System is Running unusually slow!!

[legolas192]

Hello

My computer started to run very slowly lately. The unusual part is that it happened randomly. Even My Computer takes a few minutes to show up. Also, a recurring problem is that when I try to watch a show online or even on a media player, the computer freezes up in random areas. Some updates for Microsoft can't even install. I'm running Windows XP SP2 on a Compaq. Here is the DDS log. The attatch.txt is attached but the GMER program would always make the blue screen of death pop up(the screen with the "STOP 00000..." error on it). That is why I do not have a log for it.



DDS (Ver_09-06-26.01) - NTFSx86
Run by RAHUL at 20:34:03.85 on Tue 07/07/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.85 [GMT -4:00]

AV: Panda Internet Security 2008 *On-access scanning enabled* (Updated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
FW: Panda Internet Security 2008 *enabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rbaoim.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\msdtc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\RAHUL\Desktop\utorrent.exe
C:\Documents and Settings\RAHUL\Desktop\dds.scr

============== Pseudo HJT Report ===============

mSearch Bar =
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Verizon Broadband Toolbar: {4e7bd74f-2b8d-469e-d0fc-e57af4d5fa7d} - c:\progra~1\common~1\verizo~1\sfp\vzbb.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: SpyAssassin: {1028f737-81e7-452b-a860-e50cad90a08c} - c:\program files\spyassassin\AdBlocker.dll
TB: Verizon Broadband Toolbar: {4e7bd74f-2b8d-469e-d0fc-e57af4d5fa7d} - c:\progra~1\common~1\verizo~1\sfp\vzbb.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File
TB: {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe"
uRun: [MtdAcqu] "c:\program files\creative\mediasource5\MtdAcqu.exe" /s
uRun: [DAEMON Tools] "c:\personal folders\rahul\daemon tools\daemon.exe" -lang 1033
uRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe
mRun: [,] C:\,.exe -startup
mRun: [;] c:\windows\debug\,.exe -sta
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRunOnce: [wextract_cleanup0] rundll32.exe c:\windows\system32\advpack.dll,delnoderundll32 "c:\docume~1\rahul\locals~1\temp\ixp000.tmp\"
mRunOnce: [<NO NAME>] c:\program files\compaq\compaq advisor\bin\compaq-rbaoim.exe -z
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-us\local\search.html
IE: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office10\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {474F00F5-3853-492C-AC3A-476512BBC336} - hxxp://picasaweb.google.com/s/v/23.21/uploader2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} - hxxp://download.microsoft.com/download/PowerPoint2002/Install/10.0.2609/WIN98MeXP/EN-US/msorun.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/legacy/ractrl.cab?lmi=100
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
AppInit_DLLs: NVDESK32.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\rahul\applic~1\mozilla\firefox\profiles\sfbvcvsw.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - component: c:\documents and settings\rahul\application data\mozilla\firefox\profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\documents and settings\rahul\application data\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\rahul\application data\mozilla\plugins\npcoolirisplugin.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npigl.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npRACtrl.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPUploader.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npvirtools.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v1.02.12
============= SERVICES / DRIVERS ===============

R3 Gcr432;Gcr432;c:\windows\system32\drivers\gcr432.sys [2001-9-14 53445]
S1 cdudf;cdudf;c:\windows\system32\drivers\Cdudf.sys [2001-1-11 228736]
S3 BEFCMU10;Linksys BEFCMU10 EtherFast Cable Modem with USB;c:\windows\system32\drivers\befcmu10.sys --> c:\windows\system32\drivers\BEFCMU10.sys [?]
S3 CORRTSvc;.NET Framework Support Service;c:\windows\system32\svchost.exe -k CORSvcs [2001-10-22 14336]
S3 DbgProxy;Visual Studio Debugger Proxy Service;c:\program files\microsoft visual studio.net\common7\packages\debugger\dbgproxy.exe --> c:\program files\microsoft visual studio.net\common7\packages\debugger\dbgproxy.exe [?]

=============== Created Last 30 ================

2009-06-27 01:00 <DIR> --d----- c:\docume~1\rahul\applic~1\Dropbox

==================== Find3M ====================

2009-07-07 00:11 8,520 a------- c:\windows\compaq.reg
2009-05-21 11:33 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-07 11:44 344,064 a------- c:\windows\system32\localspl.dll
2009-05-01 14:30 3,366,912 a------- c:\windows\system32\GPhotos.scr
2009-04-29 00:56 827,392 a------- c:\windows\system32\wininet.dll
2009-04-29 00:55 78,336 a------- c:\windows\system32\ieencode.dll
2009-04-17 05:58 1,846,656 a------- c:\windows\system32\win32k.sys
2009-04-15 11:11 584,192 a------- c:\windows\system32\rpcrt4.dll
2009-02-28 21:50 93,520 a------- c:\docume~1\rahul\applic~1\GDIPFONTCACHEV1.DAT
2004-09-29 22:16 59,348 a------- c:\program files\lipi.ttf
2004-09-06 22:53 1,756,976 a------- c:\program files\spyassassin-1.6.3.exe
2003-05-08 09:17 1,434 a------- c:\program files\INSTALL.LOG
2003-04-28 11:35 10,240 a------- c:\program files\Xj6.exe
2003-04-28 11:35 10,240 a------- c:\program files\Ofq5.exe
2003-04-28 11:34 10,240 a------- c:\program files\Ix4.exe
2003-04-28 11:34 10,240 a------- c:\program files\Ir6.exe
2003-04-28 11:34 10,240 a------- c:\program files\Iek4.exe
2001-10-25 13:56 352,256 a------- c:\program files\TeluguLipiEditor.exe
2000-04-04 22:52 70,092 a------- c:\program files\PO_W98NS.ttf
2009-02-05 16:05 16,384 a--sh--- c:\windows\temp\cookies\index.dat
2009-02-05 16:05 32,768 a--sh--- c:\windows\temp\history\history.ie5\index.dat
2009-02-05 16:05 32,768 a--sh--- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 20:35:51.15 ===============

[legolas192]

Bump, Please!

[tetonbob]

Hello -

It may be that the amount of physical memory available on this machine is not enough for a security suite such as Panda. 512MB is the bare minimum for Windows XP with current applications. 1GB is better, or as much as the motherboard can handle.

To help us better determine if malware is the cause of the issue, I'd like to try to get a log from GMER still.

Let's try this version of gmer. Be sure to disable Panda AntiVirus before running this scan.


Download GMER Rootkit Scanner from here to your desktop.

• Double click the exe file.
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO, then use the following settings for a more complete scan.
  
  
  
  Click the image to enlarge it
  
  
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

If still no joy, also uncheck Devices. If you still cannot complete a GMER scan, try it in Safe Mode.

To start the machine in Safe Mode

Restart your computer and boot into Safe Mode by tapping the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers.

---------------------------------------------------------------------------------------------


Also...

Please go to: VirusTotal

• On the page you'll find a "Browse" button.
  
• Next to the browse button you'll see a box to enter text.
• Please copy/paste the following:
  
  c:\program files\Xj6.exe
  
  
• Then click the "Send File " button just below.
• This will scan the file. Please be patient.
• If you get a message saying File has already been analyzed: click Reanalyze file now
• Once scanned, copy and paste the results in your next reply.
  
• Please repeat for the following files:
  
  • 
    c:\program files\Iek4.exe
    

[legolas192]

Hi

It took me a long time but I finally got everything. The only problem I have though is that now mozilla firefox isnt working. I had to do everything with internet explorer. And also, after I did the GMER scan, none of my programs were working. It said "the computer does not have enough resources". I eventually got a stop error when i tried to restart and it said that it was because of a file "rdb.sys". Is all of this temporary? The GMER scan was done without Devices by the way. Anyways, Here are the results of the scans of the two files:


File Xj6.exe received on 2009.07.12 21:42:41 (UTC)Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.07.12 -
AhnLab-V3 5.0.0.2 2009.07.11 -
AntiVir 7.9.0.204 2009.07.12 -
Antiy-AVL 2.0.3.1 2009.07.10 Worm/Win32.Win32
Authentium 5.1.2.4 2009.07.12 -
Avast 4.8.1335.0 2009.07.12 -
AVG 8.5.0.387 2009.07.12 -
BitDefender 7.2 2009.07.12 -
CAT-QuickHeal 10.00 2009.07.10 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.07.12 -
Comodo 1628 2009.07.12 -
DrWeb 5.0.0.12182 2009.07.12 -
eSafe 7.0.17.0 2009.07.12 -
eTrust-Vet 31.6.6608 2009.07.10 -
F-Prot 4.4.4.56 2009.07.12 -
F-Secure 8.0.14470.0 2009.07.12 -
Fortinet 3.120.0.0 2009.07.12 -
GData 19 2009.07.12 -
Ikarus T3.1.1.64.0 2009.07.12 -
Jiangmin 11.0.706 2009.07.12 -
K7AntiVirus 7.10.790 2009.07.11 -
Kaspersky 7.0.0.125 2009.07.12 -
McAfee 5674 2009.07.12 -
McAfee+Artemis 5674 2009.07.12 -
McAfee-GW-Edition 6.8.5 2009.07.12 -
Microsoft 1.4803 2009.07.12 -
NOD32 4237 2009.07.12 -
Norman 6.01.09 2009.07.10 -
nProtect 2009.1.8.0 2009.07.12 -
Panda 10.0.0.14 2009.07.12 -
PCTools 4.4.2.0 2009.07.11 -
Prevx 3.0 2009.07.12 -
Rising 21.37.62.00 2009.07.12 -
Sophos 4.43.0 2009.07.12 -
Sunbelt 3.2.1858.2 2009.07.12 -
Symantec 1.4.4.12 2009.07.12 -
TheHacker 6.3.4.3.366 2009.07.12 -
TrendMicro 8.950.0.1094 2009.07.10 -
VBA32 3.12.10.8 2009.07.12 -
ViRobot 2009.7.11.1831 2009.07.11 -
VirusBuster 4.6.5.0 2009.07.12 -

Additional information
File size: 10240 bytes
MD5...: 69d65062f38a95a7022a7492d4be4ba4
SHA1..: c1a65adb9b18531352ec21ec21881af39cbf940e
SHA256: 1e2a66e2100c4308192e28d3ac5532471c64fb77af9b145d75b96afefa8e5418
ssdeep: 6:MxtEh/jKjXFeyclltA3g6XYFU4FlhrrV/wSBYS:2Eh/G70yUQw6Xj4Bp/wSBYS<BR>
PEiD..: -
TrID..: File type identification<BR>Generic Win/DOS Executable (49.9%)<BR>DOS Executable Generic (49.8%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x1000<BR>timedatestamp.....: 0x850c2c8bL (invalid)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 4 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>CODE 0x1000 0x1000 0x400 0.20 406f26fbf7e57c2d5864f624639b9da5<BR>DATA 0x2000 0x1000 0x400 0.00 0f343b0931126a20f133d67c2b018a3b<BR>.idata 0x3000 0x1000 0x400 0.43 731468d136f04c6fce07e5b4eda6c8fe<BR>.reloc 0x4000 0x11f6 0x1400 0.02 06ec58cd3b906195f348faf906fa462d<BR><BR>( 1 imports ) <BR>&gt; KERNEL32.dll: Sleep, ExitProcess<BR><BR>( 0 exports ) <BR>
PDFiD.: -
RDS...: NSRL Reference Data Set<BR>-





AND HERE IS THE OTHER FILE:

File Iek4.exe_ received on 2009.07.12 21:45:23 (UTC)Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.07.12 -
AhnLab-V3 5.0.0.2 2009.07.11 -
AntiVir 7.9.0.204 2009.07.12 -
Antiy-AVL 2.0.3.1 2009.07.10 Worm/Win32.Win32
Authentium 5.1.2.4 2009.07.12 -
Avast 4.8.1335.0 2009.07.12 -
AVG 8.5.0.387 2009.07.12 -
BitDefender 7.2 2009.07.12 -
CAT-QuickHeal 10.00 2009.07.10 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.07.12 -
Comodo 1628 2009.07.12 -
DrWeb 5.0.0.12182 2009.07.12 -
eSafe 7.0.17.0 2009.07.12 -
eTrust-Vet 31.6.6608 2009.07.10 -
F-Prot 4.4.4.56 2009.07.12 -
F-Secure 8.0.14470.0 2009.07.12 -
Fortinet 3.120.0.0 2009.07.12 -
GData 19 2009.07.12 -
Ikarus T3.1.1.64.0 2009.07.12 -
Jiangmin 11.0.706 2009.07.12 -
K7AntiVirus 7.10.790 2009.07.11 -
Kaspersky 7.0.0.125 2009.07.12 -
McAfee 5674 2009.07.12 -
McAfee+Artemis 5674 2009.07.12 -
McAfee-GW-Edition 6.8.5 2009.07.12 -
Microsoft 1.4803 2009.07.12 -
NOD32 4237 2009.07.12 -
Norman 6.01.09 2009.07.10 -
nProtect 2009.1.8.0 2009.07.12 -
Panda 10.0.0.14 2009.07.12 -
PCTools 4.4.2.0 2009.07.11 -
Prevx 3.0 2009.07.12 -
Rising 21.37.62.00 2009.07.12 -
Sophos 4.43.0 2009.07.12 -
Sunbelt 3.2.1858.2 2009.07.12 -
Symantec 1.4.4.12 2009.07.12 -
TheHacker 6.3.4.3.366 2009.07.12 -
TrendMicro 8.950.0.1094 2009.07.10 -
VBA32 3.12.10.8 2009.07.12 -
ViRobot 2009.7.11.1831 2009.07.11 -
VirusBuster 4.6.5.0 2009.07.12 -

Additional information
File size: 10240 bytes
MD5...: 69d65062f38a95a7022a7492d4be4ba4
SHA1..: c1a65adb9b18531352ec21ec21881af39cbf940e
SHA256: 1e2a66e2100c4308192e28d3ac5532471c64fb77af9b145d75b96afefa8e5418
ssdeep: 6:MxtEh/jKjXFeyclltA3g6XYFU4FlhrrV/wSBYS:2Eh/G70yUQw6Xj4Bp/wSBYS<BR>
PEiD..: -
TrID..: File type identification<BR>Generic Win/DOS Executable (49.9%)<BR>DOS Executable Generic (49.8%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x1000<BR>timedatestamp.....: 0x850c2c8bL (invalid)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 4 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>CODE 0x1000 0x1000 0x400 0.20 406f26fbf7e57c2d5864f624639b9da5<BR>DATA 0x2000 0x1000 0x400 0.00 0f343b0931126a20f133d67c2b018a3b<BR>.idata 0x3000 0x1000 0x400 0.43 731468d136f04c6fce07e5b4eda6c8fe<BR>.reloc 0x4000 0x11f6 0x1400 0.02 06ec58cd3b906195f348faf906fa462d<BR><BR>( 1 imports ) <BR>&gt; KERNEL32.dll: Sleep, ExitProcess<BR><BR>( 0 exports ) <BR>
PDFiD.: -
RDS...: NSRL Reference Data Set<BR>-

[tetonbob]

none of my programs were working

Are they currently working?

[legolas192]

Everything except for firefox

[tetonbob]

What happens when you launch Firefox? Does it not load at all? Does it load, but web pages don't resolve?

[legolas192]

I dont even see the window. It does not even start when I double click

[tetonbob]

I'm not sure why Firefox would suddenly stop functioning. It may require a reinstall, but we'll take care of that later if needed. IE works, so you have internet browsing capabilities.


Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

1. Download ComboFix from this location:
   
   Link 1
   
   * IMPORTANT !!! Place Combo-Fix.exe on your Desktop
   
2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
   
   
   You can get help on disabling your protection programs here
   
   
   Panda Internet Security Suite
   Please navigate to the system tray on the bottom right hand corner and look for a sign that looks like a Pandabear head.
   • Right click it-> select "Close automatic protection.".
   • A message will pop up and warn you about disabling the protection. Chose "Yes."
   • The above sign in the systemtray will now disapear.
   • You successfully disabled the Panda Internet Security Guard.
   
   
   
3. Go to -> Run -> paste in the following single line command & click OK
   
   

   "%userprofile%\desktop\Combo-Fix.exe" /killall

   
   
   
   
4. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
   
   Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
   
   
   
   
   
   The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.
   
   With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.
   
   Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.
   
   ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.
   
   Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:
   
   The Recovery Console was successfully installed.
   
   
   
   Click on Yes, to continue scanning for malware.
   
5. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
   
6. When finished, it shall produce a log for you. Post that log in your next reply
   
   Note:
   Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
   
   ---------------------------------------------------------------------------------------------
   
7. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
   
   ---------------------------------------------------------------------------------------------

[legolas192]

Hey

The thing about the Panda security is that I thought I deleted from my system a while ago. I dont even have it on my system tray. I thought I didnt have it. How do disable it now? Its not even in my list of programs in the start menu!

[tetonbob]

It may only be a registry reference left to Panda I'm seeing. There don't appear to be any running processes or startups. Which means there's no AntiVirus at all on this machine?

You should be fine to just continue with the instructions.

[legolas192]

The weird thing is that Combofix is saying that the "following realtime scanner is active: Panda Internet Security 2008"
Its asking me to disable it
Sorry I'm harrassing you about this but I really need to get it right!!

[legolas192]

Here is the Combofix log:

ComboFix 09-07-12.03 - RAHUL 07/12/2009 22:23.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.266 [GMT -4:00]
Running from: c:\documents and settings\RAHUL\desktop\Combo-Fix.exe
Command switches used :: /killall
AV: Panda Internet Security 2008 *On-access scanning enabled* (Updated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
FW: Panda Internet Security 2008 *enabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\27dda19.msi
c:\windows\Installer\5240e56.msp
c:\windows\Installer\da749f.msi
c:\windows\system32\_006128_.tmp.dll
c:\windows\system32\_006129_.tmp.dll
c:\windows\system32\_006130_.tmp.dll
c:\windows\system32\_006131_.tmp.dll
c:\windows\system32\_006138_.tmp.dll
c:\windows\system32\_006139_.tmp.dll
c:\windows\system32\_006140_.tmp.dll
c:\windows\system32\_006141_.tmp.dll
c:\windows\system32\_006143_.tmp.dll
c:\windows\system32\_006144_.tmp.dll
c:\windows\system32\_006145_.tmp.dll
c:\windows\system32\_006147_.tmp.dll
c:\windows\system32\_006148_.tmp.dll
c:\windows\system32\_006150_.tmp.dll
c:\windows\system32\_006151_.tmp.dll
c:\windows\system32\_006152_.tmp.dll
c:\windows\system32\_006153_.tmp.dll
c:\windows\system32\_006154_.tmp.dll
c:\windows\system32\_006157_.tmp.dll
c:\windows\system32\_006158_.tmp.dll
c:\windows\system32\_006162_.tmp.dll
c:\windows\system32\_006163_.tmp.dll
c:\windows\system32\_006165_.tmp.dll
c:\windows\system32\_006168_.tmp.dll
c:\windows\system32\_006170_.tmp.dll
c:\windows\system32\_006171_.tmp.dll
c:\windows\system32\_006172_.tmp.dll
c:\windows\system32\_006173_.tmp.dll
c:\windows\system32\_006174_.tmp.dll
c:\windows\system32\_006177_.tmp.dll
c:\windows\system32\_006178_.tmp.dll
c:\windows\system32\_006179_.tmp.dll
c:\windows\system32\_006180_.tmp.dll
c:\windows\system32\_006181_.tmp.dll
c:\windows\system32\_006186_.tmp.dll
c:\windows\system32\_006188_.tmp.dll
c:\windows\system32\ssqNGWqq.dll
c:\windows\system32\xxyxWnOg.dll

.
((((((((((((((((((((((((( Files Created from 2009-06-13 to 2009-07-13 )))))))))))))))))))))))))))))))
.

2009-07-05 23:07 . 2009-07-05 23:07 127872 ----a-w- c:\documents and settings\RAHUL\Application Data\Move Networks\uninstall.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-13 00:13 . 2009-02-12 03:01 -------- d-----w- c:\documents and settings\RAHUL\Application Data\uTorrent
2009-07-07 04:11 . 2003-03-30 17:40 8520 ----a-w- c:\windows\compaq.reg
2009-07-05 23:19 . 2007-05-27 03:25 -------- d-----w- c:\documents and settings\RAHUL\Application Data\Move Networks
2009-07-05 23:07 . 2009-06-16 06:35 4183416 ----a-w- c:\documents and settings\RAHUL\Application Data\Move Networks\plugins\npqmp071503000010.dll
2009-07-05 23:07 . 2009-07-05 23:07 1686272 ----a-w- c:\documents and settings\RAHUL\Application Data\Move Networks\MoveMediaPlayerWin_071503000010.exe
2009-06-29 19:28 . 2009-07-01 20:21 106496 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Plugins\npcoolirisplugin.dll
2009-06-29 19:28 . 2009-07-01 20:20 937984 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2009-06-29 19:28 . 2009-07-01 20:20 65536 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2009-06-29 19:28 . 2009-07-01 20:20 106496 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\npcoolirisplugin.dll
2009-06-29 19:28 . 2009-07-01 20:20 103424 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2009-06-29 19:28 . 2009-07-01 20:20 4734976 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\cooliris19.dll
2009-06-29 19:28 . 2009-07-01 20:20 344064 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2009-06-27 05:04 . 2009-06-27 05:00 -------- d-----w- c:\documents and settings\RAHUL\Application Data\Dropbox
2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\documents and settings\RAHUL\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-06-10 21:37 . 2009-06-10 21:37 152576 ----a-w- c:\documents and settings\RAHUL\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-02 18:40 . 2008-07-14 15:19 -------- d-----w- c:\documents and settings\Samubial\Application Data\LimeWire
2009-05-26 22:37 . 2009-07-10 22:21 259674 ----a-w- c:\windows\PCHEALTH\HELPCTR\Config\Cache\Personal_32_1033.dat
2009-05-22 14:55 . 2003-03-31 14:20 93520 ----a-w- c:\documents and settings\Samubial\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 15:33 . 2008-11-25 23:37 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-17 02:54 . 2007-09-19 17:02 -------- d-----w- c:\documents and settings\RAHUL\Application Data\LimeWire
2009-05-07 15:44 . 2009-02-14 00:17 344064 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w- c:\windows\system32\GPhotos.scr
2009-04-29 04:56 . 2004-02-06 22:05 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-18 14:04 . 2009-02-26 20:31 189464 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-17 09:58 . 2009-02-14 00:17 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:11 . 2004-07-14 13:39 584192 ----a-w- c:\windows\system32\rpcrt4.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2007-05-23 00:14 . 2008-02-18 13:34 8784 ----a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-05-23 00:17 . 2008-02-18 13:34 245408 ----a-w- c:\program files\mozilla firefox\plugins\unicows.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-09-29 700416]
"MtdAcqu"="c:\program files\Creative\MediaSource5\MtdAcqu.exe" [2006-03-08 278528]
"Microsoft Works Update Detection"="c:\program files\Microsoft Works\WkDetect.exe" [2000-07-13 28739]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
";"="c:\windows\Debug\" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\nvdesk32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\SAS Institute\\SAS\\V8\\sas.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM\\aim.exe"=

R3 Gcr432;Gcr432;c:\windows\system32\drivers\gcr432.sys [9/14/2001 7:08 PM 53445]
S1 cdudf;cdudf;c:\windows\system32\drivers\Cdudf.sys [1/11/2001 6:00 AM 228736]
S3 BEFCMU10;Linksys BEFCMU10 EtherFast Cable Modem with USB;c:\windows\system32\DRIVERS\BEFCMU10.sys --> c:\windows\system32\DRIVERS\BEFCMU10.sys [?]
S3 CORRTSvc;.NET Framework Support Service;c:\windows\System32\svchost.exe -k CORSvcs [10/22/2001 9:14 PM 14336]
S3 DbgProxy;Visual Studio Debugger Proxy Service;c:\program files\Microsoft Visual Studio.NET\Common7\Packages\Debugger\dbgproxy.exe --> c:\program files\Microsoft Visual Studio.NET\Common7\Packages\Debugger\dbgproxy.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
CORSvcs REG_MULTI_SZ CORRTSvc
.
Contents of the 'Scheduled Tasks' folder

2002-06-04 c:\windows\Tasks\Registration reminder 1.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-10-10 07:56]

2002-06-04 c:\windows\Tasks\Registration reminder 2.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-10-10 07:56]

2002-06-04 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-10-10 07:56]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DAEMON Tools - c:\personal folders\RAHUL\DAEMON Tools\daemon.exe


.
------- Supplementary Scan -------
.
mSearch Bar =
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
IE: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - plugin: c:\documents and settings\RAHUL\Application Data\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\RAHUL\Application Data\Mozilla\plugins\npcoolirisplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npigl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPUploader.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npvirtools.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v1.02.12.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-12 22:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EE6F7F74-172B-2FB0-AEA279A1BF4D862C}\{E8F7F584-6580-7444-5DDA05E0F08E204D}\{B782894F-9CE8-F53C-F71000A030EC5F4C}*]
"Q3FBLH6RIF6MYMN6VD31LVQSMD1"=hex:01,00,00,00,00,00,00,00,5c,63,e8,cf,f7,e6,fd,
3a

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F71B406A-64B6-7890-A4E79C228CB5B5C7}\{B2D97AB2-1AAA-0E19-47D2DF75F80031A6}\{B1F98325-4C85-36BE-448BCE0A416EDA34}*]
"Q3FBLH6RIF6MYMN6VD31LVQSMD1"=hex:01,00,00,00,00,00,00,00,5c,63,e8,cf,f7,e6,fd,
3a
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(5804)
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\scardsvr.exe
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\COMPAQ\Compaq Advisor\bin\compaq-rbaoim.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\pctspk.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\system32\fxssvc.exe
c:\progra~1\COMPAQ\COMPAQ~1\bin\nda.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-07-13 22:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-13 02:49
ComboFix2.txt 2008-10-22 01:49
ComboFix3.txt 2008-10-09 00:24

Pre-Run: 16,044,478,464 bytes free
Post-Run: 16,381,530,112 bytes free

214 --- E O F --- 2009-07-11 19:54

[tetonbob]

ComboFix is reacting to the WMI references left behind by Panda. We shall attempt to remove those as well, and you can ignore the message from ComboFix regarding Panda being active.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

1. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
   
2. Open notepad and copy/paste the text in the quotebox below into it:
   
   

   http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/392952-system-running-unusually-slow.html#post2236925
   DDS::
   uInternet Connection Wizard,ShellNext = iexplore
   uSearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
   IE: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
   SecCenter::
   AV: Panda Internet Security 2008 *On-access scanning enabled* (Updated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
   FW: Panda Internet Security 2008 *enabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}
   {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}
   {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
   
   Registry::
   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   ";"=-
   [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
   "EnableFirewall"=dword:00000001
   Collect::
   c:\Program Files\Xj6.exe
   c:\Program Files\Ofq5.exe
   c:\Program Files\Ix4.exe
   c:\Program Files\Ir6.exe
   c:\Program Files\Iek4.exe
   RegNull::
   [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EE6F7F74-172B-2FB0-AEA279A1BF4D862C}\{E8F7F584-6580-7444-5DDA05E0F08E204D}\{B782894F-9CE8-F53C-F71000A030EC5F4C}*]
   [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F71B406A-64B6-7890-A4E79C228CB5B5C7}\{B2D97AB2-1AAA-0E19-47D2DF75F80031A6}\{B1F98325-4C85-36BE-448BCE0A416EDA34}*]
   Comment::
   End Copy here

   Save this as CFScript.txt
   
   
   
   
   Referring to the picture above, drag CFScript.txt into ComboFix.exe
   
   
   
3. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
   
4. When finished, it shall produce a log for you. Post that log in your next reply
   
   Note:
   Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
   
   **Note**
   
   When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
   • Ensure you are connected to the internet and click OK on the message box.
   
   Please let me know if the file was successfully submitted . Thanks.
   
   ------------------------------------------------------
   
5. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
   
   ---------------------------------------------------------------------------------------------
   

[legolas192]

ComboFix 09-07-12.03 - RAHUL 07/13/2009 10:01.4.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.155 [GMT -4:00]
Running from: c:\documents and settings\RAHUL\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\RAHUL\Desktop\CFScript.txt
AV: Panda Internet Security 2008 *On-access scanning enabled* (Updated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
FW: Panda Internet Security 2008 *enabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}

file zipped: c:\program files\Iek4.exe
file zipped: c:\program files\Ir6.exe
file zipped: c:\program files\Ix4.exe
file zipped: c:\program files\Ofq5.exe
file zipped: c:\program files\Xj6.exe
.

((((((((((((((((((((((((( Files Created from 2009-06-13 to 2009-07-13 )))))))))))))))))))))))))))))))
.

2009-07-05 23:07 . 2009-07-05 23:07 127872 ----a-w- c:\documents and settings\RAHUL\Application Data\Move Networks\uninstall.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-13 00:13 . 2009-02-12 03:01 -------- d-----w- c:\documents and settings\RAHUL\Application Data\uTorrent
2009-07-07 04:11 . 2003-03-30 17:40 8520 ----a-w- c:\windows\compaq.reg
2009-07-05 23:19 . 2007-05-27 03:25 -------- d-----w- c:\documents and settings\RAHUL\Application Data\Move Networks
2009-07-05 23:07 . 2009-06-16 06:35 4183416 ----a-w- c:\documents and settings\RAHUL\Application Data\Move Networks\plugins\npqmp071503000010.dll
2009-07-05 23:07 . 2009-07-05 23:07 1686272 ----a-w- c:\documents and settings\RAHUL\Application Data\Move Networks\MoveMediaPlayerWin_071503000010.exe
2009-06-29 19:28 . 2009-07-01 20:21 106496 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Plugins\npcoolirisplugin.dll
2009-06-29 19:28 . 2009-07-01 20:20 937984 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2009-06-29 19:28 . 2009-07-01 20:20 65536 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2009-06-29 19:28 . 2009-07-01 20:20 106496 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\npcoolirisplugin.dll
2009-06-29 19:28 . 2009-07-01 20:20 103424 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2009-06-29 19:28 . 2009-07-01 20:20 4734976 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\cooliris19.dll
2009-06-29 19:28 . 2009-07-01 20:20 344064 ----a-w- c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2009-06-27 05:04 . 2009-06-27 05:00 -------- d-----w- c:\documents and settings\RAHUL\Application Data\Dropbox
2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\documents and settings\RAHUL\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-06-10 21:37 . 2009-06-10 21:37 152576 ----a-w- c:\documents and settings\RAHUL\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-02 18:40 . 2008-07-14 15:19 -------- d-----w- c:\documents and settings\Samubial\Application Data\LimeWire
2009-05-26 22:37 . 2009-07-10 22:21 259674 ----a-w- c:\windows\PCHEALTH\HELPCTR\Config\Cache\Personal_32_1033.dat
2009-05-22 14:55 . 2003-03-31 14:20 93520 ----a-w- c:\documents and settings\Samubial\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 15:33 . 2008-11-25 23:37 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-17 02:54 . 2007-09-19 17:02 -------- d-----w- c:\documents and settings\RAHUL\Application Data\LimeWire
2009-05-07 15:44 . 2009-02-14 00:17 344064 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w- c:\windows\system32\GPhotos.scr
2009-04-29 04:56 . 2004-02-06 22:05 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-18 14:04 . 2009-02-26 20:31 189464 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-17 09:58 . 2009-02-14 00:17 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:11 . 2004-07-14 13:39 584192 ----a-w- c:\windows\system32\rpcrt4.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2007-05-23 00:14 . 2008-02-18 13:34 8784 ----a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2007-05-23 00:17 . 2008-02-18 13:34 245408 ----a-w- c:\program files\mozilla firefox\plugins\unicows.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-09-29 700416]
"MtdAcqu"="c:\program files\Creative\MediaSource5\MtdAcqu.exe" [2006-03-08 278528]
"Microsoft Works Update Detection"="c:\program files\Microsoft Works\WkDetect.exe" [2000-07-13 28739]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\nvdesk32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\SAS Institute\\SAS\\V8\\sas.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM\\aim.exe"=

R3 Gcr432;Gcr432;c:\windows\system32\drivers\gcr432.sys [9/14/2001 7:08 PM 53445]
S1 cdudf;cdudf;c:\windows\system32\drivers\Cdudf.sys [1/11/2001 6:00 AM 228736]
S3 BEFCMU10;Linksys BEFCMU10 EtherFast Cable Modem with USB;c:\windows\system32\DRIVERS\BEFCMU10.sys --> c:\windows\system32\DRIVERS\BEFCMU10.sys [?]
S3 CORRTSvc;.NET Framework Support Service;c:\windows\System32\svchost.exe -k CORSvcs [10/22/2001 9:14 PM 14336]
S3 DbgProxy;Visual Studio Debugger Proxy Service;c:\program files\Microsoft Visual Studio.NET\Common7\Packages\Debugger\dbgproxy.exe --> c:\program files\Microsoft Visual Studio.NET\Common7\Packages\Debugger\dbgproxy.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
CORSvcs REG_MULTI_SZ CORRTSvc
.
Contents of the 'Scheduled Tasks' folder

2002-06-04 c:\windows\Tasks\Registration reminder 1.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-10-10 07:56]

2002-06-04 c:\windows\Tasks\Registration reminder 2.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-10-10 07:56]

2002-06-04 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2003-10-10 07:56]
.
.
------- Supplementary Scan -------
.
mSearch Bar =
uSearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\RAHUL\Application Data\Mozilla\Firefox\Profiles\sfbvcvsw.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v1.02.12.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-13 10:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

? [62836]
? [1528]
? [1336]
? [1344]
scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(132600)
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-07-13 10:25
ComboFix-quarantined-files.txt 2009-07-13 14:24
ComboFix2.txt 2009-07-13 02:51
ComboFix3.txt 2008-10-22 01:49
ComboFix4.txt 2008-10-09 00:24

Pre-Run: 16,407,744,512 bytes free
Post-Run: 16,389,324,800 bytes free

139 --- E O F --- 2009-07-11 19:54
Upload was successful

[tetonbob]

Next we need to get some protection on that machine. But first, we need to perform another step, and also, I need to know the current condition of the machine, and of Firefox.




1. Click on the Start menu.
2. Select Run...
3. Type wbemtest and click OK
4. Connect to root\SecurityCenter
5. Click on Query
6. Type in or copy/paste SELECT * FROM AntiVirusProduct and click on Apply

If there is more than one result, it means there is more than one Antivirus program installed. Double click on each result to view the properties for that Antivirus product. Identify the product(s) installed and DELETE any records for an Antivirus software that is no longer installed. For you, it is Panda.

Please repeat the process, but for step 6 this time, use SELECT * FROM FirewallProduct

[legolas192]

I did the process. I officially do not have any virus or firewall protection. My computer is now running at a normal speed but still freezing up from time to time. Also, firefox still does not work.

[tetonbob]

Let's get some AntiVirus protection on the machine first. Windows Firewall should be enabled, that should suffice for the time being.


Install this FREE AntiVirus program, update it, and run a full system scan. This is in addition to the quick scan suggested upon installation.

Avira AntiVir Personal

There is an installation guide here

When the scan is complete, click on the Report button. A log file will open. Please post that in your next reply.

Do not install more than one antivirus program because they will conflict with each other. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

---------------------------------------------------------------------------------------------


Post a new log from DDS also.

[legolas192]

Thanks for your help! The antivirus program is installing and i'll do a DDS scan after that. But the Windows firewall is not enabling. If I go through the control panel, I get a message saying that the "Windows Firewall settings cannot be displayed because the associated service is not running" and then it says it can connect to the Internernet Connection Service but that does not even work.

[tetonbob]

It may be that there are traces of Panda still on the machine. Follow the procedures on their page under "To automatically uninstall the program"

http://www.pandasecurity.com/homeuse...209&idIdioma=2