Mebroot Trojan help

saberjk2 · 07-31-2009, 10:43 PM

Help! ESET 32 4.0 says I have a Mebroot trojan. It can't get rid of it. I would really appreciate some assistance. Here are the files you say you need, in the appropriate manner. Thank you for your time!

DDS.TXT

DDS (Ver_09-07-30.01) - NTFSx86
Run by *HIDDENTOPROTECTTHEINNOCENT* at 13:42:54.85 on Fri 07/31/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.113 [GMT -5:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\M-Audio\M-Audio Micro\MAUSBMRInst.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
G:\Program Files\CDBurnerXP\NMSAccess.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Java\jre6\bin\jusched.exe
G:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\WINDOWS\system32\ctfmon.exe
G:\Program Files\DL Software\D-Color\dcolor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
G:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
G:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
G:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Matthew Rose\Desktop\malware help\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:8181
uInternet Settings,ProxyOverride = *.local;<local>
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\sdra64.exe,
mWinlogon: SFCDisable=4 (0x4)
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\program files\hp\smart web printing\hpswp_framework.dll
BHO: {0555D119-7252-478D-B960-8D1B216F1482} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: IEWatchObj Class: {9527d42f-d666-11d3-b8dd-00600838cd5f} - c:\windows\system32\IETie.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
uRun: [Steam]
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [D-Color] g:\program files\dl software\d-color\dcolor.exe
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [RegistryMechanic]
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [iTunesHelper] "g:\program files\itunes\iTunesHelper.exe"
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [egui] "g:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
StartupFolder: c:\docume~1\matthe~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: E&xport to Microsoft Excel - g:\progra~1\micros~1\office10\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - g:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: listen.com\www
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB
DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB
DPF: {01016526-5E80-11D8-9E86-0007E96C65AE} - hxxps://install.charter.com/diskless/bin/ssctlsma.dll
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxps://support.dell.com/systemprofiler/SysPro.CAB
DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} - hxxp://tdserver.bitstream.com/tdserver.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} - hxxps://support.microsoft.com/OAS/ActiveX/odc.cab
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab
DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab
DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - hxxp://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1209852655390
DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - hxxp://launch.gamespyarcade.com/software/launch/alaunch.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://131.204.99.250/activex/AxisCamControl.cab
DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.4.1/jinstall-1_4_1_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} - hxxp://www.live365.com/players/play365.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {FDDCE9FF-1FC6-413C-80B1-37B101FDA1D4} - hxxp://download.buddylinks.net/ShellInstaller.cab
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - g:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - g:\program files\superantispyware\SASWINLO.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: nnnkjhe - nnnkjhe.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - g:\program files\superantispyware\SASSEH.DLL
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\matthe~1\applic~1\mozilla\firefox\profiles\8fgyq1m3.matthew_rose\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\documents and settings\matthew rose\application data\mozilla\firefox\profiles\8fgyq1m3.matthew_rose\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07074039.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: g:\program files\divx\divx player\npDivxPlayerPlugin.dll
FF - plugin: g:\program files\divx\divx web player\npdivx32.dll
FF - plugin: g:\program files\itunes\mozilla plugins\npitunes.dll
FF - plugin: g:\program files\mozilla firefox\plugins\npImgCtl.dll
FF - plugin: g:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: g:\program files\mozilla firefox\plugins\npmusicn.dll
FF - plugin: g:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: g:\realplayer\netscape6\nppl3260.dll
FF - plugin: g:\realplayer\netscape6\nprjplug.dll
FF - plugin: g:\realplayer\netscape6\nprpjplug.dll
FF - HiddenExtension: Java Console: No Registry Reference - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
g:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
g:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
g:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
g:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
g:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
g:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
g:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
g:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
g:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCE08D86A-A41A-410A-943C-13BABB7DC474", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA9EDC9ED-603A-4F3F-BBEA-59C8853A3236", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID90D10942-D952-4863-9DD6-A2BDBBAD456E", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0ECEE744-7B69-4912-AB91-AE76D61ECB04", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF25635B2-1AB9-47B5-88D1-8877B22C86DE", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID27B7F812-4159-45B9-A389-B7A118A58DE4", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF849DF29-393B-4F8B-99D1-117A70D66FC7", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBF1E9C3D-637C-4171-BD12-28A7360B879A", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDDE1C0601-7947-4D7F-A6E5-E68BF6BA1E37", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EA0DCCE-4D98-4876-9C6A-E5C563D0820A", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID446462BA-2AAD-4C88-BC63-5210E2F31465", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0862E368-A40E-4E55-83EB-FBC5571BABA4", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDD2A96E3C-FFB3-4D38-9AC3-B127527BEA35", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4B05B39A-9DDC-4650-A7F8-D5B134E5FFE5", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC8E2574A-7BCE-4B93-A22E-61831DFD6DB8", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID659796C0-8B5D-48D7-A4EB-7E6874E26274", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID78071AB5-E729-414E-8D02-9C1D034F82E7", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCC3F71E1-17F3-4C5B-997D-44CA56943197", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE67D5C78-B2D4-4BA0-8D69-1C7AF4BB08B5", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFC5F3D7A-D321-412C-8A5D-9AD0C8041941", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6EC5CD16-81BC-4515-9EDD-9265C906F56E", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID67CFB2C5-E491-4395-977B-CD45E4124655", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID73600569-52E6-4760-8BAB-B68202937D98", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB02EBD42-6885-401A-9389-E089F7DDC872", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBAE5CB8C-4075-4743-B2E4-78DA8D8CDC64", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID28B07B04-DA99-4FD3-BF27-4972F2B8142B", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D53448F-D12B-4102-8CE2-697DAE8D6643", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE3266A47-A141-47B8-AAA8-5F16FB4F8CCD", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB33AB7AF-76D7-4B1C-B709-5D6BF9E7B1C7", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID153B7451-0BB5-4B37-95C0-44D89E2F1F2B", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID3BBE8E21-0D3D-4BAA-AC6F-C7BCEF750849", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9B5B4F2D-A7D9-4329-B0FE-92B301A8CAAD", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA5C42921-8CD0-4924-97C3-01B5B0610BC6", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID06969252-F90F-4CF2-9074-33772EB64859", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFBF37655-1236-4C0D-96C5-F94E1724841B", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC1A3F035-B68F-4B2B-9FD5-E36DAAAF26DD", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID368F3685-543E-4812-9FDE-96E097E453FC", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID43969873-56AA-4113-84CB-4AB2AEB9AA31", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA205DD80-63D4-4E41-B785-26EC3D90B97B", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID068D43E7-7551-4A2F-AE96-4A38A9AD1953", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF443E9CB-9EEC-456E-8AE7-F3102D5CD47D", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE36A7B16-645D-4261-BFF8-3A7E69C5F7A5", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID379805E3-E0E2-40DC-B51B-6DC1AE5802AA", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF6240D69-A06D-44A1-8003-8496CCEF2C53", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID26C3113D-5A71-4F1B-A2CB-BE59E1279DDA", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID92B97F2B-7565-4CE9-9AC7-0598DFD731F8", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID2AA5E7CF-9696-42F0-B76A-8655296EADF2", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0AAACE0B-ACEF-4781-83F4-BFB52EEC995A", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D56FF58-A39D-4E8C-A40B-2E3711251772", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID946121C2-11F1-49DD-A7E3-CF793DE827A4", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB853303D-1BAB-43F3-9D7D-101D0DA8E7A5", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9E578247-FE29-4F8C-8202-A24A5688CF2A", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6D065A8F-FFC0-4A0F-B863-1D724B8C786B", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4451D291-6940-42CE-9D3C-CA1D4C96549C", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID064B722D-079D-4EBB-B3CF-9FCBF64FFF5D", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID38F8AB0F-5DFB-43D9-889E-8717CC4AB59B", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EC68CD1-0EF1-4CB9-9EF1-3D64AB266149", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID44F96B27-CFAD-41E1-83A1-6B28040C3BDE", "AllAccess");
g:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
g:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-5-14 94360]
R1 SASDIFSV;SASDIFSV;g:\program files\superantispyware\sasdifsv.sys [2006-10-10 5632]
R1 SASKUTIL;SASKUTIL;g:\program files\superantispyware\SASKUTIL.SYS [2007-2-27 51440]
R2 ekrn;ESET Service;g:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840]
R2 MAudioMicroService;M-Audio Micro Installer;c:\program files\m-audio\m-audio micro\MAUSBMRInst.exe [2007-12-26 331776]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-10-26 24652]
S2 DNSCacheReader;dns cache reader;c:\windows\system32\j7241538.exe --> c:\windows\system32\j7241538.exe [?]
S2 Workstation (lanmanworkstation) ;Workstation (lanmanworkstation) ;c:\program files\tinyproxy\tinyproxy.exe --> c:\program files\tinyproxy\TinyProxy.exe [?]
S3 MAUSBML;Service for M-Audio Micro (WDM);c:\windows\system32\drivers\mausbmr.sys [2007-12-26 124800]
S3 SASENUM;SASENUM;g:\program files\superantispyware\SASENUM.SYS [2006-2-16 4096]
S3 SPCP825K;Sunplus Serial port driver;c:\windows\system32\drivers\SPCP825K.sys [2005-12-25 26624]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2004-9-16 228432]

=============== Created Last 30 ================

2009-07-19 09:49 <DIR> --d----- c:\docume~1\matthe~1\applic~1\InfraRecorder
2009-07-16 18:10 <DIR> --d----- c:\program files\iPod

==================== Find3M ====================

2009-06-26 11:50 666,624 a------- c:\windows\system32\wininet.dll
2009-06-26 11:50 81,920 a------- c:\windows\system32\ieencode.dll
2009-06-17 17:03 170,060 a------- c:\windows\hpqins00.dat
2009-06-16 09:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 09:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-03 14:09 1,291,264 a------- c:\windows\system32\quartz.dll
2009-05-29 13:36 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-05-28 03:31 152,904 ac------ c:\windows\system32\vghd.scr
2009-05-21 11:33 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-07 10:32 345,600 a------- c:\windows\system32\localspl.dll
2005-08-05 18:49 32 ac---r-- c:\documents and settings\all users\hash.dat

============= FINISH: 13:44:06.39 ===============

saberjk2 · 08-04-2009, 05:29 PM

hello? anyone there?

saberjk2 · 08-07-2009, 12:38 PM

i'll keep bumping this. anyone know what's wrong?

Ried · 08-07-2009, 09:31 PM

Hello saberjk2, patience please. As explained in our pre-posting topic, we all volunteer our time and there are a whole lot more people needing help, than there are of us.

Yes, I see the problem and before we begin...

One or more of the identified infections is a backdoor trojan/rootkit.

This type of infection allows hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge.

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

You can read this: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

====================================

It will require more than one round to properly clean your system. Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

====================================================

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal.

====================================================

Double click on combofix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

saberjk2 · 08-08-2009, 09:37 AM

Thank you thank you thank you. I thought that was probably the reason for the wait. I'm sorry you don't have enough people helping. But you guys are doing a great job despite the fact! combofix log coming up in a few minutes.

Ried · 08-08-2009, 09:40 AM

You're welcome. You've caught me online, so I shall be standing by.

saberjk2 · 08-08-2009, 10:36 AM

wow. that took a lot longer than I hoped. Anyways, here's the combofix log file.

interesting note, a .dll file was deleted in the fix making firefox unusable. I'm having to browse through IE now.... ugh.

ComboFix 09-08-07.09 - Matthew Rose 08/08/2009 10:54.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.164 [GMT -5:00]
Running from: c:\documents and settings\Matthew Rose\Desktop\malware help\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\temp\17o7
c:\temp\17o7\tmpTF.log
c:\temp\brr
c:\windows\Downloaded Program Files\RdxIE.dll
c:\windows\fmark2.dat
c:\windows\Installer\1300d5.msi
c:\windows\Installer\df33eb.msi
c:\windows\Readme.txt
c:\windows\smdat32m.sys
c:\windows\system32\AutoRun.inf
c:\windows\system32\b02FdUe
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\mcrh.tmp
g:\program files\Mozilla Firefox\freebl3.dll
g:\program files\Mozilla Firefox\nspr4.dll
g:\program files\Mozilla Firefox\plc4.dll
g:\program files\Mozilla Firefox\plds4.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DNSCACHEREADER
-------\Legacy_DOMAINSERVICE
-------\Service_DNSCacheReader

((((((((((((((((((((((((( Files Created from 2009-07-08 to 2009-08-08 )))))))))))))))))))))))))))))))
.

2009-08-06 02:58 . 2009-08-07 15:07 -------- d-----w- c:\documents and settings\Matthew Rose\Tracing
2009-08-06 02:56 . 2009-08-06 02:56 -------- d-----w- c:\program files\Microsoft
2009-08-06 02:56 . 2009-08-06 02:56 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-08-06 02:55 . 2009-08-06 02:56 -------- d-----w- c:\program files\Windows Live
2009-08-06 02:45 . 2009-08-06 02:45 -------- d-----w- c:\program files\Common Files\Windows Live
2009-08-03 09:33 . 2009-08-03 09:33 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-07-31 18:08 . 2009-07-31 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-07-19 14:49 . 2009-07-19 14:49 -------- d-----w- c:\documents and settings\Matthew Rose\Application Data\InfraRecorder
2009-07-18 22:14 . 2009-07-18 22:16 -------- d-----w- c:\documents and settings\Matt Rose\Application Data\InfraRecorder
2009-07-18 21:27 . 2009-07-18 21:27 -------- d-----w- c:\documents and settings\Matt Rose\Local Settings\Application Data\Mozilla
2009-07-18 21:26 . 2009-07-18 21:26 -------- d-----w- c:\documents and settings\Matt Rose\Application Data\HPAppData
2009-07-18 21:20 . 2009-07-18 21:20 -------- d-----w- c:\documents and settings\Matt Rose\Local Settings\Application Data\ATI
2009-07-18 21:20 . 2009-07-18 21:20 -------- d-----w- c:\documents and settings\Matt Rose\Application Data\ATI
2009-07-18 21:20 . 2009-07-18 21:20 132 ----a-w- c:\documents and settings\Matt Rose\Local Settings\Application Data\fusioncache.dat
2009-07-18 21:20 . 2009-07-18 21:20 -------- d-----w- c:\documents and settings\Matt Rose\Local Settings\Application Data\Apple Computer
2009-07-18 21:19 . 2009-07-18 22:43 -------- d-----w- c:\documents and settings\Matt Rose
2009-07-16 23:10 . 2009-07-16 23:10 -------- d-----w- c:\program files\iPod
2009-07-16 23:00 . 2009-07-16 23:00 75040 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-13 23:00 . 2009-08-03 06:36 -------- d-----w- c:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-06 02:58 . 2004-02-17 01:59 80400 -c--a-w- c:\documents and settings\Matthew Rose\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-01 08:52 . 2008-01-05 01:10 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-07-31 17:58 . 2007-08-15 20:12 -------- d-----w- c:\program files\Eset
2009-07-22 21:51 . 2003-12-20 01:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-19 14:52 . 2005-06-02 03:02 -------- d-----w- c:\documents and settings\Matthew Rose\Application Data\Azureus
2009-07-18 22:11 . 2005-02-21 23:19 -------- d-----w- c:\program files\UltraISO
2009-07-18 21:20 . 2009-07-18 21:19 -------- d--h--w- c:\documents and settings\Matt Rose\Application Data\Gtek
2009-07-18 21:19 . 2009-07-18 21:19 79816 ----a-w- c:\documents and settings\Matt Rose\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-17 13:48 . 2005-10-21 16:41 -------- d-----w- c:\program files\Google
2009-07-16 23:09 . 2007-09-08 05:54 -------- d-----w- c:\program files\Common Files\Apple
2009-06-26 16:50 . 2004-02-06 23:05 666624 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:50 . 2004-08-04 07:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-17 22:03 . 2009-06-17 21:58 170060 ----a-w- c:\windows\hpqins00.dat
2009-06-16 14:36 . 2002-09-03 17:06 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2002-09-03 16:33 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 01:32 . 2009-06-15 01:32 390664 ----a-w- c:\documents and settings\Matthew Rose\Application Data\Real\RealPlayer\Update\realplayer11gold.exe
2009-06-11 21:17 . 2004-06-21 21:34 -------- d-----w- c:\program files\Java
2009-06-11 21:16 . 2009-06-11 21:16 152576 ----a-w- c:\documents and settings\Matthew Rose\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-04 01:44 . 2004-01-04 21:48 643 -c--a-w- c:\windows\eReg.dat
2009-06-04 01:34 . 2008-08-24 19:54 335872 -c--a-w- c:\documents and settings\All Users\Application Data\NexonUS\NGM\NGMResource.dll
2009-06-03 19:09 . 2003-12-25 19:10 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-29 18:36 . 2009-03-25 01:57 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-29 18:36 . 2007-11-09 14:57 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-28 15:00 . 2009-05-28 08:32 5 ----a-w- c:\windows\sbacknt.bin
2009-05-28 08:31 . 2009-05-28 08:31 152904 -c--a-w- c:\windows\system32\vghd.scr
2009-05-24 05:39 . 2009-05-24 05:39 152576 -c--a-w- c:\documents and settings\Matthew Rose\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-21 16:33 . 2008-12-15 21:11 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-14 20:49 . 2009-05-14 20:49 94360 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2009-05-14 20:47 . 2009-05-14 20:47 107256 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-05-14 20:41 . 2009-05-14 20:41 114472 ----a-w- c:\windows\system32\drivers\eamon.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"D-Color"="g:\program files\DL Software\D-Color\dcolor.exe" [2004-09-05 31744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-09-15 344064]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"iTunesHelper"="g:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"egui"="g:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2004-12-10 49152]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "g:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 19:41 294912 ----a-w- g:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Device Detector 3.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Device Detector 3.lnk
backup=c:\windows\pss\Device Detector 3.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^OZ-290HII Synchronization Software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\OZ-290HII Synchronization Software.lnk
backup=c:\windows\pss\OZ-290HII Synchronization Software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matthew Rose^Start Menu^Programs^Startup^BOINC Manager.lnk]
path=c:\documents and settings\Matthew Rose\Start Menu\Programs\Startup\BOINC Manager.lnk
backup=c:\windows\pss\BOINC Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matthew Rose^Start Menu^Programs^Startup^Firefox.lnk]
path=c:\documents and settings\Matthew Rose\Start Menu\Programs\Startup\Firefox.lnk
backup=c:\windows\pss\Firefox.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matthew Rose^Start Menu^Programs^Startup^Last.fm Helper.lnk]
path=c:\documents and settings\Matthew Rose\Start Menu\Programs\Startup\Last.fm Helper.lnk
backup=c:\windows\pss\Last.fm Helper.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matthew Rose^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Matthew Rose\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matthew Rose^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
path=c:\documents and settings\Matthew Rose\Start Menu\Programs\Startup\PowerReg Scheduler.exe
backup=c:\windows\pss\PowerReg Scheduler.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Java\\j2re1.4.1_02\\bin\\javaw.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"g:\\Program Files\\Steam\\SteamApps\\oogaboogajoe\\counter-strike source\\hl2.exe"=
"g:\\Program Files\\Steam\\SteamApps\\oogaboogajoe\\half-life 2 deathmatch\\hl2.exe"=
"g:\\Program Files\\Call of Duty\\CoDMP.exe"=
"g:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"g:\\Program Files\\Azureus\\Azureus.exe"=
"g:\\Program Files\\mIRC\\mirc.exe"=
"g:\\Program Files\\Call of Duty\\CoDUOMP.exe"=
"c:\\Program Files\\KODAK\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"g:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"g:\\Program Files\\America's Army\\System\\pb\\PnkBstrB.exe"=
"g:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=
"g:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"g:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6881:TCP"= 6881:TCP:listen port
"4000:TCP"= 4000:TCP:node listen
"27900:UDP"= 27900:UDP:1u
"29900:UDP"= 29900:UDP:2u
"29910:UDP"= 29910:UDP:3u
"27901:UDP"= 27901:UDP:4u
"55123:UDP"= 55123:UDP:5u
"55124:UDP"= 55124:UDP:6u
"55215:UDP"= 55215:UDP:7u
"16567:UDP"= 16567:UDP:8u
"1500:TCP"= 1500:TCP:9u
"29900:TCP"= 29900:TCP:2t
"29901:TCP"= 29901:TCP:3t
"29920:TCP"= 29920:TCP:4t
"28910:TCP"= 28910:TCP:5t
"4711:TCP"= 4711:TCP:6t

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [5/14/2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [5/14/2009 15:49 94360]
R1 SASDIFSV;SASDIFSV;g:\program files\SUPERAntiSpyware\sasdifsv.sys [10/10/2006 14:53 5632]
R1 SASKUTIL;SASKUTIL;g:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 13:39 51440]
R2 ekrn;ESET Service;g:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [5/14/2009 15:47 731840]
R2 MAudioMicroService;M-Audio Micro Installer;c:\program files\M-Audio\M-Audio Micro\MAUSBMRInst.exe [12/26/2007 02:58 331776]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/26/2007 16:13 24652]
S2 Workstation (lanmanworkstation) ;Workstation (lanmanworkstation) ;c:\program files\TinyProxy\TinyProxy.exe --> c:\program files\TinyProxy\TinyProxy.exe [?]
S3 MAUSBML;Service for M-Audio Micro (WDM);c:\windows\system32\drivers\mausbmr.sys [12/26/2007 02:58 124800]
S3 SASENUM;SASENUM;g:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 18:51 4096]
S3 SPCP825K;Sunplus Serial port driver;c:\windows\system32\drivers\SPCP825K.sys [12/25/2005 16:23 26624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-08-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:34]

2009-08-04 c:\windows\Tasks\Disk Defragmenter.job
- c:\documents and settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Defragmenter.lnk [2003-12-19 04:30]
.
- - - - ORPHANS REMOVED - - - -

BHO-{0555D119-7252-478D-B960-8D1B216F1482} - (no file)
HKCU-Run-Steam - (no file)
HKLM-Run-RegistryMechanic - (no file)
Notify-nnnkjhe - nnnkjhe.dll

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:8181
uInternet Settings,ProxyOverride = *.local;<local>
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: E&xport to Microsoft Excel - g:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
Trusted Zone: listen.com\www
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - g:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Matthew Rose\Application Data\Mozilla\Firefox\Profiles\8fgyq1m3.Matthew_Rose\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\documents and settings\Matthew Rose\Application Data\Mozilla\Firefox\Profiles\8fgyq1m3.Matthew_Rose\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07074039.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: g:\program files\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: g:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF - plugin: g:\program files\Mozilla Firefox\plugins\npImgCtl.dll
FF - plugin: g:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: g:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - plugin: g:\program files\Mozilla Firefox\plugins\npViewpoint.dll

---- FIREFOX POLICIES ----
g:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
g:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
g:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCE08D86A-A41A-410A-943C-13BABB7DC474", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA9EDC9ED-603A-4F3F-BBEA-59C8853A3236", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID90D10942-D952-4863-9DD6-A2BDBBAD456E", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0ECEE744-7B69-4912-AB91-AE76D61ECB04", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF25635B2-1AB9-47B5-88D1-8877B22C86DE", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID27B7F812-4159-45B9-A389-B7A118A58DE4", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF849DF29-393B-4F8B-99D1-117A70D66FC7", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBF1E9C3D-637C-4171-BD12-28A7360B879A", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDDE1C0601-7947-4D7F-A6E5-E68BF6BA1E37", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EA0DCCE-4D98-4876-9C6A-E5C563D0820A", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID446462BA-2AAD-4C88-BC63-5210E2F31465", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0862E368-A40E-4E55-83EB-FBC5571BABA4", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDD2A96E3C-FFB3-4D38-9AC3-B127527BEA35", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4B05B39A-9DDC-4650-A7F8-D5B134E5FFE5", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC8E2574A-7BCE-4B93-A22E-61831DFD6DB8", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID659796C0-8B5D-48D7-A4EB-7E6874E26274", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID78071AB5-E729-414E-8D02-9C1D034F82E7", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCC3F71E1-17F3-4C5B-997D-44CA56943197", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE67D5C78-B2D4-4BA0-8D69-1C7AF4BB08B5", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFC5F3D7A-D321-412C-8A5D-9AD0C8041941", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6EC5CD16-81BC-4515-9EDD-9265C906F56E", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID67CFB2C5-E491-4395-977B-CD45E4124655", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID73600569-52E6-4760-8BAB-B68202937D98", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB02EBD42-6885-401A-9389-E089F7DDC872", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBAE5CB8C-4075-4743-B2E4-78DA8D8CDC64", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID28B07B04-DA99-4FD3-BF27-4972F2B8142B", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D53448F-D12B-4102-8CE2-697DAE8D6643", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE3266A47-A141-47B8-AAA8-5F16FB4F8CCD", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB33AB7AF-76D7-4B1C-B709-5D6BF9E7B1C7", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID153B7451-0BB5-4B37-95C0-44D89E2F1F2B", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID3BBE8E21-0D3D-4BAA-AC6F-C7BCEF750849", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9B5B4F2D-A7D9-4329-B0FE-92B301A8CAAD", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA5C42921-8CD0-4924-97C3-01B5B0610BC6", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID06969252-F90F-4CF2-9074-33772EB64859", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFBF37655-1236-4C0D-96C5-F94E1724841B", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC1A3F035-B68F-4B2B-9FD5-E36DAAAF26DD", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID368F3685-543E-4812-9FDE-96E097E453FC", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID43969873-56AA-4113-84CB-4AB2AEB9AA31", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA205DD80-63D4-4E41-B785-26EC3D90B97B", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID068D43E7-7551-4A2F-AE96-4A38A9AD1953", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF443E9CB-9EEC-456E-8AE7-F3102D5CD47D", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE36A7B16-645D-4261-BFF8-3A7E69C5F7A5", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID379805E3-E0E2-40DC-B51B-6DC1AE5802AA", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF6240D69-A06D-44A1-8003-8496CCEF2C53", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID26C3113D-5A71-4F1B-A2CB-BE59E1279DDA", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID92B97F2B-7565-4CE9-9AC7-0598DFD731F8", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID2AA5E7CF-9696-42F0-B76A-8655296EADF2", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0AAACE0B-ACEF-4781-83F4-BFB52EEC995A", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D56FF58-A39D-4E8C-A40B-2E3711251772", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID946121C2-11F1-49DD-A7E3-CF793DE827A4", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB853303D-1BAB-43F3-9D7D-101D0DA8E7A5", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9E578247-FE29-4F8C-8202-A24A5688CF2A", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6D065A8F-FFC0-4A0F-B863-1D724B8C786B", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4451D291-6940-42CE-9D3C-CA1D4C96549C", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID064B722D-079D-4EBB-B3CF-9FCBF64FFF5D", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID38F8AB0F-5DFB-43D9-889E-8717CC4AB59B", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EC68CD1-0EF1-4CB9-9EF1-3D64AB266149", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID44F96B27-CFAD-41E1-83A1-6B28040C3BDE", "AllAccess");
g:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
g:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-08 11:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:õwjY*]
"DisplayName"="\09"
"DeviceDesc"="\09"
"ProviderName"=""
"MFG"="?"
"ReinstallString"="2002, 6.13.10.6193"
"DeviceInstanceIds"=multi:"\00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(864)
g:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\midimap.dll

- - - - - - - > 'explorer.exe'(396)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\Crypserv.exe
c:\program files\Java\jre6\bin\jqs.exe
g:\program files\CDBurnerXP\NMSAccess.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-08-08 11:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-08 16:30

Pre-Run: 13,586,464,768 bytes free
Post-Run: 16,191,762,432 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

417 --- E O F --- 2009-08-06 23:06

Ried · 08-08-2009, 10:57 AM

Before we continue, open Notepad and copy/paste the contents in the code box below, into Notepad.

Quote:

@echo off
for %%g in (
"C:\QooBox\Quarantine\g\program files\Mozilla Firefox\freebl3.dll.vir"
"C:\QooBox\Quarantine\g\program files\Mozilla Firefox\nspr4.dll.vir"
"C:\QooBox\Quarantine\g\program files\Mozilla Firefox\plc4.dll.vir"
"C:\QooBox\Quarantine\g\program files\Mozilla Firefox\plds4.dll.vir"
) do zip Files_for_submission %%g
del %0

Save this as Submit.bat Choose to "Save type as - All Files"
It should look like this:

Double click on Submit.bat & allow it to run.

A file, Files_for_submission.zip will be created on your desktop. Please upload that file here http://www.bleepingcomputer.com/subm....php?channel=4. Also include the link to this topic.

saberjk2 · 08-08-2009, 11:11 AM

so i made the .bat files and double clicked the icon and it disappears. no file was made.

Ried · 08-08-2009, 11:22 AM

Let's try this again.

Open Notepad and copy/paste the contents in the code box below, into Notepad.

Quote:

@echo off
for %%z in (
"C:\QooBox\Quarantine\g\program files\Mozilla Firefox\freebl3.dll.vir"
"C:\QooBox\Quarantine\g\program files\Mozilla Firefox\nspr4.dll.vir"
"C:\QooBox\Quarantine\g\program files\Mozilla Firefox\plc4.dll.vir"
"C:\QooBox\Quarantine\g\program files\Mozilla Firefox\plds4.dll.vir"
) do zip Files_for_submission %%z
del %0

Save this as Submit.bat Choose to "Save type as - All Files"
It should look like this:

Double click on Submit.bat & allow it to run.

========================

If it still does not produce a file for submission folder, click Start>Run and copy/paste the following bolded text into the Run box and click OK:

C:\Qoobox\ComboFix-quarantined-files.txt

A report should pop open for you. Please post the contents in your next reply.

saberjk2 · 08-08-2009, 11:33 AM

i restarted my machine. made another .bat file and ran it. it opens a cmd prompt and disappears after very quickly displaying some lines of code. and then the icon itself disappears. am I not waiting long enough? here is the report from running the command after manually running it.

2009-08-08 16:28:34 . 2009-08-08 16:28:34 512 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\Notify-nnnkjhe.reg.dat
2009-08-08 16:28:25 . 2009-08-08 16:28:25 104 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-RegistryMechanic.reg.dat
2009-08-08 16:28:23 . 2009-08-08 16:28:23 92 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-Steam.reg.dat
2009-08-08 16:28:20 . 2009-08-08 16:28:20 157 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\BHO-{0555D119-7252-478D-B960-8D1B216F1482}.reg.dat
2009-08-08 16:01:59 . 2009-08-08 16:01:59 2,568 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\Service_DNSCacheReader.reg.dat
2009-08-08 16:01:59 . 2009-08-08 16:01:59 846 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_DOMAINSERVICE.reg.dat
2009-08-08 16:01:59 . 2009-08-08 16:01:59 858 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_DNSCACHEREADER.reg.dat
2009-08-08 16:01:36 . 2009-08-08 16:01:36 5,078 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2009-08-08 15:39:50 . 2009-08-08 15:51:01 102 -c--a-w- C:\Qoobox\Quarantine\catchme.log
2009-04-19 17:26:00 . 2009-06-28 04:44:58 35,639 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\lowsec\local.ds.vir
2009-04-17 02:52:32 . 2009-07-18 21:20:04 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\lowsec\user.ds.vir
2008-09-22 02:16:10 . 2008-09-22 02:16:10 1 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\fmark2.dat.vir
2007-06-25 13:50:15 . 2007-08-09 20:07:17 143 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mcrh.tmp.vir
2007-06-05 23:07:33 . 2007-06-05 23:07:33 506,749 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\autorun.inf.vir
2007-04-24 16:21:00 . 2007-04-24 16:21:00 9,248 -c--a-w- C:\Qoobox\Quarantine\C\Temp\17O7\tmpTF.log.vir
2004-04-30 05:16:20 . 2004-05-09 00:39:48 10 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\smdat32m.sys.vir
2004-03-09 12:39:10 . 2004-03-09 12:39:10 1,562,624 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\Installer\1300d5.msi.vir
2004-02-10 04:30:03 . 2004-02-10 04:30:04 1,562,624 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\Installer\df33eb.msi.vir
2004-01-28 18:13:52 . 2004-01-28 18:13:52 520,349 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\Downloaded Program Files\RdxIE.dll.vir
2004-01-22 22:34:23 . 2004-01-16 16:32:46 275 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\Readme.txt.vir

Ried · 08-08-2009, 11:55 AM

For some reason, they are not in the quarantined files.

Do a search on your system. Do a search on your system All Files and type it in as nspr4.*

Let me know if it finds it anywhere.

=================================

We need to get an online scan, but before you do, your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
Scroll down to where it says "Java SE Runtime Environment (JRE) - JRE 6 Update 15 -"
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u14 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u15-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

===============================

After you've completed the above, it's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:

Using Internet Explorer, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

saberjk2 · 08-10-2009, 04:36 PM

I cannot get the online scanner to work. All I get is this error:
Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program.

You must be online to update the Kaspersky Online Scanner 7.0 database. With the latest database updates, you can find new viruses and other thresats. Please go online to use Kaspersky Online Scanner 7.0. [ERROR: Key is expired]

I've tried doing all of these things: updating Java to latest, clearing java applet cache, restarting machine, opening and closing online scanner multiple times (all same result).

there were two instances of nspr4.dll: in Mozilla Sunbird and OpenOffice. I've uninstalled both and reinstalled firefox. I couldn't take IE8 anymore. So now there is only one instance of nspr4.dll, in Firefox. All of those files were located in my slave drive G:/

Any ideas?

Ried · 08-10-2009, 06:44 PM

Those Firefox files were a false positive. I was looking to be able to restore them. No worries now that you've reinstalled Firefox.

Kaspersky seems to be having difficulties lately. Try this online scanner:

Go here to run an online scannner from ESET.

Note: You will need to use Internet explorer for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic.

saberjk2 · 08-11-2009, 09:56 PM

finally, done.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.5889
# api_version=3.0.2
# EOSSerial=f406dbb9bcc4b24bbb84f3e5c36a617c
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-11 06:00:42
# local_time=2009-08-11 01:00:42 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8199 21 100 100 47461250000
# scanned=92826
# found=0
# cleaned=0
# scan_time=2890
# nod_component=V3 Build:0x30000000
esets_scanner_update returned -1 esets_gle=37125
esets_scanner_update returned -1 esets_gle=37125
esets_scanner_update returned -1 esets_gle=37125
ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.5889
# api_version=3.0.2
# EOSSerial=f406dbb9bcc4b24bbb84f3e5c36a617c
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-08-12 03:46:31
# local_time=2009-08-11 10:46:31 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8199 21 100 100 74572187500
# scanned=94034
# found=0
# cleaned=0
# scan_time=5324
# nod_component=V3 Build:0x30000000

Ried · 08-11-2009, 11:40 PM

Hi saberjk2,

Your logs are clean. If there aren't any more problems, please continue with these final instructions and helpful links:

The following procedure will implement some cleanup procedures. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point.

Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK:

ComboFix /u

--------------------------------------------------------------------

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

Green to go
Yellow for caution
Red to stop

WOT has an addon available for both Firefox and IE.

SpywareBlaster 4.0 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.

It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page.

- Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

- Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released.

- Most importantly, Think Prevention

-----------------------------------------------------

**Kindly respond one more time and let me know if we may consider this thread resolved.

08-04-2009, 05:29 PM	#2 (permalink)
saberjk2 Registered User Join Date: Jul 2009 Posts: 9 OS: WinXP serv pack 3	Re: Mebroot Trojan help hello? anyone there?

08-07-2009, 12:38 PM	#3 (permalink)
saberjk2 Registered User Join Date: Jul 2009 Posts: 9 OS: WinXP serv pack 3	Re: Mebroot Trojan help i'll keep bumping this. anyone know what's wrong?

08-07-2009, 09:31 PM	#4 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,993 OS: WinXP and Vista	Re: Mebroot Trojan help Hello saberjk2, patience please. As explained in our pre-posting topic, we all volunteer our time and there are a whole lot more people needing help, than there are of us. Yes, I see the problem and before we begin... One or more of the identified infections is a backdoor trojan/rootkit. This type of infection allows hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. You can read this: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? ==================================== It will require more than one round to properly clean your system. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. ==================================================== Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop ==================================================== Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. ==================================================== Double click on combofix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt** in your next reply for further review. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

08-08-2009, 09:37 AM	#5 (permalink)
saberjk2 Registered User Join Date: Jul 2009 Posts: 9 OS: WinXP serv pack 3	Re: Mebroot Trojan help Thank you thank you thank you. I thought that was probably the reason for the wait. I'm sorry you don't have enough people helping. But you guys are doing a great job despite the fact! combofix log coming up in a few minutes.

08-08-2009, 09:40 AM	#6 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,993 OS: WinXP and Vista	Re: Mebroot Trojan help You're welcome. You've caught me online, so I shall be standing by. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

08-08-2009, 11:11 AM	#9 (permalink)
saberjk2 Registered User Join Date: Jul 2009 Posts: 9 OS: WinXP serv pack 3	Re: Mebroot Trojan help so i made the .bat files and double clicked the icon and it disappears. no file was made.

08-08-2009, 11:33 AM	#11 (permalink)
saberjk2 Registered User Join Date: Jul 2009 Posts: 9 OS: WinXP serv pack 3	Re: Mebroot Trojan help i restarted my machine. made another .bat file and ran it. it opens a cmd prompt and disappears after very quickly displaying some lines of code. and then the icon itself disappears. am I not waiting long enough? here is the report from running the command after manually running it. 2009-08-08 16:28:34 . 2009-08-08 16:28:34 512 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\Notify-nnnkjhe.reg.dat 2009-08-08 16:28:25 . 2009-08-08 16:28:25 104 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-RegistryMechanic.reg.dat 2009-08-08 16:28:23 . 2009-08-08 16:28:23 92 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-Steam.reg.dat 2009-08-08 16:28:20 . 2009-08-08 16:28:20 157 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\BHO-{0555D119-7252-478D-B960-8D1B216F1482}.reg.dat 2009-08-08 16:01:59 . 2009-08-08 16:01:59 2,568 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\Service_DNSCacheReader.reg.dat 2009-08-08 16:01:59 . 2009-08-08 16:01:59 846 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_DOMAINSERVICE.reg.dat 2009-08-08 16:01:59 . 2009-08-08 16:01:59 858 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_DNSCACHEREADER.reg.dat 2009-08-08 16:01:36 . 2009-08-08 16:01:36 5,078 -c--a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2009-08-08 15:39:50 . 2009-08-08 15:51:01 102 -c--a-w- C:\Qoobox\Quarantine\catchme.log 2009-04-19 17:26:00 . 2009-06-28 04:44:58 35,639 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\lowsec\local.ds.vir 2009-04-17 02:52:32 . 2009-07-18 21:20:04 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\lowsec\user.ds.vir 2008-09-22 02:16:10 . 2008-09-22 02:16:10 1 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\fmark2.dat.vir 2007-06-25 13:50:15 . 2007-08-09 20:07:17 143 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\mcrh.tmp.vir 2007-06-05 23:07:33 . 2007-06-05 23:07:33 506,749 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\autorun.inf.vir 2007-04-24 16:21:00 . 2007-04-24 16:21:00 9,248 -c--a-w- C:\Qoobox\Quarantine\C\Temp\17O7\tmpTF.log.vir 2004-04-30 05:16:20 . 2004-05-09 00:39:48 10 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\smdat32m.sys.vir 2004-03-09 12:39:10 . 2004-03-09 12:39:10 1,562,624 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\Installer\1300d5.msi.vir 2004-02-10 04:30:03 . 2004-02-10 04:30:04 1,562,624 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\Installer\df33eb.msi.vir 2004-01-28 18:13:52 . 2004-01-28 18:13:52 520,349 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\Downloaded Program Files\RdxIE.dll.vir 2004-01-22 22:34:23 . 2004-01-16 16:32:46 275 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\Readme.txt.vir

08-08-2009, 11:55 AM	#12 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,993 OS: WinXP and Vista	Re: Mebroot Trojan help For some reason, they are not in the quarantined files. Do a search on your system. Do a search on your system All Files and type it in as nspr4.* Let me know if it finds it anywhere. ================================= We need to get an online scan, but before you do, your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop. Scroll down to where it says "Java SE Runtime Environment (JRE) - JRE 6 Update 15 -" Click the "Download" button to the right. Select the Windows platform from the dropdown menu. Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u14 with JavaFX 1 License Agreement". Click on Continue.The page will refresh. Click on the link to download Windows Offline Installation and save the file to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java. Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u15-windows-i586-p.exe to install the newest version. After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button. Next, click on the Delete Files button There are two options in the window to clear the cache - Leave BOTH Checked Applications and Applets Trace and Log Files Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Temporary Files Window Click OK to leave the Java Control Panel. =============================== After you've completed the above, it's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Using Internet Explorer, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review: Close any open programs Turn off the real time scanner of any existing antivirus program while performing the online scan 3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View scan report at the bottom. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

08-10-2009, 04:36 PM	#13 (permalink)
saberjk2 Registered User Join Date: Jul 2009 Posts: 9 OS: WinXP serv pack 3	Re: Mebroot Trojan help I cannot get the online scanner to work. All I get is this error: Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program. You must be online to update the Kaspersky Online Scanner 7.0 database. With the latest database updates, you can find new viruses and other thresats. Please go online to use Kaspersky Online Scanner 7.0. [ERROR: Key is expired] I've tried doing all of these things: updating Java to latest, clearing java applet cache, restarting machine, opening and closing online scanner multiple times (all same result). there were two instances of nspr4.dll: in Mozilla Sunbird and OpenOffice. I've uninstalled both and reinstalled firefox. I couldn't take IE8 anymore. So now there is only one instance of nspr4.dll, in Firefox. All of those files were located in my slave drive G:/ Any ideas?

08-10-2009, 06:44 PM	#14 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,993 OS: WinXP and Vista	Re: Mebroot Trojan help Those Firefox files were a false positive. I was looking to be able to restore them. No worries now that you've reinstalled Firefox. Kaspersky seems to be having difficulties lately. Try this online scanner: Go here to run an online scannner from ESET. Note: You will need to use Internet explorer for this scan Turn off the real time scanner of any existing antivirus program while performing the online scan Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the activex control to install Click Start Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked Click Scan Wait for the scan to finish Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt Copy and paste that log as a reply to this topic. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

08-11-2009, 09:56 PM	#15 (permalink)
saberjk2 Registered User Join Date: Jul 2009 Posts: 9 OS: WinXP serv pack 3	Re: Mebroot Trojan help finally, done. ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=6 # iexplore.exe=6.00.2900.5512 (xpsp.080413-2105) # OnlineScanner.ocx=1.0.0.5889 # api_version=3.0.2 # EOSSerial=f406dbb9bcc4b24bbb84f3e5c36a617c # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2009-08-11 06:00:42 # local_time=2009-08-11 01:00:42 (-0600, Central Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=8199 21 100 100 47461250000 # scanned=92826 # found=0 # cleaned=0 # scan_time=2890 # nod_component=V3 Build:0x30000000 esets_scanner_update returned -1 esets_gle=37125 esets_scanner_update returned -1 esets_gle=37125 esets_scanner_update returned -1 esets_gle=37125 ESETSmartInstaller@High as downloader log: all ok # version=6 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.5889 # api_version=3.0.2 # EOSSerial=f406dbb9bcc4b24bbb84f3e5c36a617c # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2009-08-12 03:46:31 # local_time=2009-08-11 10:46:31 (-0600, Central Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=8199 21 100 100 74572187500 # scanned=94034 # found=0 # cleaned=0 # scan_time=5324 # nod_component=V3 Build:0x30000000

08-11-2009, 11:40 PM	#16 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,993 OS: WinXP and Vista	Re: Mebroot Trojan help Hi saberjk2, Your logs are clean. If there aren't any more problems, please continue with these final instructions and helpful links: The following procedure will implement some cleanup procedures. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u -------------------------------------------------------------------- To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites: Green to go Yellow for caution Red to stop WOT has an addon available for both Firefox and IE. SpywareBlaster 4.0 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page. - Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer - Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. - Most importantly, Think Prevention ----------------------------------------------------- **Kindly respond one more time and let me know if we may consider this thread resolved. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."