msb.exe

[blossercg]

In the last 24 hours, I installed bittorrent and downloaded a 4gb file (against my better judgment). At some point in the process, my system became infected.

I have Avast, Zone Alarm, and SpyBot. I routinely use Firefox.

Today, I began hearing spontaneous audio commercials when no browser was open. Zone alarm also blocked attempts of a file msb.exe to connect to the internet. ZA also blocked an attempt of Word to access the internet when I didn't have Word open. Occasionally, IE will open with a page that says connection could not be established. Avast has found a few suspicious files and deleted them. Spy bot found several suspicious files, but could only "fix" about half of them.

Here are my logs:


DDS (Ver_09-05-14.01) - NTFSx86
Run by Chris Blosser at 21:13:30.25 on Sat 06/20/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1463 [GMT -7:00]

AV: avast! antivirus 4.8.1335 [VPS 090620-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Avast4\aswUpdSv.exe
C:\Avast4\ashServ.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost.exe
C:\WINDOWS\msb.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\HP\HP Software Update\HPWuSchd2.exe
C:\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Avast4\ashDisp.exe
C:\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Microsoft Money\System\Money Express.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Chris Blosser\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MoneyAgent] "c:\microsoft money\system\Money Express.exe"
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe
mRun: [HP Software Update] c:\hp\hp software update\HPWuSchd2.exe
mRun: [DVDLauncher] "c:\powerdvd\DVDLauncher.exe"
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [avast!] c:\avast4\ashDisp.exe
mRun: [Adobe Acrobat Speed Launcher] "c:\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [<NO NAME>]
mRun: [Acrobat Assistant 8.0] "c:\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [ZoneAlarm Client] "c:\zonealarm\zlclient.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\itunes\iTunesHelper.exe"
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\micros~1\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\micros~1\office11\REFIEBAR.DLL
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1223935318671
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\chrisb~1\applic~1\mozilla\firefox\profiles\9k2s88fj.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\adobe\acrobat 6.0\acrobat\browser\nppdf32.dll
FF - plugin: c:\adobe\acrobat 9.0\acrobat\browser\nppdf32.dll
FF - plugin: c:\documents and settings\chris blosser\application data\mozilla\firefox\profiles\9k2s88fj.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071102000004.dll
FF - plugin: c:\firefox\plugins\npsnapfish.dll
FF - plugin: c:\itunes\mozilla plugins\npitunes.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-10-13 114768]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2008-10-13 353672]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-10-13 20560]
R2 avast! Antivirus;avast! Antivirus;c:\avast4\ashServ.exe [2008-10-13 138680]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2004-5-3 88192]
S0 ntcdrdrv;ntcdrdrv;c:\windows\system32\drivers\ntcdrdrv.sys --> c:\windows\system32\drivers\ntcdrdrv.sys [?]
S2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0;c:\program files\common files\nero\nero backitup 4\nbservice.exe --> c:\program files\common files\nero\nero backitup 4\NBService.exe [?]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\avast4\ashMaiSv.exe [2008-10-13 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\avast4\ashWebSv.exe [2008-10-13 352920]

=============== Created Last 30 ================

2009-06-20 12:49 120,836 a------- c:\windows\msb.exe
2009-06-20 11:55 50 a------- c:\windows\system32\SKYNETlog.dat
2009-06-20 11:44 19,456 a------- c:\windows\system32\SKYNETevmtbqin.dll
2009-06-20 11:43 120,836 a------- c:\windows\msa.exe
2009-06-20 11:42 2,339 a------- c:\windows\system32\SKYNETqbwexvak.dat
2009-06-20 11:42 43,008 a------- c:\windows\system32\SKYNETmotuumof.dll
2009-06-20 08:54 <DIR> --d----- C:\Box Office Bust
2009-06-20 03:33 507,400 a------- c:\windows\system32\XAudio2_1.dll
2009-06-20 03:32 <DIR> --d----- c:\windows\Logs
2009-06-19 22:15 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DAEMON Tools Pro
2009-06-19 22:10 <DIR> --d----- c:\program files\Zapu
2009-06-19 22:08 721,904 a------- c:\windows\system32\drivers\sptd.sys
2009-06-19 22:08 <DIR> --d----- c:\docume~1\chrisb~1\applic~1\DAEMON Tools Pro
2009-06-13 18:50 <DIR> --d----- c:\program files\Avery
2009-06-12 20:12 <DIR> --d----- c:\program files\StudySmart
2009-06-12 12:30 3,245 a------- c:\windows\system32\wbem\Outlook_01c9eb944d71a370.mof
2009-06-11 17:40 <DIR> --d----- C:\_AcroTemp
2009-06-10 03:05 <DIR> --d----- c:\windows\ie8updates
2009-06-09 12:53 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-06-09 12:53 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-06-05 19:04 <DIR> --dsh--- c:\documents and settings\chris blosser\IECompatCache
2009-06-05 19:02 <DIR> --dsh--- c:\documents and settings\chris blosser\PrivacIE
2009-06-05 18:59 <DIR> --d----- c:\program files\common files\Real
2009-06-05 14:34 <DIR> --d----- c:\program files\Rhapsody
2009-06-05 13:34 <DIR> --d----- c:\program files\common files\Sonic
2009-06-05 13:33 <DIR> --d----- c:\program files\common files\SureThing Shared
2009-06-05 13:33 98,358 a------- c:\windows\dla.exe
2009-06-05 13:33 87,136 a------- c:\windows\system32\drivers\drvmcdb.sys
2009-06-05 13:33 61,498 a------- c:\windows\system32\tfswapi.dll
2009-06-05 13:33 40,544 a------- c:\windows\system32\drivers\drvnddm.sys
2009-06-05 13:33 23,545 a------- c:\windows\system32\drivers\ssrtln.sys
2009-06-05 13:33 5,627 a------- c:\windows\system32\drivers\sscdbhk5.sys
2009-06-05 13:33 <DIR> --d----- c:\program files\Sonic
2009-06-05 12:51 <DIR> --d----- c:\program files\iPod
2009-06-05 12:50 <DIR> --d----- C:\iTunes
2009-06-04 11:48 <DIR> --dsh--- c:\documents and settings\chris blosser\IETldCache
2009-06-04 11:18 <DIR> -cd-h--- c:\windows\ie8
2009-05-26 17:18 90,112 a------- c:\windows\system32\QuickTimeVR.qtx
2009-05-26 17:18 57,344 a------- c:\windows\system32\QuickTime.qts

==================== Find3M ====================

2009-05-29 13:36 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-05-29 13:36 39,424 a------- c:\windows\system32\drivers\usbaapl.sys
2009-05-21 11:33 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-12 22:15 915,456 a------- c:\windows\system32\wininet.dll
2009-05-08 14:59 102,937 a------- c:\windows\jgzr.dat
2009-05-07 08:32 345,600 a------- c:\windows\system32\localspl.dll
2009-04-17 05:26 1,847,168 a------- c:\windows\system32\win32k.sys
2009-04-15 07:51 585,216 a------- c:\windows\system32\rpcrt4.dll
2009-03-27 08:20 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-03-23 13:16 249,856 -------- c:\windows\Setup1.exe
2009-03-23 13:16 73,216 a------- c:\windows\ST6UNST.EXE

============= FINISH: 21:13:55.75 ===============

[TheBruce1]

Hello and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear.

Please DO NOT Attach logs to your posts unless you are advised to do so.


==========

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Place combofix.exe on your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

Double click on combofix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.

ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.



Click on Yes, to continue scanning for malware.

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

[blossercg]

Thank you. The log is attached.

ComboFix 09-06-21.01 - Chris Blosser 06/22/2009 4:54.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1307 [GMT -7:00]
Running from: c:\downloads\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090621-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\Programs\Internet Explorer.lnk
c:\windows\msa.exe
c:\windows\system32\SKYNETevmtbqin.dll
c:\windows\system32\SKYNETlog.dat
c:\windows\system32\SKYNETmotuumof.dll
c:\windows\system32\SKYNETqbwexvak.dat
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
c:\windows\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SKYNETYXIDQVXF
-------\Service_SKYNETyxidqvxf


((((((((((((((((((((((((( Files Created from 2009-05-22 to 2009-06-22 )))))))))))))))))))))))))))))))
.

2009-06-20 19:49 . 2009-06-20 18:46 120836 ----a-w- c:\windows\msb.exe
2009-06-20 18:45 . 2009-06-20 18:45 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-20 18:25 . 2009-06-20 18:25 -------- d--h--r- c:\documents and settings\Chris Blosser\Application Data\SecuROM
2009-06-20 15:54 . 2009-06-20 16:01 -------- d-----w- C:\Box Office Bust
2009-06-20 10:33 . 2008-05-30 21:19 507400 ----a-w- c:\windows\system32\XAudio2_1.dll
2009-06-20 10:32 . 2009-06-20 10:32 -------- d-----w- c:\windows\Logs
2009-06-20 05:15 . 2009-06-20 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Pro
2009-06-20 05:10 . 2009-06-20 05:10 -------- d-----w- c:\program files\Zapu
2009-06-20 05:08 . 2009-06-20 05:08 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-06-20 05:08 . 2009-06-20 05:36 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\DAEMON Tools Pro
2009-06-20 04:47 . 2009-06-20 04:47 -------- d-----w- c:\documents and settings\Chris Blosser\Local Settings\Application Data\WinZip
2009-06-20 04:47 . 2009-06-20 04:47 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-06-15 22:22 . 2009-06-15 22:22 152576 ----a-w- c:\documents and settings\Chris Blosser\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-14 01:50 . 2009-06-14 01:50 -------- d-----w- c:\program files\Avery
2009-06-13 03:12 . 2009-06-13 03:12 -------- d-----w- c:\program files\StudySmart
2009-06-12 00:40 . 2009-06-15 15:49 -------- d-----w- C:\_AcroTemp
2009-06-10 10:05 . 2009-06-10 10:05 -------- d-----w- c:\windows\ie8updates
2009-06-09 19:53 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-09 19:53 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-06 02:04 . 2009-06-06 02:04 -------- d-sh--w- c:\documents and settings\Chris Blosser\IECompatCache
2009-06-06 02:02 . 2009-06-06 02:02 -------- d-sh--w- c:\documents and settings\Chris Blosser\PrivacIE
2009-06-06 01:59 . 2009-06-06 01:59 -------- d-----w- c:\program files\Common Files\Real
2009-06-05 21:35 . 2009-06-05 21:35 -------- d-----w- c:\program files\Real
2009-06-05 21:34 . 2009-06-06 02:08 -------- d-----w- c:\program files\Rhapsody
2009-06-05 20:38 . 2009-06-05 20:38 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\Leadertech
2009-06-05 20:36 . 2009-06-05 20:38 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\Sonic
2009-06-05 20:34 . 2009-06-05 20:34 -------- d-----w- c:\program files\Common Files\Sonic
2009-06-05 20:33 . 2009-06-05 20:33 -------- d-----w- c:\program files\Common Files\SureThing Shared
2009-06-05 20:33 . 2004-08-13 09:56 40544 ----a-w- c:\windows\system32\drivers\drvnddm.sys
2009-06-05 20:33 . 2004-08-13 08:05 98358 ----a-w- c:\windows\dla.exe
2009-06-05 20:33 . 2004-08-13 08:05 61498 ----a-w- c:\windows\system32\tfswapi.dll
2009-06-05 20:33 . 2004-08-04 10:21 87136 ----a-w- c:\windows\system32\drivers\drvmcdb.sys
2009-06-05 20:33 . 2004-07-14 18:29 5627 ----a-w- c:\windows\system32\drivers\sscdbhk5.sys
2009-06-05 20:33 . 2004-07-14 18:28 23545 ----a-w- c:\windows\system32\drivers\ssrtln.sys
2009-06-05 20:33 . 2009-06-05 20:33 -------- d-----w- c:\program files\Sonic
2009-06-05 20:13 . 2009-06-05 20:13 -------- d--h--r- C:\MSOCache
2009-06-05 19:51 . 2009-06-05 19:51 -------- d-----w- c:\program files\iPod
2009-06-05 19:50 . 2009-06-05 19:51 -------- d-----w- C:\iTunes
2009-06-05 19:48 . 2009-06-05 19:48 -------- d-----w- c:\program files\QuickTime
2009-06-05 19:43 . 2009-06-05 19:43 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-04 21:48 . 2009-06-04 21:48 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-04 18:48 . 2009-06-04 18:48 -------- d-sh--w- c:\documents and settings\Chris Blosser\IETldCache
2009-06-04 18:18 . 2009-06-04 18:20 -------- dc-h--w- c:\windows\ie8

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-22 12:00 . 2009-05-26 14:20 6235426 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2009-06-20 16:11 . 2009-06-20 16:13 2310656 ----a-w- c:\windows\Internet Logs\xDBE.tmp
2009-06-20 09:38 . 2008-10-13 16:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-20 09:05 . 2008-10-13 22:10 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\FileZilla
2009-06-16 15:17 . 2009-06-16 15:52 2242048 ----a-w- c:\windows\Internet Logs\xDBD.tmp
2009-06-15 22:24 . 2008-10-30 17:07 -------- d-----w- c:\program files\Java
2009-06-14 01:54 . 2008-10-13 21:12 60848 ----a-w- c:\documents and settings\Chris Blosser\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-13 03:12 . 2009-02-28 05:18 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\ThomsonWest
2009-06-12 14:42 . 2009-02-28 05:17 -------- d-----w- c:\program files\StudySmartMPRE
2009-06-05 20:44 . 2008-10-13 21:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-06-05 19:51 . 2008-10-13 21:48 -------- d-----w- c:\program files\Common Files\Apple
2009-06-03 01:31 . 2009-06-03 01:33 2165248 ----a-w- c:\windows\Internet Logs\xDBC.tmp
2009-06-03 01:31 . 2009-06-03 01:33 233472 ----a-w- c:\windows\Internet Logs\xDBB.tmp
2009-05-29 20:36 . 2009-03-17 13:44 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-29 20:36 . 2008-10-13 21:49 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-21 18:33 . 2008-10-29 05:17 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-19 06:54 . 2009-05-19 06:54 774144 ----a-w- c:\windows\Internet Logs\xDB2E.tmp
2009-05-19 06:54 . 2009-05-19 06:54 2161152 ----a-w- c:\windows\Internet Logs\xDB2F.tmp
2009-05-17 06:12 . 2009-05-17 06:13 2152448 ----a-w- c:\windows\Internet Logs\xDBA.tmp
2009-05-13 05:15 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-12 01:52 . 2009-05-12 01:52 -------- d-----w- c:\program files\Reflective Learning
2009-05-12 00:20 . 2008-12-26 02:12 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-05-08 22:00 . 2008-11-04 02:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Examsoft
2009-05-08 21:59 . 2008-11-04 02:14 102937 ----a-w- c:\windows\jgzr.dat
2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-04 03:20 . 2009-03-27 15:17 -------- d-----w- c:\program files\FileZilla FTP Client
2009-04-24 19:37 . 2009-04-24 04:04 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\Trondent Development Corp
2009-04-24 19:31 . 2009-04-24 19:32 2114048 ----a-w- c:\windows\Internet Logs\xDB9.tmp
2009-04-24 19:31 . 2009-04-24 19:32 3134464 ----a-w- c:\windows\Internet Logs\xDB8.tmp
2009-04-19 04:31 . 2009-04-19 08:10 2091008 ----a-w- c:\windows\Internet Logs\xDB7.tmp
2009-04-17 12:26 . 2004-08-04 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-03 02:22 . 2009-04-03 03:46 2027520 ----a-w- c:\windows\Internet Logs\xDB6.tmp
2009-03-31 20:09 . 2009-03-31 20:09 152576 ----a-w- c:\documents and settings\Chris Blosser\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-27 15:20 . 2008-10-14 01:35 4212 ---ha-w- c:\windows\system32\zllictbl.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MoneyAgent"="c:\microsoft money\System\Money Express.exe" [2000-07-19 176183]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-09-15 118784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936]
"HP Software Update"="c:\hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"DVDLauncher"="c:\powerdvd\DVDLauncher.exe" [2004-04-26 53248]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"avast!"="c:\avast4\ashDisp.exe" [2009-02-05 81000]
"Adobe Acrobat Speed Launcher"="c:\adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-02-27 38768]
"Acrobat Assistant 8.0"="c:\adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-02-27 640376]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"ZoneAlarm Client"="c:\zonealarm\zlclient.exe" [2009-02-16 981384]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696]
"iTunesHelper"="c:\itunes\iTunesHelper.exe" [2009-05-30 292136]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-11-18 1724416]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Zapu\\Zapu Accelerator\\Webseed_dl.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [10/13/2008 6:09 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10/13/2008 6:09 PM 20560]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [5/3/2004 4:26 PM 88192]
S0 ntcdrdrv;ntcdrdrv;c:\windows\system32\DRIVERS\ntcdrdrv.sys --> c:\windows\system32\DRIVERS\ntcdrdrv.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\micros~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-22 05:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(648)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ZoneLabs\vsmon.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\avast4\aswUpdSv.exe
c:\avast4\ashServ.exe
c:\windows\system32\BRSS01A.EXE
c:\windows\system32\scardsvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\rundll32.exe
c:\program files\Apoint\hidfind.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-06-22 8:02 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-22 15:02

Pre-Run: 42,998,927,360 bytes free
Post-Run: 44,968,280,064 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

236 --- E O F --- 2009-06-10 10:05

[TheBruce1]

Hello again

DO NOT attach your logs, simply copy/paste them into your replies.

========

Open notepad and copy/paste the text in the quotebox below into it:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/387533-msb-exe.html

Collect::
c:\windows\msb.exe

DDS::
uInternet Settings,ProxyOverride = *.local

Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file(s).

=========

Download ATF-Cleaner by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

=========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

This animation will guide you through the process:




To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

=========
Logs Required
C:\Combofix.txt
Kaspersky Scan Report

An update on how your system is running.

[blossercg]

Alright I've done all of that. After I did the first steps of the ATF cleaner, it the Firefox selection greyed out and wouldn't let me choose it. With the Kaspersky scanner, it took about an hour and half to get to 26%, I left for about an hour, came back and it said complete. I didn't save the report because it was blank.

As far as system performance, I haven't noticed any popups or other strange occurrences since running CF the first time. Looking at my task manager, it seems like there's an exorbitant amount of processes running, but that's probably unrelated to malware.

Here is the CF report:

ComboFix 09-06-22.01 - Chris Blosser 06/22/2009 14:39.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1491 [GMT -7:00]
Running from: c:\documents and settings\Chris Blosser\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Chris Blosser\Desktop\cfscript.txt
AV: avast! antivirus 4.8.1335 [VPS 090622-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

file zipped: c:\windows\msb.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\msb.exe

.
((((((((((((((((((((((((( Files Created from 2009-05-22 to 2009-06-22 )))))))))))))))))))))))))))))))
.

2009-06-20 18:45 . 2009-06-20 18:45 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-20 18:25 . 2009-06-20 18:25 -------- d--h--r- c:\documents and settings\Chris Blosser\Application Data\SecuROM
2009-06-20 15:54 . 2009-06-20 16:01 -------- d-----w- C:\Box Office Bust
2009-06-20 10:33 . 2008-05-30 21:19 507400 ----a-w- c:\windows\system32\XAudio2_1.dll
2009-06-20 10:32 . 2009-06-20 10:32 -------- d-----w- c:\windows\Logs
2009-06-20 05:15 . 2009-06-20 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Pro
2009-06-20 05:10 . 2009-06-20 05:10 -------- d-----w- c:\program files\Zapu
2009-06-20 05:08 . 2009-06-20 05:08 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-06-20 05:08 . 2009-06-20 05:36 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\DAEMON Tools Pro
2009-06-20 04:47 . 2009-06-20 04:47 -------- d-----w- c:\documents and settings\Chris Blosser\Local Settings\Application Data\WinZip
2009-06-20 04:47 . 2009-06-20 04:47 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-06-15 22:22 . 2009-06-15 22:22 152576 ----a-w- c:\documents and settings\Chris Blosser\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-14 01:50 . 2009-06-14 01:50 -------- d-----w- c:\program files\Avery
2009-06-13 03:12 . 2009-06-13 03:12 -------- d-----w- c:\program files\StudySmart
2009-06-12 00:40 . 2009-06-15 15:49 -------- d-----w- C:\_AcroTemp
2009-06-10 10:05 . 2009-06-10 10:05 -------- d-----w- c:\windows\ie8updates
2009-06-09 19:53 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-09 19:53 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-06 02:04 . 2009-06-06 02:04 -------- d-sh--w- c:\documents and settings\Chris Blosser\IECompatCache
2009-06-06 02:02 . 2009-06-06 02:02 -------- d-sh--w- c:\documents and settings\Chris Blosser\PrivacIE
2009-06-06 01:59 . 2009-06-06 01:59 -------- d-----w- c:\program files\Common Files\Real
2009-06-05 21:35 . 2009-06-05 21:35 -------- d-----w- c:\program files\Real
2009-06-05 21:34 . 2009-06-06 02:08 -------- d-----w- c:\program files\Rhapsody
2009-06-05 20:38 . 2009-06-05 20:38 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\Leadertech
2009-06-05 20:36 . 2009-06-05 20:38 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\Sonic
2009-06-05 20:34 . 2009-06-05 20:34 -------- d-----w- c:\program files\Common Files\Sonic
2009-06-05 20:33 . 2009-06-05 20:33 -------- d-----w- c:\program files\Common Files\SureThing Shared
2009-06-05 20:33 . 2004-08-13 09:56 40544 ----a-w- c:\windows\system32\drivers\drvnddm.sys
2009-06-05 20:33 . 2004-08-13 08:05 98358 ----a-w- c:\windows\dla.exe
2009-06-05 20:33 . 2004-08-13 08:05 61498 ----a-w- c:\windows\system32\tfswapi.dll
2009-06-05 20:33 . 2004-08-04 10:21 87136 ----a-w- c:\windows\system32\drivers\drvmcdb.sys
2009-06-05 20:33 . 2004-07-14 18:29 5627 ----a-w- c:\windows\system32\drivers\sscdbhk5.sys
2009-06-05 20:33 . 2004-07-14 18:28 23545 ----a-w- c:\windows\system32\drivers\ssrtln.sys
2009-06-05 20:33 . 2009-06-05 20:33 -------- d-----w- c:\program files\Sonic
2009-06-05 20:13 . 2009-06-05 20:13 -------- d--h--r- C:\MSOCache
2009-06-05 19:51 . 2009-06-05 19:51 -------- d-----w- c:\program files\iPod
2009-06-05 19:50 . 2009-06-05 19:51 -------- d-----w- C:\iTunes
2009-06-05 19:48 . 2009-06-05 19:48 -------- d-----w- c:\program files\QuickTime
2009-06-05 19:43 . 2009-06-05 19:43 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-04 21:48 . 2009-06-04 21:48 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-04 18:48 . 2009-06-04 18:48 -------- d-sh--w- c:\documents and settings\Chris Blosser\IETldCache
2009-06-04 18:18 . 2009-06-04 18:20 -------- dc-h--w- c:\windows\ie8

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-22 12:00 . 2009-05-26 14:20 6235426 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2009-06-20 16:11 . 2009-06-20 16:13 2310656 ----a-w- c:\windows\Internet Logs\xDBE.tmp
2009-06-20 09:38 . 2008-10-13 16:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-20 09:05 . 2008-10-13 22:10 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\FileZilla
2009-06-16 15:17 . 2009-06-16 15:52 2242048 ----a-w- c:\windows\Internet Logs\xDBD.tmp
2009-06-15 22:24 . 2008-10-30 17:07 -------- d-----w- c:\program files\Java
2009-06-14 01:54 . 2008-10-13 21:12 60848 ----a-w- c:\documents and settings\Chris Blosser\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-13 03:12 . 2009-02-28 05:18 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\ThomsonWest
2009-06-12 14:42 . 2009-02-28 05:17 -------- d-----w- c:\program files\StudySmartMPRE
2009-06-05 20:44 . 2008-10-13 21:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-06-05 19:51 . 2008-10-13 21:48 -------- d-----w- c:\program files\Common Files\Apple
2009-06-03 01:31 . 2009-06-03 01:33 2165248 ----a-w- c:\windows\Internet Logs\xDBC.tmp
2009-06-03 01:31 . 2009-06-03 01:33 233472 ----a-w- c:\windows\Internet Logs\xDBB.tmp
2009-05-29 20:36 . 2009-03-17 13:44 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-29 20:36 . 2008-10-13 21:49 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-21 18:33 . 2008-10-29 05:17 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-19 06:54 . 2009-05-19 06:54 774144 ----a-w- c:\windows\Internet Logs\xDB2E.tmp
2009-05-19 06:54 . 2009-05-19 06:54 2161152 ----a-w- c:\windows\Internet Logs\xDB2F.tmp
2009-05-17 06:12 . 2009-05-17 06:13 2152448 ----a-w- c:\windows\Internet Logs\xDBA.tmp
2009-05-13 05:15 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-12 01:52 . 2009-05-12 01:52 -------- d-----w- c:\program files\Reflective Learning
2009-05-12 00:20 . 2008-12-26 02:12 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-05-08 22:00 . 2008-11-04 02:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Examsoft
2009-05-08 21:59 . 2008-11-04 02:14 102937 ----a-w- c:\windows\jgzr.dat
2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-04 03:20 . 2009-03-27 15:17 -------- d-----w- c:\program files\FileZilla FTP Client
2009-04-24 19:37 . 2009-04-24 04:04 -------- d-----w- c:\documents and settings\Chris Blosser\Application Data\Trondent Development Corp
2009-04-24 19:31 . 2009-04-24 19:32 2114048 ----a-w- c:\windows\Internet Logs\xDB9.tmp
2009-04-24 19:31 . 2009-04-24 19:32 3134464 ----a-w- c:\windows\Internet Logs\xDB8.tmp
2009-04-19 04:31 . 2009-04-19 08:10 2091008 ----a-w- c:\windows\Internet Logs\xDB7.tmp
2009-04-17 12:26 . 2004-08-04 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-03 02:22 . 2009-04-03 03:46 2027520 ----a-w- c:\windows\Internet Logs\xDB6.tmp
2009-03-31 20:09 . 2009-03-31 20:09 152576 ----a-w- c:\documents and settings\Chris Blosser\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-27 15:20 . 2008-10-14 01:35 4212 ---ha-w- c:\windows\system32\zllictbl.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-06-22_12.03.13 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-22 21:27 . 2009-06-22 21:27 16384 c:\windows\Temp\Perflib_Perfdata_750.dat
+ 2009-06-22 21:27 . 2009-06-22 21:27 16384 c:\windows\Temp\Perflib_Perfdata_238.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MoneyAgent"="c:\microsoft money\System\Money Express.exe" [2000-07-19 176183]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-09-15 118784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936]
"HP Software Update"="c:\hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"DVDLauncher"="c:\powerdvd\DVDLauncher.exe" [2004-04-26 53248]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"avast!"="c:\avast4\ashDisp.exe" [2009-02-05 81000]
"Adobe Acrobat Speed Launcher"="c:\adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-02-27 38768]
"Acrobat Assistant 8.0"="c:\adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-02-27 640376]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"ZoneAlarm Client"="c:\zonealarm\zlclient.exe" [2009-02-16 981384]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696]
"iTunesHelper"="c:\itunes\iTunesHelper.exe" [2009-05-30 292136]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-11-18 1724416]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Zapu\\Zapu Accelerator\\Webseed_dl.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [10/13/2008 6:09 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10/13/2008 6:09 PM 20560]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [5/3/2004 4:26 PM 88192]
S0 ntcdrdrv;ntcdrdrv;c:\windows\system32\DRIVERS\ntcdrdrv.sys --> c:\windows\system32\DRIVERS\ntcdrdrv.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\micros~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-22 14:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-06-22 14:51
ComboFix-quarantined-files.txt 2009-06-22 21:51

Pre-Run: 44,959,424,512 bytes free
Post-Run: 44,933,902,336 bytes free

190 --- E O F --- 2009-06-10 10:05

[TheBruce1]

Hello again

If there are no further issues, continue below.

======

Delete DDS from your desktop, you may keep ATF-Cleaner if you wish...otherwise delete from desktop.

=======

Well done, your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

========

Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.


Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.


For Internet Explorer users:
WOT for IE

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
Malwarebytes ' Anti-Malware

SpywareBlaster to help prevent spyware from installing in the first place.

• Install & update SpywareBlaster with the latest definitions.
  After you have updated, click the button - enable protection for all unprotected items

------------------------------------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more.

It can also alert you if you have not installed the latest patches from Microsoft.

==============================================

Also, please take a look at this well written article:

PC Safety and Security--What Do I Need?

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more, as we may mark this as resolved, thanks.

[TheBruce1]

As this topic is resolved, this thread is closed.