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo!
2008-11-24 01:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2008-11-14 23:10 --------- d-----w c:\program files\AntivirusPro2009
2008-11-12 03:51 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Apple Computer
2008-11-12 03:50 --------- d-----w c:\program files\Apple Software Update
2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Sonic
2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Leadertech
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-17 08:08 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-10-16 20:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 20:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:11 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-10-15 16:34 337,408 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-15 07:06 633,632 ------w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-01-09 00:32 56 --sh--r c:\windows\system32\0DC36E3687.sys
2008-10-04 01:05 88 --sh--r c:\windows\system32\87366EC30D.sys
2008-10-04 01:05 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys
2008-08-21 20:18 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
"CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-07-10 169984]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-09-08 110592]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 73728]
"dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"CTHelper"="CTHELPER.EXE" [2005-11-08 c:\windows\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-10 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
mStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-05 17:00:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-05 17:01:28
ComboFix-quarantined-files.txt 2009-01-05 23:01:19
ComboFix2.txt 2009-01-05 22:55:38

Pre-Run: 144,381,190,144 bytes free
Post-Run: 144,325,742,592 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

145 --- E O F --- 2008-12-14 23:28:36

I appreciate your time.

Mis

**chemist** · 01-05-2009, 05:59 PM

Hello, misbhavin.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists:

Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here

If you decide to uninstall it, also delete the following Folders if they still exist:

C:\Program Files\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint

------------------------------------------------------

I see you have WildTangent Web Driver installed on your system. Although not technically spyware, it does have built-in components to update itself and collect information about your computer. We recommend uninstalling it. Please read here for information, removal instructions, and a link to an automatic removal tool.

If you uninstall it, delete the following Folder if it still exists:

C:\Program Files\WildTangent

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the quotebox below into Notepad:

Quote:

FileLook::
c:\windows\asuvy.dll
c:\windows\ydotileci.exe

Folder::
c:\program files\AntivirusPro2009

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

------------------------------------------------------

**chemist** · 01-08-2009, 02:57 PM

Still with us? Any trouble with those last instructions?

misbhavin · 01-08-2009, 05:50 PM

Chemist,

I am so sorry. I had another system a friend gave with with a bad power supply.
The parts arrived Tuesday and I had to deliver the system an hour away today.
I will be working on the instructions you gave me tomorrow.
Everything seems clear from your instructions.
Sorry for the delay, I know you are very busy!!!
I will post results tomorrow.

misbhavin · 01-09-2009, 10:20 AM

Hi Chemist,

I do have a question.
Shall I start with a fresh ComboFix or will the copy that I dropped the console into be OK?
I will wait to do until this afternoon.
If I don't hear back I will try both ways.
I do not want to take up more of your time.
Thanks for our patience.

Mis

**chemist** · 01-09-2009, 11:25 AM

If you have an active internet connection, ComboFix will ask if you want to update if one is available. You can always delete your existing copy and download a fresh copy.

misbhavin · 01-09-2009, 06:23 PM

Chemist,

Thank you for the quick reply.
I used a fresh ComboFix with the script dropped in.
Below is the log file.

ComboFix 09-01-09.01 - Vinnie Cherrone 2009-01-09 19:14:49.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.637 [GMT -6:00]
Running from: c:\documents and settings\Vinnie Cherrone\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Vinnie Cherrone\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\AntivirusPro2009
c:\program files\AntivirusPro2009\AntivirusPro2009.cfg
c:\program files\AntivirusPro2009\AVEngn.dll
c:\program files\AntivirusPro2009\data\daily.cvd
c:\program files\AntivirusPro2009\htmlayout.dll
c:\program files\AntivirusPro2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\program files\AntivirusPro2009\Microsoft.VC80.CRT\msvcm80.dll
c:\program files\AntivirusPro2009\Microsoft.VC80.CRT\msvcp80.dll
c:\program files\AntivirusPro2009\Microsoft.VC80.CRT\msvcr80.dll
c:\program files\AntivirusPro2009\pthreadVC2.dll
c:\program files\AntivirusPro2009\wscui.cpl

.
((((((((((((((((((((((((( Files Created from 2008-12-10 to 2009-01-10 )))))))))))))))))))))))))))))))
.

2008-12-29 15:27 . 2008-12-29 15:27 <DIR> d-------- C:\Tools
2008-12-14 21:38 . 2008-12-14 21:38 <DIR> d-------- c:\windows\system32\NtmsData
2008-12-14 18:01 . 2008-12-14 18:01 <DIR> d-------- c:\program files\Trend Micro
2008-12-14 16:46 . 2008-12-14 16:46 73 --a------ c:\windows\st_affiliate.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-29 20:49 --------- d-----w c:\program files\Dl_cats
2008-12-14 22:53 --------- d-----w c:\program files\McAfee.com
2008-12-14 22:53 --------- d-----w c:\program files\McAfee
2008-12-14 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2008-11-29 11:50 --------- d--h--r c:\documents and settings\Vinnie Cherrone\Application Data\yahoo!
2008-11-29 11:50 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo!
2008-11-24 01:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2008-11-14 22:55 18,003 ----a-w c:\program files\Common Files\ukat.bin
2008-11-14 22:55 17,890 ----a-w c:\windows\asuvy.dll
2008-11-14 22:55 15,746 ----a-w c:\documents and settings\All Users\Application Data\hudud.exe
2008-11-14 22:55 13,534 ----a-w c:\program files\Common Files\iluc.dll
2008-11-14 22:55 13,183 ----a-w c:\windows\ebuq.pif
2008-11-14 22:55 13,139 ----a-w c:\documents and settings\Vinnie Cherrone\Application Data\uwacoqiz.dat
2008-11-14 22:55 12,752 ----a-w c:\windows\ydotileci.exe
2008-11-14 22:55 12,678 ----a-w c:\windows\iwaquxeh.bat
2008-11-14 22:55 12,664 ----a-w c:\program files\Common Files\uxiwutugez.bat
2008-11-14 22:55 10,426 ----a-w c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe
2008-11-14 22:55 10,280 ----a-w c:\windows\azuduniby.reg
2008-11-12 03:51 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Apple Computer
2008-11-12 03:50 --------- d-----w c:\program files\Apple Software Update
2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Sonic
2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Leadertech
2008-01-09 00:32 56 --sh--r c:\windows\system32\0DC36E3687.sys
2008-10-04 01:05 88 --sh--r c:\windows\system32\87366EC30D.sys
2008-10-04 01:05 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys
2008-08-21 20:18 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\asuvy.dll -- Not a PE file.
MD5: 55aa78008101cf7880cfd347b44b2b03

c:\windows\ydotileci.exe -- Not a PE file.
MD5: b3eb4c4ae0132bb23105090d6b79e19d

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
"CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-07-10 169984]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-09-08 110592]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 73728]
"dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"CTHelper"="CTHELPER.EXE" [2005-11-08 c:\windows\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-10 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
mStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-09 19:17:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3953387213-346972422-2963791592-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\CTXFISPI.EXE
c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe
c:\windows\system32\dlcccoms.exe
c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
.
**************************************************************************
.
Completion time: 2009-01-09 19:19:07 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-10 01:19:04
ComboFix2.txt 2009-01-05 23:01:29
ComboFix3.txt 2009-01-05 22:55:38

Pre-Run: 144,373,465,088 bytes free
Post-Run: 144,356,179,968 bytes free

162 --- E O F --- 2008-12-14 23:28:36

How we lookin?

Mis

**chemist** · 01-09-2009, 06:41 PM

Hello again, misbhavin. Please tell us how your system is behaving.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the quotebox below into Notepad:

Quote:

File::
c:\program files\Common Files\ukat.bin
c:\windows\asuvy.dll
c:\documents and settings\All Users\Application Data\hudud.exe
c:\program files\Common Files\iluc.dll
c:\windows\ebuq.pif
c:\documents and settings\Vinnie Cherrone\Application Data\uwacoqiz.dat
c:\windows\ydotileci.exe
c:\windows\iwaquxeh.bat
c:\program files\Common Files\uxiwutugez.bat
c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe
c:\windows\azuduniby.reg

FileLook::
c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and Save it to your Desktop.
Scroll down to where it says Java Runtime Environment (JRE) 6 Update 11 The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
Click the Download button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement
Click Continue The page will refresh.
Click on the link to download Windows Offline Installation and Save the file to your Desktop.
Close any programs you may have running - especially your web browser.
Go to Start(or My Computer) > Control Panel and double-click on Add or Remove Programs and remove all older versions of Java.
Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java(TM) SE or Java(TM) 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version.

After the install is complete, go back to your Control Panel(using Classic View) and click the Java icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button.
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
  - Trace and Log Files
- Click OK on Delete Temporary Files Window.
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
- Click OK to leave the Temporary Files Window.
- Click OK to leave the Java Control Panel.
- Delete jre-6u11-windows-i586-p.exe from your desktop.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Ensure your external and/or USB drives are inserted during the scan.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at any Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected.
It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Please post the following in your next reply:

ComboFix.txt
Kaspersky report
report on system behavior

misbhavin · 01-12-2009, 05:21 PM

Chemist, running last scan. Will post when done.

Mis

misbhavin · 01-12-2009, 09:19 PM

Chemist,

Here are the logs. The system runs slow, but I don't stay on it long in order to properly give an assessment. Since it is not mine and I don't want to infect my network I have been VERY CAUTIOUS with it. I am actually concerned I may have infected my laptop by downloading files to a thumb drive and working between the infected system and my laptop.
Here are the logs:

ComboFix 09-01-09.01 - Vinnie Cherrone 2009-01-12 17:17:09.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.664 [GMT -6:00]
Running from: c:\documents and settings\Vinnie Cherrone\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Vinnie Cherrone\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\documents and settings\All Users\Application Data\hudud.exe
c:\documents and settings\Vinnie Cherrone\Application Data\uwacoqiz.dat
c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe
c:\program files\Common Files\iluc.dll
c:\program files\Common Files\ukat.bin
c:\program files\Common Files\uxiwutugez.bat
c:\windows\asuvy.dll
c:\windows\azuduniby.reg
c:\windows\ebuq.pif
c:\windows\iwaquxeh.bat
c:\windows\ydotileci.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\hudud.exe
c:\documents and settings\Vinnie Cherrone\Application Data\uwacoqiz.dat
c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe
c:\program files\Common Files\iluc.dll
c:\program files\Common Files\ukat.bin
c:\program files\Common Files\uxiwutugez.bat
c:\windows\asuvy.dll
c:\windows\azuduniby.reg
c:\windows\ebuq.pif
c:\windows\iwaquxeh.bat
c:\windows\ydotileci.exe

.
((((((((((((((((((((((((( Files Created from 2008-12-12 to 2009-01-12 )))))))))))))))))))))))))))))))
.

2008-12-29 15:27 . 2008-12-29 15:27 <DIR> d-------- C:\Tools
2008-12-14 21:38 . 2008-12-14 21:38 <DIR> d-------- c:\windows\system32\NtmsData
2008-12-14 18:01 . 2008-12-14 18:01 <DIR> d-------- c:\program files\Trend Micro
2008-12-14 16:46 . 2008-12-14 16:46 73 --a------ c:\windows\st_affiliate.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-29 20:49 --------- d-----w c:\program files\Dl_cats
2008-12-14 22:53 --------- d-----w c:\program files\McAfee.com
2008-12-14 22:53 --------- d-----w c:\program files\McAfee
2008-12-14 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2008-11-29 11:50 --------- d--h--r c:\documents and settings\Vinnie Cherrone\Application Data\yahoo!
2008-11-29 11:50 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo!
2008-11-24 01:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2008-11-12 03:51 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Apple Computer
2008-11-12 03:50 --------- d-----w c:\program files\Apple Software Update
2008-01-09 00:32 56 --sh--r c:\windows\system32\0DC36E3687.sys
2008-10-04 01:05 88 --sh--r c:\windows\system32\87366EC30D.sys
2008-10-04 01:05 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys
2008-08-21 20:18 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe -- Not a PE file.
MD5: 593ec07062c8f88100b7a7ad6425a28e

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
"CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-07-10 169984]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-09-08 110592]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 73728]
"dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"CTHelper"="CTHELPER.EXE" [2005-11-08 c:\windows\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-10 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
mStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-12 17:19:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3953387213-346972422-2963791592-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\CTXFISPI.EXE
c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe
c:\windows\system32\dlcccoms.exe
c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
.
**************************************************************************
.
Completion time: 2009-01-12 17:21:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-12 23:21:35
ComboFix2.txt 2009-01-10 01:19:08
ComboFix3.txt 2009-01-05 23:01:29
ComboFix4.txt 2009-01-05 22:55:38

Pre-Run: 144,338,456,576 bytes free
Post-Run: 144,325,935,104 bytes free

160 --- E O F --- 2008-12-14 23:28:36

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, January 12, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, January 12, 2009 23:26:55
Records in database: 1610839
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 57631
Threat name: 6
Infected objects: 7
Suspicious objects: 0
Duration of the scan: 00:54:36

File name / Threat name / Threats count
C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys2\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip Infected: Backdoor.Win32.TDSS.bkw 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSShrsr.dll.vir Infected: Backdoor.Win32.TDSS.asz 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSoiqn.dll.vir Infected: Backdoor.Win32.TDSS.blh 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSrtqp.dll.vir Infected: Backdoor.Win32.TDSS.atb 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSxfum.dll.vir Infected: Rootkit.Win32.Clbd.lc 1

The selected area was scanned.

What do you recommend for virus scanning and adware removal once this system is clean?

Thanks for your help,

Mis

**chemist** · 01-13-2009, 06:15 AM

Except for the two Musicmatch files, the Kaspersky finds are in ComboFix's quarantine folder, which we will delete when we uninstall ComboFix.

Quote:

What do you recommend for virus scanning and adware removal once this system is clean?

I will give you a link to some articles to read once we are done.

Quote:

I am actually concerned I may have infected my laptop

I wouldn't be worried about that, unless you are experiencing problems. You can always do an online scan and see what turns up.

Quote:

The system runs slow, but I don't stay on it long in order to properly give an assessment.

No malware is showing in the logs. Please read the following article: http://www.techsupportforum.com/secu...ning-slow.html

------------------------------------------------------

Go to Start > Run and copy/paste the following into the Run box and click OK:

cmd /c del /a/f/q "C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys2\WebSys.mmz"

A DOS window will open and close again, this is normal.

Repeat for this command:

cmd /c del /a/f/q "C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz"

------------------------------------------------------

Congratulations. Well done! Your logs appear clean. You should be good to go.

As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK:

combofix /u

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
PC Safety and Security--What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here
MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
Spybot - Search & Destroy is an excellent spyware remover and also offers real-time protection against critical registry changes. Don't use the Immunize feature in Spybot if you use SpywareBlaster. See tutorial here

Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.

misbhavin · 01-16-2009, 11:38 AM

Chemist,

I will be following last steps today.
Had to get hold of owner to verify OK to delete Music Match and add apps.
Thanks for your help.
Will let you know when complete so you can close.

Mis

**chemist** · 01-20-2009, 06:08 AM

Still with us, Mis?

misbhavin · 01-21-2009, 03:36 PM

chemist,

Sorry was out of pocket this weekend and started back at school this week.
Finishing off at this moment, just adding S/W recommended.

misbhavin · 01-21-2009, 04:34 PM

Chemist,

Looking good.
Thank you very much.
OK to mark thread resolved.
Will pass on support if I get paid from my friend. :-)
I'm a lowly, poor student :-(

Mis

**chemist** · 01-21-2009, 05:54 PM

You're very welcome! Glad to have helped.

No worries about the donation. Worry about school.

01-02-2009, 08:48 AM	#2 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites BUMP, please Last edited by misbhavin; 01-02-2009 at 08:50 AM.

01-02-2009, 07:00 PM	#3 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,592 OS: XP SP3	Re: Cannot update virus definitions or goto certain sites Hello and Welcome to TSF. Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Download Combo-Fix and the Microsoft file to a USB drive on another computer and transfer the files to your desktop. ------------------------------------------------------ Download Combo-Fix.exe and Save it to your Desktop. * IMPORTANT !!! Save Combo-Fix.exe to your Desktop ------------------------------------------------------ With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Download the file from this Microsoft page: http://www.microsoft.com/downloads/d...displaylang=en Do not be concerned that this file is for SP2 and you have SP3. It will work just fine on your system. Save it as it is originally named to your Desktop. ------------------------------------------------------ Transfer all files you just downloaded to the desktop of the infected computer. ------------------------------------------------------ Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools. Drag the setup package onto Combo-Fix.exe and drop it. Follow the prompts to start Combo-Fix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. At the next prompt, click Yes to run the full Combo-Fix scan. When the tool is finished, it shall produce a log for you. Please post the C:\ComboFix.txt in your next reply. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

01-05-2009, 04:12 PM	#4 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites Chemist, Thank you so much for your help! I ran the ComboFix twice because I got an error on the console install the first time. below find the logs with ComboFixLog.txt being without the console installed and ComboFixLog2.txt after. I am sorry for the redundancy but didn't want to accidently lose any important info. I know my friend plays online poker, but have his permission to remove it if this is the cause (or a contributor) of his problems, which I told him I expected. ComboFix 09-01-02.01 - Vinnie Cherrone 2009-01-05 16:51:06.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.724 [GMT -6:00] Running from: c:\documents and settings\Vinnie Cherrone\Desktop\Combo-Fix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\_scui.cpl c:\windows\system32\DelSelf.bat c:\windows\system32\drivers\TDSSpqlt.sys c:\windows\system32\TDSShrsr.dll c:\windows\system32\TDSSkkai.log c:\windows\system32\TDSSlxwp.dll c:\windows\system32\TDSSnmxh.log c:\windows\system32\TDSSoiqn.dll c:\windows\system32\TDSSorvd.dat c:\windows\system32\TDSSrhyp.log c:\windows\system32\TDSSrtqp.dll c:\windows\system32\TDSSsihc.dll c:\windows\system32\TDSSxfum.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_TDSSserv.sys -------\Legacy_TDSSserv.sys ((((((((((((((((((((((((( Files Created from 2008-12-05 to 2009-01-05 ))))))))))))))))))))))))))))))) . 2008-12-29 15:27 . 2008-12-29 15:27 <DIR> d-------- C:\Tools 2008-12-14 21:38 . 2008-12-14 21:38 <DIR> d-------- c:\windows\system32\NtmsData 2008-12-14 18:01 . 2008-12-14 18:01 <DIR> d-------- c:\program files\Trend Micro 2008-12-14 16:46 . 2008-12-14 16:46 73 --a------ c:\windows\st_affiliate.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-29 20:49 --------- d-----w c:\program files\Dl_cats 2008-12-14 22:53 --------- d-----w c:\program files\McAfee.com 2008-12-14 22:53 --------- d-----w c:\program files\McAfee 2008-12-14 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2008-11-29 11:50 --------- d--h--r c:\documents and settings\Vinnie Cherrone\Application Data\yahoo! 2008-11-29 11:50 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo! 2008-11-24 01:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2008-11-14 23:10 --------- d-----w c:\program files\AntivirusPro2009 2008-11-14 22:55 18,003 ----a-w c:\program files\Common Files\ukat.bin 2008-11-14 22:55 17,890 ----a-w c:\windows\asuvy.dll 2008-11-14 22:55 15,746 ----a-w c:\documents and settings\All Users\Application Data\hudud.exe 2008-11-14 22:55 13,534 ----a-w c:\program files\Common Files\iluc.dll 2008-11-14 22:55 13,183 ----a-w c:\windows\ebuq.pif 2008-11-14 22:55 13,139 ----a-w c:\documents and settings\Vinnie Cherrone\Application Data\uwacoqiz.dat 2008-11-14 22:55 12,752 ----a-w c:\windows\ydotileci.exe 2008-11-14 22:55 12,678 ----a-w c:\windows\iwaquxeh.bat 2008-11-14 22:55 12,664 ----a-w c:\program files\Common Files\uxiwutugez.bat 2008-11-14 22:55 10,426 ----a-w c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe 2008-11-14 22:55 10,280 ----a-w c:\windows\azuduniby.reg 2008-11-12 03:51 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Apple Computer 2008-11-12 03:50 --------- d-----w c:\program files\Apple Software Update 2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Sonic 2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Leadertech 2008-01-09 00:32 56 --sh--r c:\windows\system32\0DC36E3687.sys 2008-10-04 01:05 88 --sh--r c:\windows\system32\87366EC30D.sys 2008-10-04 01:05 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys 2008-08-21 20:18 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064] "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304] "CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056] "VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880] "AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-07-10 169984] "MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-09-08 110592] "DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 73728] "dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080] "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208] "CTHelper"="CTHELPER.EXE" [2005-11-08 c:\windows\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-10 24576] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= . - - - - ORPHANS REMOVED - - - - WebBrowser-{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - (no file) . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr mStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr uInternet Settings,ProxyOverride = .local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/http://www.yahoo.com IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe FF - ProfilePath - . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-05 16:53:49 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = CTHELPER.EXE? CTxfiHlp = CTXFIHLP.EXE? DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-3953387213-346972422-2963791592-1006\Software\Microsoft\SystemCertificates\AddressBookNULL] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\CTXFISPI.EXE c:\windows\system32\CTSVCCDA.EXE c:\program files\Dell Support Center\bin\sprtsvc.exe c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe c:\windows\system32\dlcccoms.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-01-05 16:55:37 - machine was rebooted [Vinnie Cherrone] ComboFix-quarantined-files.txt 2009-01-05 22:55:35 Pre-Run: 144,459,833,344 bytes free Post-Run: 144,424,075,264 bytes free 165 --- E O F --- 2008-12-14 23:28:36 ComboFixLog2.txt ComboFix 09-01-05.03 - Vinnie Cherrone 2009-01-05 16:59:50.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.627 [GMT -6:00] Running from: c:\documents and settings\Vinnie Cherrone\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\Vinnie Cherrone\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-12-05 to 2009-01-05 ))))))))))))))))))))))))))))))) . 2008-12-29 15:27 . 2008-12-29 15:27 <DIR> d-------- C:\Tools 2008-12-14 21:38 . 2008-12-14 21:38 <DIR> d-------- c:\windows\system32\NtmsData 2008-12-14 18:01 . 2008-12-14 18:01 <DIR> d-------- c:\program files\Trend Micro 2008-12-14 16:46 . 2008-12-14 16:46 73 --a------ c:\windows\st_affiliate.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-29 20:49 --------- d-----w c:\program files\Dl_cats 2008-12-14 22:53 --------- d-----w c:\program files\McAfee.com 2008-12-14 22:53 --------- d-----w c:\program files\McAfee 2008-12-14 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2008-11-29 11:50 --------- d--h--r c:\documents and settings\Vinnie Cherrone\Application Data\yahoo! 2008-11-29 11:50 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo! 2008-11-24 01:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2008-11-14 23:10 --------- d-----w c:\program files\AntivirusPro2009 2008-11-12 03:51 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Apple Computer 2008-11-12 03:50 --------- d-----w c:\program files\Apple Software Update 2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Sonic 2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Leadertech 2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys 2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll 2008-10-17 08:08 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll 2008-10-16 20:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 20:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 20:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 20:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 20:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 20:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 20:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-10-16 13:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe 2008-10-16 13:11 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe 2008-10-15 16:34 337,408 ------w c:\windows\system32\dllcache\netapi32.dll 2008-10-15 07:06 633,632 ------w c:\windows\system32\dllcache\iexplore.exe 2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll 2008-01-09 00:32 56 --sh--r c:\windows\system32\0DC36E3687.sys 2008-10-04 01:05 88 --sh--r c:\windows\system32\87366EC30D.sys 2008-10-04 01:05 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys 2008-08-21 20:18 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064] "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304] "CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056] "VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880] "AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-07-10 169984] "MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-09-08 110592] "DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 73728] "dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080] "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208] "CTHelper"="CTHELPER.EXE" [2005-11-08 c:\windows\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-10 24576] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr mStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr uInternet Settings,ProxyOverride = .local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/http://www.yahoo.com IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe FF - ProfilePath - . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-05 17:00:44 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = CTHELPER.EXE? CTxfiHlp = CTXFIHLP.EXE? DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2009-01-05 17:01:28 ComboFix-quarantined-files.txt 2009-01-05 23:01:19 ComboFix2.txt 2009-01-05 22:55:38 Pre-Run: 144,381,190,144 bytes free Post-Run: 144,325,742,592 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 145 --- E O F --- 2008-12-14 23:28:36 I appreciate your time. Mis

01-08-2009, 02:57 PM	#6 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,592 OS: XP SP3	Re: Cannot update virus definitions or goto certain sites Still with us? Any trouble with those last instructions? __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

01-08-2009, 05:50 PM	#7 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites Chemist, I am so sorry. I had another system a friend gave with with a bad power supply. The parts arrived Tuesday and I had to deliver the system an hour away today. I will be working on the instructions you gave me tomorrow. Everything seems clear from your instructions. Sorry for the delay, I know you are very busy!!! I will post results tomorrow.

01-09-2009, 10:20 AM	#8 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites Hi Chemist, I do have a question. Shall I start with a fresh ComboFix or will the copy that I dropped the console into be OK? I will wait to do until this afternoon. If I don't hear back I will try both ways. I do not want to take up more of your time. Thanks for our patience. Mis

01-09-2009, 11:25 AM	#9 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,592 OS: XP SP3	Re: Cannot update virus definitions or goto certain sites If you have an active internet connection, ComboFix will ask if you want to update if one is available. You can always delete your existing copy and download a fresh copy. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

01-09-2009, 06:23 PM	#10 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites Chemist, Thank you for the quick reply. I used a fresh ComboFix with the script dropped in. Below is the log file. ComboFix 09-01-09.01 - Vinnie Cherrone 2009-01-09 19:14:49.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.637 [GMT -6:00] Running from: c:\documents and settings\Vinnie Cherrone\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\Vinnie Cherrone\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\AntivirusPro2009 c:\program files\AntivirusPro2009\AntivirusPro2009.cfg c:\program files\AntivirusPro2009\AVEngn.dll c:\program files\AntivirusPro2009\data\daily.cvd c:\program files\AntivirusPro2009\htmlayout.dll c:\program files\AntivirusPro2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest c:\program files\AntivirusPro2009\Microsoft.VC80.CRT\msvcm80.dll c:\program files\AntivirusPro2009\Microsoft.VC80.CRT\msvcp80.dll c:\program files\AntivirusPro2009\Microsoft.VC80.CRT\msvcr80.dll c:\program files\AntivirusPro2009\pthreadVC2.dll c:\program files\AntivirusPro2009\wscui.cpl . ((((((((((((((((((((((((( Files Created from 2008-12-10 to 2009-01-10 ))))))))))))))))))))))))))))))) . 2008-12-29 15:27 . 2008-12-29 15:27 <DIR> d-------- C:\Tools 2008-12-14 21:38 . 2008-12-14 21:38 <DIR> d-------- c:\windows\system32\NtmsData 2008-12-14 18:01 . 2008-12-14 18:01 <DIR> d-------- c:\program files\Trend Micro 2008-12-14 16:46 . 2008-12-14 16:46 73 --a------ c:\windows\st_affiliate.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-29 20:49 --------- d-----w c:\program files\Dl_cats 2008-12-14 22:53 --------- d-----w c:\program files\McAfee.com 2008-12-14 22:53 --------- d-----w c:\program files\McAfee 2008-12-14 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2008-11-29 11:50 --------- d--h--r c:\documents and settings\Vinnie Cherrone\Application Data\yahoo! 2008-11-29 11:50 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo! 2008-11-24 01:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2008-11-14 22:55 18,003 ----a-w c:\program files\Common Files\ukat.bin 2008-11-14 22:55 17,890 ----a-w c:\windows\asuvy.dll 2008-11-14 22:55 15,746 ----a-w c:\documents and settings\All Users\Application Data\hudud.exe 2008-11-14 22:55 13,534 ----a-w c:\program files\Common Files\iluc.dll 2008-11-14 22:55 13,183 ----a-w c:\windows\ebuq.pif 2008-11-14 22:55 13,139 ----a-w c:\documents and settings\Vinnie Cherrone\Application Data\uwacoqiz.dat 2008-11-14 22:55 12,752 ----a-w c:\windows\ydotileci.exe 2008-11-14 22:55 12,678 ----a-w c:\windows\iwaquxeh.bat 2008-11-14 22:55 12,664 ----a-w c:\program files\Common Files\uxiwutugez.bat 2008-11-14 22:55 10,426 ----a-w c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe 2008-11-14 22:55 10,280 ----a-w c:\windows\azuduniby.reg 2008-11-12 03:51 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Apple Computer 2008-11-12 03:50 --------- d-----w c:\program files\Apple Software Update 2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Sonic 2008-11-11 01:32 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Leadertech 2008-01-09 00:32 56 --sh--r c:\windows\system32\0DC36E3687.sys 2008-10-04 01:05 88 --sh--r c:\windows\system32\87366EC30D.sys 2008-10-04 01:05 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys 2008-08-21 20:18 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\asuvy.dll -- Not a PE file. MD5: 55aa78008101cf7880cfd347b44b2b03 c:\windows\ydotileci.exe -- Not a PE file. MD5: b3eb4c4ae0132bb23105090d6b79e19d ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064] "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304] "CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056] "VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880] "AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-07-10 169984] "MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-09-08 110592] "DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 73728] "dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080] "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208] "CTHelper"="CTHELPER.EXE" [2005-11-08 c:\windows\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-10 24576] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr mStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr uInternet Settings,ProxyOverride = .local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/http://www.yahoo.com IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe FF - ProfilePath - . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-09 19:17:19 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = CTHELPER.EXE? CTxfiHlp = CTXFIHLP.EXE? DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-3953387213-346972422-2963791592-1006\Software\Microsoft\SystemCertificates\AddressBook] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\CTSVCCDA.EXE c:\program files\Dell Support Center\bin\sprtsvc.exe c:\windows\system32\wscntfy.exe c:\windows\system32\CTXFISPI.EXE c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe c:\windows\system32\dlcccoms.exe c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe . ************************************************************************* . Completion time: 2009-01-09 19:19:07 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-10 01:19:04 ComboFix2.txt 2009-01-05 23:01:29 ComboFix3.txt 2009-01-05 22:55:38 Pre-Run: 144,373,465,088 bytes free Post-Run: 144,356,179,968 bytes free 162 --- E O F --- 2008-12-14 23:28:36 How we lookin? Mis

01-12-2009, 05:21 PM	#12 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites Chemist, running last scan. Will post when done. Mis

01-12-2009, 09:19 PM	#13 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites Chemist, Here are the logs. The system runs slow, but I don't stay on it long in order to properly give an assessment. Since it is not mine and I don't want to infect my network I have been VERY CAUTIOUS with it. I am actually concerned I may have infected my laptop by downloading files to a thumb drive and working between the infected system and my laptop. Here are the logs: ComboFix 09-01-09.01 - Vinnie Cherrone 2009-01-12 17:17:09.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.664 [GMT -6:00] Running from: c:\documents and settings\Vinnie Cherrone\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\Vinnie Cherrone\Desktop\CFScript.txt * Created a new restore point FILE :: c:\documents and settings\All Users\Application Data\hudud.exe c:\documents and settings\Vinnie Cherrone\Application Data\uwacoqiz.dat c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe c:\program files\Common Files\iluc.dll c:\program files\Common Files\ukat.bin c:\program files\Common Files\uxiwutugez.bat c:\windows\asuvy.dll c:\windows\azuduniby.reg c:\windows\ebuq.pif c:\windows\iwaquxeh.bat c:\windows\ydotileci.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\hudud.exe c:\documents and settings\Vinnie Cherrone\Application Data\uwacoqiz.dat c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe c:\program files\Common Files\iluc.dll c:\program files\Common Files\ukat.bin c:\program files\Common Files\uxiwutugez.bat c:\windows\asuvy.dll c:\windows\azuduniby.reg c:\windows\ebuq.pif c:\windows\iwaquxeh.bat c:\windows\ydotileci.exe . ((((((((((((((((((((((((( Files Created from 2008-12-12 to 2009-01-12 ))))))))))))))))))))))))))))))) . 2008-12-29 15:27 . 2008-12-29 15:27 <DIR> d-------- C:\Tools 2008-12-14 21:38 . 2008-12-14 21:38 <DIR> d-------- c:\windows\system32\NtmsData 2008-12-14 18:01 . 2008-12-14 18:01 <DIR> d-------- c:\program files\Trend Micro 2008-12-14 16:46 . 2008-12-14 16:46 73 --a------ c:\windows\st_affiliate.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-29 20:49 --------- d-----w c:\program files\Dl_cats 2008-12-14 22:53 --------- d-----w c:\program files\McAfee.com 2008-12-14 22:53 --------- d-----w c:\program files\McAfee 2008-12-14 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2008-11-29 11:50 --------- d--h--r c:\documents and settings\Vinnie Cherrone\Application Data\yahoo! 2008-11-29 11:50 --------- d-----w c:\documents and settings\All Users\Application Data\yahoo! 2008-11-24 01:24 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2008-11-12 03:51 --------- d-----w c:\documents and settings\Vinnie Cherrone\Application Data\Apple Computer 2008-11-12 03:50 --------- d-----w c:\program files\Apple Software Update 2008-01-09 00:32 56 --sh--r c:\windows\system32\0DC36E3687.sys 2008-10-04 01:05 88 --sh--r c:\windows\system32\87366EC30D.sys 2008-10-04 01:05 4,184 --sha-w c:\windows\system32\KGyGaAvL.sys 2008-08-21 20:18 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082120080822\index.dat . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Vinnie Cherrone\Application Data\yrobyr.exe -- Not a PE file. MD5: 593ec07062c8f88100b7a7ad6425a28e ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064] "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304] "CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056] "VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880] "AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-07-10 169984] "MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2005-09-08 110592] "DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 73728] "dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080] "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208] "CTHelper"="CTHELPER.EXE" [2005-11-08 c:\windows\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-10 24576] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "c:\\Program Files\\America Online 9.0\\waol.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr mStart Page = hxxp://www.rr.com/browsers/redirect/?b=RRHSO_BLD1&CMP=OTC-RRHSO_BLD1HPRR&d=homerr uInternet Settings,ProxyOverride = .local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/http://www.yahoo.com IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe FF - ProfilePath - . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-12 17:19:51 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTHelper = CTHELPER.EXE? CTxfiHlp = CTXFIHLP.EXE? DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-3953387213-346972422-2963791592-1006\Software\Microsoft\SystemCertificates\AddressBook] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\CTSVCCDA.EXE c:\program files\Dell Support Center\bin\sprtsvc.exe c:\windows\system32\wscntfy.exe c:\windows\system32\CTXFISPI.EXE c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe c:\windows\system32\dlcccoms.exe c:\program files\Google\Google Desktop Search\GoogleDesktopDisplay.exe . ************************************************************************* . Completion time: 2009-01-12 17:21:38 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-12 23:21:35 ComboFix2.txt 2009-01-10 01:19:08 ComboFix3.txt 2009-01-05 23:01:29 ComboFix4.txt 2009-01-05 22:55:38 Pre-Run: 144,338,456,576 bytes free Post-Run: 144,325,935,104 bytes free 160 --- E O F --- 2008-12-14 23:28:36 -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Monday, January 12, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, January 12, 2009 23:26:55 Records in database: 1610839 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 57631 Threat name: 6 Infected objects: 7 Suspicious objects: 0 Duration of the scan: 00:54:36 File name / Threat name / Threats count C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys2\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip Infected: Backdoor.Win32.TDSS.bkw 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSShrsr.dll.vir Infected: Backdoor.Win32.TDSS.asz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSoiqn.dll.vir Infected: Backdoor.Win32.TDSS.blh 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSrtqp.dll.vir Infected: Backdoor.Win32.TDSS.atb 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSxfum.dll.vir Infected: Rootkit.Win32.Clbd.lc 1 The selected area was scanned. What do you recommend for virus scanning and adware removal once this system is clean? Thanks for your help, Mis

01-16-2009, 11:38 AM	#15 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites Chemist, I will be following last steps today. Had to get hold of owner to verify OK to delete Music Match and add apps. Thanks for your help. Will let you know when complete so you can close. Mis

01-20-2009, 06:08 AM	#16 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,592 OS: XP SP3	Re: Cannot update virus definitions or goto certain sites Still with us, Mis? __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

01-21-2009, 03:36 PM	#17 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites chemist, Sorry was out of pocket this weekend and started back at school this week. Finishing off at this moment, just adding S/W recommended.

01-21-2009, 04:34 PM	#18 (permalink)
misbhavin Registered User Join Date: Dec 2008 Posts: 12 OS: Windows XP Pro	Re: Cannot update virus definitions or goto certain sites Chemist, Looking good. Thank you very much. OK to mark thread resolved. Will pass on support if I get paid from my friend. :-) I'm a lowly, poor student :-( Mis

01-21-2009, 05:54 PM	#19 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,592 OS: XP SP3	Re: Cannot update virus definitions or goto certain sites You're very welcome! Glad to have helped. No worries about the donation. Worry about school. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE