Help with Trojan:win32/AgentBypass.gen!G

[Jo-Diaz02]

Hello, I'm having some problems with my PC. One day I tried to install some required updates and they were always ready to install but failed to do so. Other than that it was running normally until a day I started it and windows showed me a message stating that Data Execution Prevention (DEP) has prevented Internet Explorer from execution without my permission. The DEP messages kept popping and the computer began getting slower, even the CPU usage reached 100% very frequently. I scanned the computer with windows defender and it found the following: Trojan: Win32/AgentBypass.gen!G, Trojan:Win32/InternetAntivirus, Trojan:Win32/Tibs.IT, Trojan:Win32/Tibs.IU. It removed them but every time I start my PC, Defender keeps warning me of a program trying to make an exception to the firewall rules. The occurence of these Defender warnings is from 1 every minute to 4 every minute and the videos streamed from the internet are playing like they have a cut each and every second, very choppy. I scanned the PC a few times after I found it was still infected and even tried a restore but it seems to be impossible to get rid of the Trojan:win32/AgentBypass.gen!G virus. I don't know how it got infected because I'm not the only user and I'm very cautious when I use the Web Any ways, I'm using Windows XP Sp #3, Any help or advice you can provide is very welcome, PLEASE HELP!


I need some help with the DDS thing, it says it is a screen saver. And when I downloaded it, it showed only one of the 3 icons I saw in the "New instructions" post. There you show three icons, dds.scr, dds.pif, dds.com. I have the one from the first "here" link you provide and I tried the other "here" link and found it was the one with the pif extension. Can you give me any additional istructions on this? I already did extract the Gmer and have the dds but I got the first icon on the picture on the "new instructions" section, the icon with the "!?" symbols. Any instructions to follow on this one?

Thanks in advance!

[chemist]

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

I need some help with the DDS thing, it says it is a screen saver.

Are you saying your computer won't allow dds.scr to run? Did you try double-clicking it to run it?

Please follow the instructions in the First Steps link exactly.

------------------------------------------------------

[Jo-Diaz02]

Thanks for the reply, and with regards to your question, no I just was worried because the extention of the DDS was .scr, and I wanted to be sure that I was doing nothing wrong. Sorry for the misunderstanding, it happens that my native language is not english but spanish and some times I could sound like rough to some people but it´s not my intention,it´s just that some times I can´t find the right words. I beg you excuse me if it appears that I´m a little rough to you, that´s not the intention.

Here is the DDS report as well as the attach files.



DDS (Ver_09-06-26.01) - NTFSx86
Run by Jorge D¡az at 12:53:39.85 on 13/07/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.432 [GMT -6:00]

AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Dell AIO 810\dlcgmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
C:\Documents and Settings\Jorge Díaz\Desktop\dds.scr
C:\WINDOWS\system32\bndmss.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
mWinlogon: Userinit=Userinit.exe
mWinlogon: Taskman=c:\recycler\s-1-5-21-3176080064-8957055401-848564433-9510\winmap32.exe
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {089fd14d-132b-48fc-8861-0048ae113215} - c:\program files\siteadvisor\6261\SiteAdv.dll
BHO: McAfee Phishing Filter: {377c180e-6f0e-4d4c-980f-f45bd3d40cf4} - c:\progra~1\mcafee\msk\mcapbho.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\6261\SiteAdv.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [12CFG914-K641-26SF-N32P] c:\recycler\s-1-5-21-0243336031-4052116379-881863308-0851\vse432.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [DLCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCGtime.dll,_RunDLLEntry@16
mRun: [dlcgmon.exe] "c:\program files\dell aio 810\dlcgmon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodaks~1.lnk - c:\program files\kodak\kodak software updater\7288971\program\Kodak Software Updater.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\LAUNCH~1.LNK -
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} - hxxp://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} -
Notify: igfxcui - igfxdev.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-9-2 201320]
R2 BNDMSS;Windows Network Data Management System Service;c:\windows\system32\bndmss.exe [2009-6-4 30720]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-9-2 359248]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-9-2 144704]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-9-2 695624]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-9-2 79304]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-9-2 35240]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-9-2 40488]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-9-2 33832]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2009-06-22 12:32 <DIR> --d----- c:\windows\system32\wbem\Repository

==================== Find3M ====================

2009-07-13 12:50 7,077,888 a------- c:\documents and settings\jorge díaz\NTUSER.DAT
2009-06-04 13:02 30,720 -------- c:\windows\system32\bndmss.exe
2009-06-03 17:07 5,578 a------- c:\windows\system32\PerfStringBackup.TMP
2009-05-06 22:24 156,672 a------- c:\windows\system32\rmc_fixasf.exe
2009-05-06 22:24 237,568 a------- c:\windows\system32\rmc_rtspdl.dll
2009-05-06 22:24 323,584 a------- c:\windows\system32\AUDIOGENIE2.DLL
2009-03-06 05:57 2,788,800 a------- c:\program files\FLV PlayerFCSetup.exe
2009-03-06 05:56 9,696,264 a------- c:\program files\FLV PlayerRCATSetup.exe
2009-03-06 05:52 21,011,904 a------- c:\program files\FLV PlayerRCSetup.exe

============= FINISH: 12:55:01.51 ===============

[chemist]

Hello Jo-Diaz02.

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

Download ComboFix and Save it to your Desktop.

* IMPORTANT !!! Save Combo-Fix.exe to your Desktop

------------------------------------------------------

• Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools.
  
• Get help here
  
• Please see this for help with disabling VirusScan >> http://img.photobucket.com/albums/v6...ee_disable.gif
  
• Double-click on Combo-Fix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes to continue scanning for malware.

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

------------------------------------------------------

[Jo-Diaz02]

Hello Chemist; I downloaded the Combofix, but when I try to run it, it prompts a message stating ¨there´s a new version of combofix, want to update? Should I get that new version?

Thanks in advance

[chemist]

Yes, please allow ComboFix to update if prompted.

[Jo-Diaz02]

Hello chemist, here is the combofix log:

ComboFix 09-07-14.08 - Jorge Díaz 17/07/2009 12:22.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.444 [GMT -6:00]
Running from: c:\documents and settings\Jorge Díaz\Desktop\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Jorge Díaz\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusXP.lnk
c:\recycler\S-1-5-21-0243336031-4052116379-881863308-0851
c:\recycler\S-1-5-21-0468463703-6752763511-745327105-5753
c:\recycler\S-1-5-21-0572535615-0756285333-546654907-0705
c:\recycler\S-1-5-21-0676938962-0876666913-908986832-8842
c:\recycler\S-1-5-21-0844295535-0054861172-053145151-1206
c:\recycler\S-1-5-21-1689290358-0035128540-389054495-2365
c:\recycler\S-1-5-21-1738720116-3136769174-668705174-5664
c:\recycler\S-1-5-21-3176080064-8957055401-848564433-9510
c:\recycler\S-1-5-21-3176080064-8957055401-848564433-9510\Desktop.ini
c:\recycler\S-1-5-21-3176080064-8957055401-848564433-9510\winmap32.exe
c:\recycler\S-1-5-21-4839915268-9314752184-976553610-7644
c:\recycler\S-1-5-21-5034753278-4391492615-880275978-4807
c:\recycler\S-1-5-21-5203719295-2792257535-438192042-6120
c:\recycler\S-1-5-21-5738466618-9339433537-548458471-5540
c:\recycler\S-1-5-21-6752068037-6113495147-139266748-8592
c:\recycler\S-1-5-21-7002477078-7225954701-068690151-1671
c:\recycler\S-1-5-21-7248788879-9378748093-610106841-7940
c:\recycler\S-1-5-21-9232197412-3938627218-585957635-9077
c:\recycler\S-1-5-21-9544966702-8917137865-333049166-2832
c:\recycler\S-1-5-21-9561388783-0053939016-840421148-5349
c:\windows\Downloaded Program Files\ODCTOOLS
c:\windows\Downloaded Program Files\ODCTOOLS\~t130.tmp
c:\windows\Installer\1006635.msp
c:\windows\Installer\1064552.msp
c:\windows\Installer\1064559.msp
c:\windows\Installer\1064560.msi
c:\windows\Installer\1064573.msp
c:\windows\Installer\1064584.msp
c:\windows\Installer\1064598.msp
c:\windows\Installer\10645dd.msp
c:\windows\Installer\10645f2.msp
c:\windows\Installer\106460a.msp
c:\windows\Installer\1064613.msp
c:\windows\Installer\1064628.msp
c:\windows\Installer\106463a.msp
c:\windows\Installer\1064650.msp
c:\windows\Installer\1183860.msp
c:\windows\Installer\1183868.msp
c:\windows\Installer\118386f.msp
c:\windows\Installer\26dcde.msi
c:\windows\Installer\54887d.msi
c:\windows\Installer\637df.msi
c:\windows\Installer\7102ad.msp
c:\windows\Installer\7102d2.msp
c:\windows\Installer\7102ec.msp
c:\windows\Installer\710302.msp
c:\windows\Installer\94633f.msp
c:\windows\Installer\946340.msp
c:\windows\Installer\946341.msp
c:\windows\Installer\946342.msp
c:\windows\Installer\946343.msp
c:\windows\Installer\946344.msp
c:\windows\Installer\946345.msp
c:\windows\Installer\946346.msp
c:\windows\Installer\946347.msp
c:\windows\Installer\9ce3ff.msp
c:\windows\Installer\9ce400.msp
c:\windows\Installer\9ce401.msp
c:\windows\Installer\9ce402.msp
c:\windows\Installer\9ce403.msp
c:\windows\Installer\9ce404.msp
c:\windows\Installer\9ce405.msp
c:\windows\Installer\9ce406.msp
c:\windows\Installer\9ce407.msp
c:\windows\Installer\9ce408.msp
c:\windows\Installer\9e9f6e.msp
c:\windows\Installer\9e9f78.msp
c:\windows\Installer\9e9f83.msp
c:\windows\Installer\b0fa72.msp
c:\windows\Installer\ddff4.msp
c:\windows\Installer\de030.msp
c:\windows\Installer\de044.msp
c:\windows\Installer\de06a.msp
c:\windows\Installer\de084.msp
c:\windows\system32\bndmss.exe
c:\windows\system32\rpcss(2)(2).dll
c:\windows\system32\uniq.tll
c:\windows\system32\warning.gif
c:\windows\system32\win32hlp.cnf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BNDMSS
-------\Service_BNDMSS


((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 )))))))))))))))))))))))))))))))
.

2009-06-22 18:32 . 2009-06-22 18:32 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-09 19:12 . 2006-10-26 00:59 -------- d-----w- c:\program files\Dl_cats
2009-06-13 01:37 . 2009-03-06 11:56 -------- d-----w- c:\program files\Replay Media Catcher
2009-06-07 23:00 . 2006-11-08 12:14 77408 ----a-w- c:\documents and settings\Leonel Diaz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-07 20:02 . 2006-10-27 23:37 77408 ----a-w- c:\documents and settings\Claribel Rosa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-05 06:07 . 2009-06-05 06:07 -------- d-----w- c:\program files\Windows Defender
2009-06-04 00:02 . 2008-03-05 10:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-03 23:07 . 2009-06-03 23:07 5578 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2009-05-22 22:03 . 2007-03-21 21:34 -------- d-----w- c:\documents and settings\Jennifer Diaz\Application Data\U3
2009-05-15 07:03 . 2006-10-30 04:46 77408 ----a-w- c:\documents and settings\Jennifer Diaz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-07 04:24 . 2009-04-09 19:27 156672 ----a-w- c:\windows\system32\rmc_fixasf.exe
2009-05-07 04:24 . 2009-04-09 19:27 237568 ----a-w- c:\windows\system32\rmc_rtspdl.dll
2009-05-07 04:24 . 2009-03-10 14:43 323584 ----a-w- c:\windows\system32\AUDIOGENIE2.DLL
2009-03-06 11:57 . 2009-03-06 11:56 2788800 ----a-w- c:\program files\FLV PlayerFCSetup.exe
2009-03-06 11:56 . 2009-03-06 11:55 9696264 ----a-w- c:\program files\FLV PlayerRCATSetup.exe
2009-03-06 11:52 . 2009-03-06 11:46 21011904 ----a-w- c:\program files\FLV PlayerRCSetup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-07-17 389120]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-07-31 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-24 136600]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728]
"dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-21 430080]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-11-15 155648]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-13 155648]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-02 582992]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-02-10 282624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-9-20 24576]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe [2005-3-10 757760]
Kodak software updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-2-13 16423]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 07:19 p.m. 13592]
.
Contents of the 'Scheduled Tasks' folder

2009-05-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-09-03 01:32]

2009-06-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-09-03 01:32]

2009-07-17 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 01:20]
.
.
------- Supplementary Scan -------
.
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-17 12:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3212307087-1084510436-2973750227-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3164)
c:\docume~1\JORGED~1\LOCALS~1\Temp\IadHide5.dll
c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
c:\program files\Common Files\Ahead\Lib\NeroSearchTrayHook.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
c:\program files\Common Files\Ahead\Lib\BCGCBPRO800u.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\drivers\KodakCCS.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dlcgcoms.exe
c:\progra~1\McAfee\MSC\mcuimgr.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\McAfee\MPF\MpfSrv.exe
.
**************************************************************************
.
Completion time: 2009-07-17 12:45 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-17 18:45

Pre-Run: 88,477,822,976 bytes free
Post-Run: 89,606,402,048 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

242 --- E O F --- 2009-06-05 05:52

[chemist]

Hello again, Jo-Diaz02. Please tell us how your system is behaving.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists:

Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here

------------------------------------------------------

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs):

J2SE Runtime Environment 5.0 Update 6

These are all outdated, and security risks by having them installed still. Unfortunately, Java does not uninstall these older versions when you update, nor tell you that you should. Going forward, Java will overwrite existing installs, so removing older versions should not be required after this.

In fact, you should be able to update your current Java, Java(TM) 6 Update 11, by going to Control Panel (Classic View) and double-clicking on the Java icon (looks like a coffee cup). Click on the Update tab. On the lower right, click on Update Now. An update should begin. Allow the install of the new Java.

Make sure you untick the box next to Yahoo Toolbar for Firefox/Mozilla or MSN Toolbar unless you want it.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Ensure your external and/or USB drives are inserted during the scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at any Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected.
• It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Please post the following in your next reply:

Kaspersky report
report on system behavior

[Jo-Diaz02]

The PC is running a bit faster now, though it is not at the same speed it had before it got the virus. But I´m not having the problem with the video streaming. I will do as you say and be back right after that, OK?

[chemist]

I'll be here.

[Jo-Diaz02]

Good day chemist, I have a question. I have a USB hard drive and 4 other usb flash memories but only 2 USB ports available, Should I run the Kaspersky online scan a few times until all the USB devices had been present during the scans? or shoul I run the scan only once and download a flash disinfector for the other USB devices?

[chemist]

Hello Jo-Diaz02. First, I would run the scan on the computer and two of the flash drives. Then run the scan again, configuring Kaspersky to scan only the two remaining flash drives. Then post both reports.

[Jo-Diaz02]

Hello chemist, here is the log for my PC, an external hard disk and 1GB flash memory. I scanned this flash memory separately and have a separate report if you need it. It says it found 55 infected items.Anyway, good day. here is the log:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Sunday, July 19, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Sunday, July 19, 2009 16:26:58
Records in database: 2495153
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 90598
Threat name: 5
Infected objects: 56
Suspicious objects: 0
Duration of the scan: 02:34:18


File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\bndmss.exe.vir Infected: Backdoor.Win32.Agent.ahgv 1
F:\new folder\new folder.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Data\Data.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\0DE4F643-C398-46ec-9339-2362F2311932\Data\My Skype Pictures\My Skype Pictures.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\0DE4F643-C398-46ec-9339-2362F2311932\Data\Data.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\0DE4F643-C398-46ec-9339-2362F2311932\0DE4F643-C398-46ec-9339-2362F2311932.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\EC30627F-0195-44d4-8C24-1B09F3C02C50\Exec\Exec.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\EC30627F-0195-44d4-8C24-1B09F3C02C50\EC30627F-0195-44d4-8C24-1B09F3C02C50.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Data\Data.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\3082\Promo\Promo.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\3082\3082.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1031\Promo\Promo.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1031\1031.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1033\Promo\Promo.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1033\1033.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1036\Promo\Promo.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1036\1036.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1040\Promo\Promo.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1040\1040.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1041\Promo\Promo.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1041\1041.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\2052\Promo\Promo.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\2052\2052.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\24142E37-DA3C-432a-82EA-59AD95B17904.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1F30627F-0195-44d4-8C24-1999F3C02C50\Data\Data.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1F30627F-0195-44d4-8C24-1999F3C02C50\1F30627F-0195-44d4-8C24-1999F3C02C50.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\285E6953-BF3C-4445-9376-3FE5D7F645B2\285E6953-BF3C-4445-9376-3FE5D7F645B2.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\ED241DFF-CBD5-41ad-975B-4B162A35BFF7\Data\Data.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\ED241DFF-CBD5-41ad-975B-4B162A35BFF7\ED241DFF-CBD5-41ad-975B-4B162A35BFF7.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\audio\audio.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\backgrounds\backgrounds.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\tilesets\tilesets.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\badges\badges.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\assets.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\cst\cst.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\DE\badges\badges.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\EN\badges\badges.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\ES\badges\badges.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\FR\badges\badges.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\IT\badges\badges.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\JA\badges\badges.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\ZH\badges\badges.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\local.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\player\player.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\Data.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\System\Apps\Apps.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\New Folder (2)\New Folder (2).exe Infected: Email-Worm.Win32.Brontok.q 1
F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\exe32.exe Infected: Trojan.Win32.Pakes.jwk 1
F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ine32.exe Infected: Backdoor.Win32.Bifrose.adxp 1
F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\win32.exe Infected: Worm.Win32.AutoRun.aevb 1
F:\Documents\CruzerSyncData\CruzerSyncData.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\Documents\signupshield\data\susc\susc.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\Documents\signupshield\signupshield.exe Infected: Email-Worm.Win32.Brontok.q 1
F:\Documents\Documents.exe Infected: Email-Worm.Win32.Brontok.q 1

The selected area was scanned.



And here is the log for a USB flash memory(4GB). My older brother says that he downloaded a keygen but have not installed it so he asked that I keep them. I think it is an ilegal thing from the sound of his description of that Keygen thing. If you tell me it is some ilegal stuff it will be delleted,I wait for your response. Here is the log:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Sunday, July 19, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Sunday, July 19, 2009 16:26:58
Records in database: 2495153
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Folder:
H:\

Scan statistics:
Files scanned: 389
Threat name: 6
Infected objects: 14
Suspicious objects: 0
Duration of the scan: 00:00:13


File name / Threat name / Threats count
H:\Documents\WinRar\winrar_3.62_key.exe Infected: Backdoor.Win32.Frauder.aqj 1
H:\Documents\WinRar\winrar_3.62_key.exe Infected: Trojan-Downloader.Win32.Small.jfh 1
H:\Documents\WinRar\winrar_3.62_key.exe Infected: Trojan.Win32.Monderb.ahoe 1
H:\Documents\WinRar\winrar_3.62_key.exe Infected: Trojan-Downloader.Win32.Agent.bfjx 1
H:\Documents\WinRar\winrar_key380I.exe Infected: Backdoor.Win32.Frauder.aqj 1
H:\Documents\WinRar\winrar_key380I.exe Infected: Trojan-Downloader.Win32.Small.jfh 1
H:\Documents\WinRar\winrar_key380I.exe Infected: Trojan.Win32.Monderb.ahoe 1
H:\Documents\WinRar\winrar_key380I.exe Infected: Trojan-Downloader.Win32.Agent.bfjx 1
H:\Documents\WinRar\winrar_key380II.exe Infected: Backdoor.Win32.Frauder.aqj 1
H:\Documents\WinRar\winrar_key380II.exe Infected: Trojan-Downloader.Win32.Small.jfh 1
H:\Documents\WinRar\winrar_key380II.exe Infected: Trojan.Win32.Monderb.ahoe 1
H:\Documents\WinRar\winrar_key380II.exe Infected: Trojan-Downloader.Win32.Agent.bfjx 1
H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\exe32.exe Infected: Trojan.Win32.Pakes.jwk 1
H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\win32.exe Infected: Worm.Win32.AutoRun.aevb 1

The selected area was scanned.



And I also scanned a digital camera with the online scanner and it found some infections too. The report is below:


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Monday, July 20, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Monday, July 20, 2009 18:21:16
Records in database: 2500993
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Folder:
G:\

Scan statistics:
Files scanned: 233
Threat name: 2
Infected objects: 4
Suspicious objects: 0
Duration of the scan: 00:00:10


File name / Threat name / Threats count
G:\DCIM\101MSDCF\101MSDCF.exe Infected: Virus.Win32.Virut.n 1
G:\DCIM\103_COPY\103_COPY.exe Infected: Virus.Win32.Virut.n 1
G:\MISC\MISC.exe Infected: Virus.Win32.Virut.n 1
G:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isee.exe Infected: Worm.Win32.AutoRun.dcm 1

The selected area was scanned.

[chemist]

Hello again, Jo-Diaz02. QooBox is ComboFix's quarantine folder. It will get deleted when we uninstall ComboFix.

The rest of those files have to go. And yes, keygens are illegal, and often infected.

In 2006, a study revealed that 59% of keygens and crack tools downloaded from peer-to-peer networks contained malicious or "unwanted" software.

------------------------------------------------------

Ensure your F: drive is inserted.

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"F:\new folder\new folder.exe"
"F:\System\Apps\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Data\Data.exe"
"F:\System\Apps\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8.exe"
"F:\System\Apps\0DE4F643-C398-46ec-9339-2362F2311932\Data\My Skype Pictures\My Skype Pictures.exe"
"F:\System\Apps\0DE4F643-C398-46ec-9339-2362F2311932\Data\Data.exe"
"F:\System\Apps\0DE4F643-C398-46ec-9339-2362F2311932\0DE4F643-C398-46ec-9339-2362F2311932.exe"
"F:\System\Apps\EC30627F-0195-44d4-8C24-1B09F3C02C50\Exec\Exec.exe"
"F:\System\Apps\EC30627F-0195-44d4-8C24-1B09F3C02C50\EC30627F-0195-44d4-8C24-1B09F3C02C50.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Data\Data.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\3082\Promo\Promo.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\3082\3082.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1031\Promo\Promo.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1031\1031.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1033\Promo\Promo.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1033\1033.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1036\Promo\Promo.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1036\1036.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1040\Promo\Promo.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1040\1040.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1041\Promo\Promo.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\1041\1041.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\2052\Promo\Promo.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\Exec\2052\2052.exe"
"F:\System\Apps\24142E37-DA3C-432a-82EA-59AD95B17904\24142E37-DA3C-432a-82EA-59AD95B17904.exe"
"F:\System\Apps\1F30627F-0195-44d4-8C24-1999F3C02C50\Data\Data.exe"
"F:\System\Apps\1F30627F-0195-44d4-8C24-1999F3C02C50\1F30627F-0195-44d4-8C24-1999F3C02C50.exe"
"F:\System\Apps\285E6953-BF3C-4445-9376-3FE5D7F645B2\285E6953-BF3C-4445-9376-3FE5D7F645B2.exe"
"F:\System\Apps\ED241DFF-CBD5-41ad-975B-4B162A35BFF7\Data\Data.exe"
"F:\System\Apps\ED241DFF-CBD5-41ad-975B-4B162A35BFF7\ED241DFF-CBD5-41ad-975B-4B162A35BFF7.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\audio\audio.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\backgrounds\backgrounds.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\tilesets\tilesets.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\badges\badges.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\assets\assets.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\cst\cst.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\DE\badges\badges.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\EN\badges\badges.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\ES\badges\badges.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\FR\badges\badges.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\IT\badges\badges.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\JA\badges\badges.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\ZH\badges\badges.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\local\local.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\player\player.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\Data\Data.exe"
"F:\System\Apps\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5\1FD3D3AE-B05C-48d0-8D19-36BE78FB3BC5.exe"
"F:\System\Apps\Apps.exe"
"F:\New Folder (2)\New Folder (2).exe"
"F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\exe32.exe"
"F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ine32.exe"
"F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\win32.exe"
"F:\Documents\CruzerSyncData\CruzerSyncData.exe"
"F:\Documents\signupshield\data\susc\susc.exe"
"F:\Documents\signupshield\signupshield.exe"
"F:\Documents\Documents.exe"

) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)


if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0

Save this Notepad file as fix.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on fix.bat to run it.

Tell me what it says in your next reply. Press any key to continue.

------------------------------------------------------

Ensure your G: and H: drives are inserted.

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"G:\DCIM\101MSDCF\101MSDCF.exe"
"G:\DCIM\103_COPY\103_COPY.exe"
"G:\MISC\MISC.exe"
"G:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\isee.exe"
"H:\Documents\WinRar\winrar_3.62_key.exe"
"H:\Documents\WinRar\winrar_key380I.exe"
"H:\Documents\WinRar\winrar_key380II.exe"
"H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\exe32.exe"
"H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\win32.exe"

) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)


if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0

Save this Notepad file as fix.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on fix.bat to run it.

Tell me what it says in your next reply. Press any key to continue.

------------------------------------------------------

[Jo-Diaz02]

Hello again chemist! I did as you told me and the window siad ¨Deleted succesfully¨press any key to continue_ on both cases what should I do now?

[chemist]

Congratulations. Well done! Your logs appear clean. You should be good to go.

As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now.

Please disable McAfee before uninstalling ComboFix and then re-enable it after doing so.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK:

combofix /u

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

• How Did I Get Infected In The First Place? by TonyKlein
• How to Prevent Malware by miekiemoes

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an add-on available for both Firefox and IE.
  
• SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
  
• MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Download Host.zip and Save it to your Desktop.
  • Right-click hosts.zip and select 'Extract all files' or 'Extract files...'.
  • Follow the prompts and click 'Finish'.
  • This will open the newly created hosts folder on your Desktop.
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  • Once updated you should see another prompt that the task was completed.
• IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here

Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.

[Jo-Diaz02]

Thanks, chemist. I ran the combofix /u and checked the restore points, they are gone and there is only one. I asume it is the one referenced at your post, the clean restore point, but the combofix icon is still in my desktop. I tried to download the SpywareBlaster and the page says "the product is not available in your country" and offers a list of site where to download it from: Download.c0m, Majorgeeks and through coral distribution network. Wich of these sites should I use for the download? I unzipped the HOSTS file and windows defender alerts me of system configuration change, I think I should allow it but want to be sure. And the the site for the IE-Spyad says:

"Last Updated: Jun 19 '09

Please Note: the original IE-SPYAD format that used .REG files to load and unload the Restricted Sites list is no longer available and will not be maintained. The same holds true for IE-SPYAD2. Both are replaced by what used to be called IE-SPYAD for ZonedOut. ZonedOut is a free utility that loads and unloads a plain text list of domains into the Restricted sites zone. You can think of ZonedOut as an improved replacement for the .BAT file utility used in the "original" IE-SPYAD. This new version of IE-SPYAD provides the same protection as the old version, but is easier to use and maintain."
And states that: "To use the IE-SPYAD for ZonedOut "Restricted sites" lists you must also download ZonedOut, a free Internet Explorer zone management utility"

What shoul I do?

[chemist]

Hello again, Jo-Diaz02. If ComboFix said 'ComboFix is uninstalled' when you ran combofix /u, then just right-click ComboFix.exe and delete it. Else, let me know.

All of those sites are OK--try MajorGeeks.

It is OK to tell Windows Defender to allow it.

As far as IE-SPYAD, the directions can be confusing. If you don't want to bother with it, then don't. If you want it, you will have to download ZonedOut and follow the instructions carefully. Let me know.

[Jo-Diaz02]

Hello chemist, sorry for the delay, I had to take my PC to the shop. Its was still in warranty and they said they re configured the BIOS. I will try to download the Spywareblaster from MAjorgeeks as you recomend and follow the instructions you provided on a previous reply. I waould like to know about the Academy mentioned in this forum. How can I enroll?

[chemist]

Hello again, Jo-Diaz02.

I had to take my PC to the shop.

What happened?

How can I enroll?

Go here > Please Read Before Applying To Join The Academy

and scroll down to:

If you are interested in joining the TSF Academy,

then follow the rest of the instructions.