STOP 0x00000050 error while going into safe mode

[Arturo Rios]

The following was originally posted yesterday on the Windows XP Support:

"There is no problem when I choose to start Windows normally, only when I choose safe mode in any of its modes. This is the error I get:
PAGE_FAULT_IN_NONPAGED_AREA
0x00000050 (0xC356C77C,0x00000001,0x80537009,0x00000000).

I have not recently installed new hardware or software and the first time I ran into trouble was when I installed the Microsoft update Kb971486 which
I uninstalled and then I could login into windows normally. See here: http://www.stateofthetech.com/?p=117.

My PC`s specifications:
HP Pavillion du6500 Notebook PC
System board Id: 30CF
Processor type: AMD Turon 64 X2 Mobile Technology TL-58
Processor speed: 1900 mhz
Total memory: 1024 Mb
960 Mb RAM
Windows XP Profesional ver 2002 sp3

Any help you can give me to resolve this will be greately appreciated."

This is the response I got from CCT:

"There is this possibility; hxxp://support.microsoft.com/default...b;en-us;894278

I say that because Safe Mode is usually 'safe', whereas you aren't getting the error in normal boot.

I think you should re-post in the spyware section after reading/following this; NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help".

So I followed CCT`suggestions. Here´s my DDS.TXT file:

DDS (Ver_09-10-13.01) - NTFSx86
Run by admin at 16:31:01.28 on 21/10/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.959.311 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\System32\svchost.exe -k Cognizance
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe
C:\Archivos de programa\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\ARCHIV~1\AVG\AVG8\avgrsx.exe
C:\ARCHIV~1\AVG\AVG8\avgnsx.exe
C:\ARCHIV~1\AVG\AVG8\avgemc.exe
C:\Archivos de programa\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Archivos de programa\AVG\AVG8\avgcsrvx.exe
C:\Archivos de programa\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Archivos de programa\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\Archivos de programa\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Documents and Settings\admin\zeabei.exe
C:\Archivos de programa\Hewlett-Packard\Shared\HpqToaster.exe
C:\Archivos de programa\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Archivos de programa\Windows Live\Messenger\usnsvc.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Documents and Settings\admin\Escritorio\dds.com

============== Pseudo HJT Report ===============

uStart Page = about:blank
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\archivos de programa\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\archivos de programa\avg\avg8\toolbar\IEToolbar.dll
mWinlogon: Userinit=c:\windows\system32\userinit.exe, explorer.exe,
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\archivos de programa\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\archivos de programa\hp\smart web printing\hpswp_framework.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\archivos de programa\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\archivos de programa\avg\avg8\avgssie.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Aplicación auxiliar de inicio de sesión: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\archivos de programa\archivos comunes\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\archivos de programa\avg\avg8\toolbar\IEToolbar.dll
BHO: VeriSoft Access Manager: {df21f1db-80c6-11d3-9483-b03d0ec10000} - c:\archivos de programa\bioscrypt\verisoft\bin\ItIEAddIn.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\archivos de programa\avg\avg8\toolbar\IEToolbar.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\archivos de programa\windows live\messenger\MsnMsgr.Exe" /background
uRun: [MSMSGS] "c:\archivos de programa\messenger\msmsgs.exe" /background
uRun: [SUPERAntiSpyware] c:\archivos de programa\superantispyware\SUPERAntiSpyware.exe
uRun: [zeabei] c:\documents and settings\admin\zeabei.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [hpWirelessAssistant] c:\archivos de programa\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [RemoteControl] "c:\archivos de programa\cyberlink\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "c:\archivos de programa\cyberlink\powerdvd\language\Language.exe"
mRun: [HP Software Update] c:\archivos de programa\hp\hp software update\HPWuSchd2.exe
mRun: [AVG8_TRAY] c:\archiv~1\avg\avg8\avgtray.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\archivos de programa\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\menini~1\progra~1\inicio\hpdigi~1.lnk - c:\archivos de programa\hp\digital imaging\bin\hpqtra08.exe
IE: E&xportar a Microsoft Excel - c:\archiv~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\archivos de programa\messenger\msmsgs.exe
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\archivos de programa\hp\smart web printing\hpswp_extensions.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\archivos de programa\hp\smart web printing\hpswp_extensions.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\archiv~1\micros~2\office11\REFIEBAR.DLL
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} - hxxp://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\archivos de programa\avg\avg8\avgpp.dll
Notify: !SASWinLogon - c:\archivos de programa\superantispyware\SASWINLO.DLL
Notify: avgrsstarter - avgrsstx.dll
Notify: OneCard - c:\archivos de programa\bioscrypt\verisoft\bin\ASWLNPkg.dll
Notify: WBSrv - c:\archivos de programa\stardock\object desktop\windowblinds\wbsrv.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\archivos de programa\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli ASWLNPkg

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admin\datosd~1\mozilla\firefox\profiles\w2ap4c7d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-9-1 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-9-1 108552]
R1 SASDIFSV;SASDIFSV;c:\archivos de programa\superantispyware\sasdifsv.sys [2009-6-23 9968]
R1 SASKUTIL;SASKUTIL;c:\archivos de programa\superantispyware\SASKUTIL.SYS [2009-6-23 74480]
R2 ASBroker;Broker de inicio de sesión;c:\windows\system32\svchost.exe -k Cognizance [2008-4-13 14336]
R2 ASChannel;Canal de comunicación local;c:\windows\system32\svchost.exe -k Cognizance [2008-4-13 14336]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\archiv~1\avg\avg8\avgemc.exe [2009-9-1 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\archiv~1\avg\avg8\avgwdsvc.exe [2009-9-1 297752]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [2009-1-4 16384]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [2009-1-4 37888]
R3 SASENUM;SASENUM;c:\archivos de programa\superantispyware\SASENUM.SYS [2009-6-23 7408]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [2009-1-4 91648]
S3 hklfbet;hklfbet;\??\c:\windows\system32\02.tmp --> c:\windows\system32\02.tmp [?]

=============== Created Last 30 ================

2009-10-20 20:19 <DIR> --d----- c:\archivos de programa\Trend Micro
2009-10-20 18:09 <DIR> --d----- c:\windows\system32\appmgmt
2009-10-20 15:11 64 a------- c:\windows\wininit.ini
2009-10-19 21:56 29,696 ac------ c:\windows\system32\dllcache\dm9pci5.sys
2009-10-19 21:55 39,936 ac------ c:\windows\system32\dllcache\cnxt1803.sys
2009-10-19 21:54 164,923 ac------ c:\windows\system32\dllcache\diapi2.sys
2009-10-19 21:53 103,936 ac------ c:\windows\system32\dllcache\binlsvc.dll
2009-10-19 21:52 26,496 ac------ c:\windows\system32\dllcache\asc.sys
2009-10-19 21:51 32,827 ac------ c:\windows\system32\dllcache\tcptest.exe
2009-10-19 13:33 <DIR> --d----- c:\windows\pss
2009-10-14 20:57 2,191,488 ac------ c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-14 20:57 2,147,840 ac------ c:\windows\system32\dllcache\ntkrnlmp.exe
2009-10-14 20:57 2,147,840 a------- c:\windows\system32\ntoskrnl.exe
2009-10-14 20:57 2,026,496 a------- c:\windows\system32\ntkrnlpa.exe
2009-10-14 12:46 61,440 ---shr-- c:\documents and settings\admin\zeabei.scr
2009-10-14 12:46 61,440 ---shr-- c:\documents and settings\admin\zeabei.exe

==================== Find3M ====================

2009-10-21 10:23 92,928 a------- c:\windows\system32\drivers\ksecdd.sys
2009-10-14 21:02 504,940 a------- c:\windows\system32\perfh00A.dat
2009-10-14 21:02 90,898 a------- c:\windows\system32\perfc00A.dat
2009-10-08 12:10 2,828 a--sh--- c:\docume~1\alluse~1\datosd~1\KGyGaAvL.sys
2009-09-24 22:36 669,696 a------- c:\windows\system32\wininet.dll
2009-09-24 22:36 81,920 a------- c:\windows\system32\ieencode.dll
2009-09-11 07:18 136,192 a------- c:\windows\system32\msv1_0.dll
2009-09-10 14:54 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 14:53 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-09-04 14:04 58,880 a------- c:\windows\system32\msasn1.dll
2009-09-01 11:59 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-09-01 11:59 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-09-01 11:59 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
2009-08-26 01:01 247,326 a------- c:\windows\system32\strmdll.dll
2009-08-06 19:23 274,288 a------- c:\windows\system32\mucltui.dll
2009-08-06 19:23 215,920 a------- c:\windows\system32\muweb.dll
2009-08-05 02:00 205,312 a------- c:\windows\system32\mswebdvd.dll
2009-03-22 19:27 8 ---shr-- c:\docume~1\alluse~1\datosd~1\355178F374.sys

============= FINISH: 16:31:47.60 ===============

I also posted the Attach.zip file to be reviewed. Thanks in advance for all your help.

[chemist]

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix.

Get help here

Please post the C:\ComboFix.txt in your next reply for further review.

Please re-enable your antivirus after posting the ComboFix.txt log.

------------------------------------------------------

[Arturo Rios]

Thank you for your reply to my post. Please see COMBOFIX.TXT attached.
Regards.

ComboFix 09-10-25.01 - admin 25/10/2009 11:04.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.959.572 [GMT -8:00]
Running from: c:\documents and settings\admin\Escritorio\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\admin\CONFIG~1\Temp\502.exe
c:\documents and settings\admin\autorun.inf
c:\documents and settings\admin\Mis documentos\oct2009.reg
c:\recycler\S-1-5-21-2345960970-7924487754-818532316-9476
c:\recycler\S-1-5-21-4946304480-2993025695-606426835-2849
c:\recycler\S-1-5-21-5386681169-5868701602-133159031-8791
c:\recycler\S-1-5-21-6793961361-8043667181-507647877-7296
c:\recycler\S-1-5-21-6842298254-9791464974-900368986-5514
c:\recycler\S-1-5-21-7135943762-7955870680-714643083-5243
c:\recycler\S-1-5-21-9025402517-7123731706-628930094-6464
c:\recycler\S-1-5-21-9486330810-9922490187-393245247-2368
c:\recycler\S-1-5-21-9529188254-2521634672-950689832-8237
c:\windows\system32\404Fix.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :p
.
((((((((((((((((((((((((( Files Created from 2009-09-25 to 2009-10-25 )))))))))))))))))))))))))))))))
.

2009-10-23 23:29 . 2009-08-29 07:27 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-23 23:29 . 2009-08-29 07:27 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-10-23 23:29 . 2009-08-29 07:27 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-10-23 23:29 . 2009-08-29 07:27 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-10-23 23:29 . 2009-08-28 10:28 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2009-10-23 23:29 . 2009-08-29 07:27 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2009-10-23 23:29 . 2009-08-29 07:27 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2009-10-23 23:29 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2009-10-21 22:02 . 2009-10-21 22:02 -------- d--h--w- c:\documents and settings\All Users\Datos de programa\CanonBJ
2009-10-21 03:19 . 2009-10-21 03:19 -------- d-----w- c:\archivos de programa\Trend Micro
2009-10-20 04:56 . 2001-08-18 03:11 29696 -c--a-w- c:\windows\system32\dllcache\dm9pci5.sys
2009-10-20 04:55 . 2001-08-18 03:11 39936 -c--a-w- c:\windows\system32\dllcache\cnxt1803.sys
2009-10-20 04:54 . 2001-08-23 05:15 32256 -c--a-w- c:\windows\system32\dllcache\diapi2NT.dll
2009-10-20 04:53 . 2001-08-23 05:15 103936 -c--a-w- c:\windows\system32\dllcache\binlsvc.dll
2009-10-20 04:52 . 2001-08-18 04:52 26496 -c--a-w- c:\windows\system32\dllcache\asc.sys
2009-10-20 04:51 . 2003-03-24 23:52 32827 -c--a-w- c:\windows\system32\dllcache\tcptest.exe
2009-10-15 03:57 . 2009-02-09 11:24 2191488 -c--a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-15 03:57 . 2009-02-09 11:24 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-15 03:57 . 2009-02-09 11:23 2147840 -c--a-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-10-15 03:57 . 2009-02-09 11:23 2147840 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-14 19:46 . 2009-10-14 19:46 61440 --sh--r- c:\documents and settings\admin\zeabei.scr

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-25 19:08 . 2001-08-24 12:00 90898 ----a-w- c:\windows\system32\perfc00A.dat
2009-10-25 19:08 . 2001-08-24 12:00 504940 ----a-w- c:\windows\system32\perfh00A.dat
2009-10-21 17:23 . 2008-04-13 22:01 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-10-21 01:08 . 2009-04-19 00:28 -------- d-----w- c:\archivos de programa\MySecurityCenter
2009-10-19 21:50 . 2009-09-01 18:58 -------- d-----w- c:\documents and settings\All Users\Datos de programa\avg8
2009-10-19 20:47 . 2009-07-06 08:07 -------- d-----w- c:\archivos de programa\Malwarebytes' Anti-Malware
2009-10-19 03:22 . 2009-06-24 08:13 -------- d-----w- c:\archivos de programa\SUPERAntiSpyware
2009-10-11 23:36 . 2009-05-23 22:40 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-08 19:10 . 2009-03-23 02:27 2828 --sha-w- c:\documents and settings\All Users\Datos de programa\KGyGaAvL.sys
2009-09-15 05:30 . 2009-07-06 07:23 -------- d-----w- c:\archivos de programa\Opera
2009-09-11 14:18 . 2008-04-14 05:48 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 21:54 . 2009-07-06 08:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 21:53 . 2009-07-06 08:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-08 19:34 . 2009-01-05 05:39 -------- d-----w- c:\documents and settings\admin\Datos de programa\U3
2009-09-04 21:04 . 2008-04-14 05:48 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-02 18:05 . 2009-09-02 18:05 -------- d-----w- c:\documents and settings\All Users\Datos de programa\IObit
2009-09-01 18:59 . 2009-09-01 18:59 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-09-01 18:59 . 2009-09-01 18:59 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-09-01 18:59 . 2009-09-01 18:59 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-09-01 18:59 . 2009-09-01 18:59 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-09-01 18:59 . 2009-09-01 18:59 -------- d-----w- c:\documents and settings\All Users\Datos de programa\AVG Security Toolbar
2009-09-01 18:59 . 2009-09-01 18:59 -------- d-----w- c:\archivos de programa\AVG
2009-08-29 07:27 . 2008-04-14 05:48 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:27 . 2008-04-14 05:48 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:27 . 2008-04-14 05:48 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:01 . 2008-04-14 05:48 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-07 02:24 . 2009-01-05 05:29 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 02:24 . 2009-01-05 05:29 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 02:24 . 2009-01-05 05:29 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 02:24 . 2008-10-16 22:09 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 02:24 . 2009-01-05 05:29 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-07 02:24 . 2008-04-14 05:48 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 02:23 . 2009-01-05 05:29 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 02:23 . 2009-01-14 04:31 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 02:23 . 2009-01-14 04:31 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 02:23 . 2009-01-05 05:29 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:00 . 2008-04-14 05:48 205312 ----a-w- c:\windows\system32\mswebdvd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\archivos de programa\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 18:58 1107200 ----a-w- c:\archivos de programa\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\archivos de programa\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\archivos de programa\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\archivos de programa\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"MSMSGS"="c:\archivos de programa\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SUPERAntiSpyware"="c:\archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-19 2000112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"hpWirelessAssistant"="c:\archivos de programa\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"RemoteControl"="c:\archivos de programa\CyberLink\PowerDVD\PDVDServ.exe" [2006-09-18 29696]
"LanguageShortcut"="c:\archivos de programa\CyberLink\PowerDVD\Language\Language.exe" [2006-09-30 49152]
"HP Software Update"="c:\archivos de programa\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"AVG8_TRAY"="c:\archiv~1\AVG\AVG8\avgtray.exe" [2009-10-19 2025752]
"Malwarebytes Anti-Malware (reboot)"="c:\archivos de programa\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Men£ Inicio\Programas\Inicio\
HP Digital Imaging Monitor.lnk - c:\archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\archivos de programa\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-12 02:44 548352 ----a-w- c:\archivos de programa\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2006-10-10 04:38 69120 ----a-r- c:\archivos de programa\Bioscrypt\VeriSoft\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2009-02-10 00:20 229376 ----a-w- c:\archivos de programa\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-01 18:59 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=
"c:\\Archivos de programa\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe"=
"c:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [01/09/2009 10:59 a.m. 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [01/09/2009 10:59 a.m. 108552]
R1 SASDIFSV;SASDIFSV;c:\archivos de programa\SUPERAntiSpyware\sasdifsv.sys [23/06/2009 10:01 a.m. 9968]
R1 SASKUTIL;SASKUTIL;c:\archivos de programa\SUPERAntiSpyware\SASKUTIL.SYS [23/06/2009 10:01 a.m. 74480]
R2 ASBroker;Broker de inicio de sesión;c:\windows\System32\svchost.exe -k Cognizance [13/04/2008 09:49 p.m. 14336]
R2 ASChannel;Canal de comunicación local;c:\windows\System32\svchost.exe -k Cognizance [13/04/2008 09:49 p.m. 14336]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\archiv~1\AVG\AVG8\avgemc.exe [01/09/2009 10:59 a.m. 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\archiv~1\AVG\AVG8\avgwdsvc.exe [01/09/2009 10:59 a.m. 297752]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [04/01/2009 09:42 p.m. 16384]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [04/01/2009 09:42 p.m. 37888]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [04/01/2009 09:42 p.m. 91648]
S3 hklfbet;hklfbet;\??\c:\windows\system32\02.tmp --> c:\windows\system32\02.tmp [?]
S3 SASENUM;SASENUM;c:\archivos de programa\SUPERAntiSpyware\SASENUM.SYS [23/06/2009 10:01 a.m. 7408]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
yopvoka
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportar a Microsoft Excel - c:\archiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\admin\Datos de programa\Mozilla\Firefox\Profiles\w2ap4c7d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-zeabei - c:\documents and settings\admin\zeabei.exe
HKLM-Run-nwiz - nwiz.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-25 11:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\hklfbet]
"ImagePath"="\??\c:\windows\system32\02.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"A0C0110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(888)
c:\archivos de programa\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\archivos de programa\Bioscrypt\VeriSoft\Bin\ASWLNPkg.dll
c:\archivos de programa\Bioscrypt\VeriSoft\bin\ItMsg.dll
c:\archivos de programa\Stardock\Object Desktop\WindowBlinds\wbsrv.dll

- - - - - - - > 'lsass.exe'(944)
c:\archivos de programa\Bioscrypt\VeriSoft\bin\ASWLNPkg.dll
c:\archivos de programa\Bioscrypt\VeriSoft\bin\ItMsg.dll
.
Completion time: 2009-10-25 11:13
ComboFix-quarantined-files.txt 2009-10-25 19:13

Pre-Run: 83,939,889,152 bytes libres
Post-Run: 86,809,571,328 bytes libres

- - End Of File - - E9ED949DA74C4CEE310ADAC64D336EFE

[chemist]

Hello Arturo Rios. No need to attach logs going forward. Just copy/paste them directly into the Reply to Thread window. Thanks.

Any particular reason you didn't install the Recovery Console?

Please go to: VirusTotal

• On the page you'll find a Browse button.
  
• Next to the Browse button you'll see a box to enter text.
• Please copy/paste the following bolded text into the box:
  
  c:\documents and settings\admin\zeabei.scr
  
  
• Then click the Send File button just below.
• This will scan the file. Please be patient.
• If you get a message saying File has already been analysed: click Reanalyse file now
• Once scanned, copy and paste the results in your next reply.

------------------------------------------------------

[Arturo Rios]

Chemist, actually Combofix showed it was trying to install the Recovery console but there was no message saying why the recovery console was not installed.

This is the Virus Total scan report:

Análisis del archivo 426BA76800EAE057F01200D3C260B00000394568.exe recibido el 2009.10.21 02:30:04 (UTC)
Estado actual: análisis terminado
Resultado: 23/41 (56.10%)
Compactar Compactar Imprimir resultados Imprimir resultados
Motor antivirus Versión Última actualización Resultado
a-squared 4.5.0.41 2009.10.20 Virus.Worm.Win32.VBNA!IK
AhnLab-V3 5.0.0.2 2009.10.20 -
AntiVir 7.9.1.35 2009.10.20 Worm/VBNA.JDX
Antiy-AVL 2.0.3.7 2009.10.20 -
Authentium 5.1.2.4 2009.10.21 W32/VB.X.gen!Eldorado
Avast 4.8.1351.0 2009.10.20 Win32:VB-NIK
AVG 8.5.0.420 2009.10.20 -
BitDefender 7.2 2009.10.21 Trojan.VB.Chinky.G
CAT-QuickHeal 10.00 2009.10.20 Win32.Worm.VBNA.jdx.3
ClamAV 0.94.1 2009.10.21 Trojan.Chinky-1
Comodo 2673 2009.10.21 -
DrWeb 5.0.0.12182 2009.10.21 -
eSafe 7.0.17.0 2009.10.19 -
eTrust-Vet 35.1.7075 2009.10.19 Win32/Vobfus!generic
F-Prot 4.5.1.85 2009.10.20 W32/VB.X.gen!Eldorado
F-Secure 9.0.15300.0 2009.10.20 Trojan.VB.Chinky.G
Fortinet 3.120.0.0 2009.10.20 -
GData 19 2009.10.21 Trojan.VB.Chinky.G
Ikarus T3.1.1.72.0 2009.10.20 Virus.Worm.Win32.VBNA
Jiangmin 11.0.800 2009.10.20 -
K7AntiVirus 7.10.875 2009.10.20 -
Kaspersky 7.0.0.125 2009.10.21 Worm.Win32.VBNA.jdx
McAfee 5777 2009.10.20 W32/VBNA.worm
McAfee+Artemis 5777 2009.10.20 W32/VBNA.worm
McAfee-GW-Edition 6.8.5 2009.10.21 Worm.VBNA.JDX
Microsoft 1.5101 2009.10.20 -
NOD32 4527 2009.10.20 a variant of Win32/AutoRun.VB.GJ
Norman 6.03.02 2009.10.20 W32/VBNA.A
nProtect 2009.1.8.0 2009.10.20 Trojan/W32.Agent.61440.QB
Panda 10.0.2.2 2009.10.20 W32/Autorun.JKS
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.21 -
Rising 21.52.14.00 2009.10.20 -
Sophos 4.46.0 2009.10.21 W32/SillyFDC-DV
Sunbelt 3.2.1858.2 2009.10.20 Worm.Win32.VBNA.jdx (v)
Symantec 1.4.4.12 2009.10.21 -
TheHacker 6.5.0.2.049 2009.10.20 -
TrendMicro 8.950.0.1094 2009.10.20 -
VBA32 3.12.10.11 2009.10.20 -
ViRobot 2009.10.20.1996 2009.10.20 -
VirusBuster 4.6.5.0 2009.10.20 Worm.VBNA.Gen
Información adicional
File size: 61440 bytes
MD5 : 5a60b9dfa26e4c75775b08422d493049
SHA1 : 9b387294459e5d296e976d9d1633932769bfda9b
SHA256: 4b290a3a38d81e5992150d42a77d83927ef565ec97df4426e823b62655155583
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1184
timedatestamp.....: 0x4ACDA1F8 (Thu Oct 8 10:25:28 2009)
machinetype.......: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xC458 0xD000 5.07 26b12a069a08485749b4cc22ad7530ab
.data 0xE000 0x2408 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x11000 0x114 0x1000 4.01 b06a96e7b104361fca7dcae67c14a96f

( 1 imports )

> msvbvm60.dll: MethCallEngine, -, -, -, -, -, -, -, -, -, -, EVENT_SINK_AddRef, -, -, -, DllFunctionCall, EVENT_SINK_Release, EVENT_SINK_QueryInterface, __vbaExceptHandler, -, -, -, -, -, -, -, ProcCallEngine, -, -, -, -, -, -, -, -, -, -, -

( 0 exports )
TrID : File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 768:YXumpnBuJIpIS58Fy6+9A/v/bVlbdfs3OfKDHGIHY56W/:YXuQpv516y43wY56W/
PEiD : -
RDS : NSRL Reference Data Set
-

[Arturo Rios]

Very sorry Chemist. Disregard my last post. I reanalysed the file and I will send the current results of the scan as soon as have them.

[Arturo Rios]

Now, these are the last results of the scan.

Análisis del archivo zeabei.scr recibido el 2009.10.25 21:14:40 (UTC)
Estado actual: Cargando ... en cola en espera en proceso análisis terminado NO ENCONTRADO DETENIDO
Resultado: 32/41 (78.05%)
Cargando información del servidor..
Su archivo se encuentra encolado en la posición: 4.
Se estima que tendrá que esperar entre 70 y 100 segundos
hasta el comienzo del análisis.
No cierre la ventana hasta se haya completado el análisis.
El analizador que estaba procesando su muestra se encuentra detenido,
se va a esperar unos segundos por si fuera posible recuperar el resultado.
Si lleva esperando varios minutos necesitará reenviar su archivo de nuevo.
Su archivo está siendo analizado por VirusTotal en estos momentos,
los resultados se iran mostrando a continuación.
Compactar Compactar Imprimir resultados Imprimir resultados
La muestra ha caducado o no existe.
El sistema se encuentra detenido en estos momentos, su muestra se encuentra a la espera de ser analizada (posicion: ) por un tiempo indefinido.

Usted puede continuar esperando la respuesta por web (se recargará automaticamente) o bien introducir su email en el siguiente formulario y pulsar el botón "solicitar" para que la respuesta le sea automaticamente remitida por correo electrónico.
Email:

Motor antivirus Versión Última actualización Resultado
a-squared 4.5.0.41 2009.10.25 Virus.Worm.Win32.VBNA!IK
AhnLab-V3 5.0.0.2 2009.10.23 -
AntiVir 7.9.1.44 2009.10.23 Worm/VBNA.JDX
Antiy-AVL 2.0.3.7 2009.10.23 Worm/Win32.VBNA
Authentium 5.1.2.4 2009.10.25 W32/VB.X.gen!Eldorado
Avast 4.8.1351.0 2009.10.25 Win32:VB-NIK
AVG 8.5.0.423 2009.10.25 Worm/VB.VNV
BitDefender 7.2 2009.10.25 Trojan.VB.Chinky.G
CAT-QuickHeal 10.00 2009.10.24 Win32.Worm.VBNA.jdx.3
ClamAV 0.94.1 2009.10.25 Trojan.Chinky-1
Comodo 2729 2009.10.25 -
DrWeb 5.0.0.12182 2009.10.25 Trojan.MulDrop.39230
eSafe 7.0.17.0 2009.10.25 -
eTrust-Vet 35.1.7082 2009.10.23 Win32/Vobfus!generic
F-Prot 4.5.1.85 2009.10.25 W32/VB.X.gen!Eldorado
F-Secure 9.0.15370.0 2009.10.22 Trojan.VB.Chinky.G
Fortinet 3.120.0.0 2009.10.25 W32/VBNA.JDX!worm
GData 19 2009.10.25 Trojan.VB.Chinky.G
Ikarus T3.1.1.72.0 2009.10.25 Virus.Worm.Win32.VBNA
Jiangmin 11.0.800 2009.10.24 -
K7AntiVirus 7.10.879 2009.10.24 Trojan.Win32.Malware.1
Kaspersky 7.0.0.125 2009.10.25 Worm.Win32.VBNA.jdx
McAfee 5782 2009.10.25 W32/VBNA.worm
McAfee+Artemis 5782 2009.10.25 W32/VBNA.worm
McAfee-GW-Edition 6.8.5 2009.10.25 Heuristic.LooksLike.Win32.Suspicious.L!89
Microsoft 1.5202 2009.10.25 Worm:Win32/Vobfus.F
NOD32 4541 2009.10.25 a variant of Win32/AutoRun.VB.GJ
Norman 6.03.02 2009.10.23 W32/VBNA.A
nProtect 2009.1.8.0 2009.10.25 Trojan/W32.Agent.61440.QB
Panda 10.0.2.2 2009.10.25 W32/Autorun.JKS
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.25 High Risk Worm
Rising 21.52.62.00 2009.10.25 -
Sophos 4.46.0 2009.10.25 W32/SillyFDC-DV
Sunbelt 3.2.1858.2 2009.10.25 Worm.Win32.VBNA.jdx (v)
Symantec 1.4.4.12 2009.10.25 W32.Changeup
TheHacker 6.5.0.2.053 2009.10.24 -
TrendMicro 8.950.0.1094 2009.10.25 -
VBA32 3.12.10.11 2009.10.23 Worm.Win32.VBNA.jdx
ViRobot 2009.10.23.2003 2009.10.23 -
VirusBuster 4.6.5.0 2009.10.25 Worm.VBNA.Gen
Información adicional
Tamano archivo: 61440 bytes
MD5...: 5a60b9dfa26e4c75775b08422d493049
SHA1..: 9b387294459e5d296e976d9d1633932769bfda9b
SHA256: 4b290a3a38d81e5992150d42a77d83927ef565ec97df4426e823b62655155583
ssdeep: 768:YXumpnBuJIpIS58Fy6+9A/v/bVlbdfs3OfKDHGIHY56W/:YXuQpv516y43wY
56W/
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1184
timedatestamp.....: 0x4acda1f8 (Thu Oct 08 08:25:28 2009)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xc458 0xd000 5.07 26b12a069a08485749b4cc22ad7530ab
.data 0xe000 0x2408 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x11000 0x114 0x1000 4.01 b06a96e7b104361fca7dcae67c14a96f

( 1 imports )
> MSVBVM60.DLL: MethCallEngine, -, -, -, -, -, -, -, -, -, -, EVENT_SINK_AddRef, -, -, -, DllFunctionCall, EVENT_SINK_Release, EVENT_SINK_QueryInterface, __vbaExceptHandler, -, -, -, -, -, -, -, ProcCallEngine, -, -, -, -, -, -, -, -, -, -, -

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=426BA76800EAE057F01200D3C260B00000394568' target='_blank'>http://info.prevx.com/aboutprogramte...60B00000394568</a>

[chemist]

Hello Arturo Rios. We can install it another way.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

I see you have P2P software ( LimeWire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here and here.

I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs.

------------------------------------------------------

First, we need to install the Windows Recovery Console.

The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. Also, ComboFix will not address certain types of malware unless the RC is installed. It is a simple procedure that will only take a few moments of your time.

Download the file from this Microsoft page:

http://www.microsoft.com/downloads/d...displaylang=en

Do not be concerned that this file is for SP2 if you have SP3. It will work just fine on your system.

Save it as it is originally named to your Desktop.

Now close all open windows and programs, including all antivirus and antispyware programs. Get help here



Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console.

As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return.

ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Recovery Console is installed, this blue window will appear:



Please choose No

------------------------------------------------------

To open Notepad, go Start > Run and type Notepad then click 'OK'.

Open Notepad and copy/paste all the text in the codebox below into Notepad:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/424458-stop-0x00000050-error-while-going-into-safe-mode.html#post2409684

Collect::
c:\documents and settings\admin\zeabei.scr

RegNull::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]

NetSvc::
yopvoka

RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

Driver::
yopvoka
hklfbet

Save this Notepad file as CFScript.txt to your Desktop and then close the file.





Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix and have an internet connection, please choose Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

------------------------------------------------------

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

• Ensure you are connected to the internet and click OK on the message box.

If you do not get a message box, please do the following:

There should be a file named [4]-Submit_date@time.zip with today's date, located here:

C:\QooBox\Quarantine\[4]-Submit_date@time.zip

Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4

Please let me know if you successfully submitted the file. Thanks.

------------------------------------------------------

[Arturo Rios]

Chemist: The repair console was installed alright. Here is the new combofix.txt:

ComboFix 09-10-25.01 - admin 25/10/2009 15:09.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.959.498 [GMT -8:00]
Running from: c:\documents and settings\admin\Escritorio\ComboFix.exe
Command switches used :: c:\documents and settings\admin\Escritorio\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

file zipped: c:\documents and settings\admin\zeabei.scr
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\admin\zeabei.scr

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_hklfbet


((((((((((((((((((((((((( Files Created from 2009-09-25 to 2009-10-25 )))))))))))))))))))))))))))))))
.

2009-10-23 23:29 . 2009-08-29 07:27 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-23 23:29 . 2009-08-29 07:27 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-10-23 23:29 . 2009-08-29 07:27 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-10-23 23:29 . 2009-08-29 07:27 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-10-23 23:29 . 2009-08-28 10:28 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2009-10-23 23:29 . 2009-08-29 07:27 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2009-10-23 23:29 . 2009-08-29 07:27 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2009-10-23 23:29 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2009-10-21 22:02 . 2009-10-21 22:02 -------- d--h--w- c:\documents and settings\All Users\Datos de programa\CanonBJ
2009-10-21 03:19 . 2009-10-21 03:19 -------- d-----w- c:\archivos de programa\Trend Micro
2009-10-20 04:56 . 2001-08-18 03:11 29696 -c--a-w- c:\windows\system32\dllcache\dm9pci5.sys
2009-10-20 04:55 . 2001-08-18 03:11 39936 -c--a-w- c:\windows\system32\dllcache\cnxt1803.sys
2009-10-20 04:54 . 2001-08-23 05:15 32256 -c--a-w- c:\windows\system32\dllcache\diapi2NT.dll
2009-10-20 04:53 . 2001-08-23 05:15 103936 -c--a-w- c:\windows\system32\dllcache\binlsvc.dll
2009-10-20 04:52 . 2001-08-18 04:52 26496 -c--a-w- c:\windows\system32\dllcache\asc.sys
2009-10-20 04:51 . 2003-03-24 23:52 32827 -c--a-w- c:\windows\system32\dllcache\tcptest.exe
2009-10-15 03:57 . 2009-02-09 11:24 2191488 -c--a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-15 03:57 . 2009-02-09 11:24 2026496 ------w- c:\windows\system32\ntkrnlpa.exe
2009-10-15 03:57 . 2009-02-09 11:23 2147840 -c--a-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-10-15 03:57 . 2009-02-09 11:23 2147840 ------w- c:\windows\system32\ntoskrnl.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-25 23:06 . 2001-08-24 12:00 90898 ----a-w- c:\windows\system32\perfc00A.dat
2009-10-25 23:06 . 2001-08-24 12:00 504940 ----a-w- c:\windows\system32\perfh00A.dat
2009-10-21 17:23 . 2008-04-13 22:01 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-10-21 01:08 . 2009-04-19 00:28 -------- d-----w- c:\archivos de programa\MySecurityCenter
2009-10-19 21:50 . 2009-09-01 18:58 -------- d-----w- c:\documents and settings\All Users\Datos de programa\avg8
2009-10-19 20:47 . 2009-07-06 08:07 -------- d-----w- c:\archivos de programa\Malwarebytes' Anti-Malware
2009-10-19 03:22 . 2009-06-24 08:13 -------- d-----w- c:\archivos de programa\SUPERAntiSpyware
2009-10-11 23:36 . 2009-05-23 22:40 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-08 19:10 . 2009-03-23 02:27 2828 --sha-w- c:\documents and settings\All Users\Datos de programa\KGyGaAvL.sys
2009-09-15 05:30 . 2009-07-06 07:23 -------- d-----w- c:\archivos de programa\Opera
2009-09-11 14:18 . 2008-04-14 05:48 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 21:54 . 2009-07-06 08:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 21:53 . 2009-07-06 08:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-08 19:34 . 2009-01-05 05:39 -------- d-----w- c:\documents and settings\admin\Datos de programa\U3
2009-09-04 21:04 . 2008-04-14 05:48 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-02 18:05 . 2009-09-02 18:05 -------- d-----w- c:\documents and settings\All Users\Datos de programa\IObit
2009-09-01 18:59 . 2009-09-01 18:59 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-09-01 18:59 . 2009-09-01 18:59 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-09-01 18:59 . 2009-09-01 18:59 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-09-01 18:59 . 2009-09-01 18:59 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-09-01 18:59 . 2009-09-01 18:59 -------- d-----w- c:\documents and settings\All Users\Datos de programa\AVG Security Toolbar
2009-09-01 18:59 . 2009-09-01 18:59 -------- d-----w- c:\archivos de programa\AVG
2009-08-29 07:27 . 2008-04-14 05:48 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:27 . 2008-04-14 05:48 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:27 . 2008-04-14 05:48 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:01 . 2008-04-14 05:48 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-07 02:24 . 2009-01-05 05:29 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 02:24 . 2009-01-05 05:29 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 02:24 . 2009-01-05 05:29 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 02:24 . 2008-10-16 22:09 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 02:24 . 2009-01-05 05:29 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-07 02:24 . 2008-04-14 05:48 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 02:23 . 2009-01-05 05:29 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 02:23 . 2009-01-14 04:31 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 02:23 . 2009-01-14 04:31 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 02:23 . 2009-01-05 05:29 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:00 . 2008-04-14 05:48 205312 ----a-w- c:\windows\system32\mswebdvd.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-10-25_19.11.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-08-24 12:00 . 2009-10-25 19:08 71336 c:\windows\system32\perfc009.dat
+ 2001-08-24 12:00 . 2009-10-25 23:06 71336 c:\windows\system32\perfc009.dat
+ 2001-08-24 12:00 . 2009-10-25 23:06 441018 c:\windows\system32\perfh009.dat
- 2001-08-24 12:00 . 2009-10-25 19:08 441018 c:\windows\system32\perfh009.dat
+ 2009-08-20 13:02 . 2009-08-20 13:02 5204992 c:\windows\Installer\65d3bf.msp
+ 2009-08-20 13:02 . 2009-08-20 13:02 5204992 c:\windows\Installer\24ed7d.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\archivos de programa\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 18:58 1107200 ----a-w- c:\archivos de programa\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\archivos de programa\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\archivos de programa\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\archivos de programa\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"MSMSGS"="c:\archivos de programa\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SUPERAntiSpyware"="c:\archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-19 2000112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"hpWirelessAssistant"="c:\archivos de programa\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"RemoteControl"="c:\archivos de programa\CyberLink\PowerDVD\PDVDServ.exe" [2006-09-18 29696]
"LanguageShortcut"="c:\archivos de programa\CyberLink\PowerDVD\Language\Language.exe" [2006-09-30 49152]
"HP Software Update"="c:\archivos de programa\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"AVG8_TRAY"="c:\archiv~1\AVG\AVG8\avgtray.exe" [2009-10-19 2025752]
"Malwarebytes Anti-Malware (reboot)"="c:\archivos de programa\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Men£ Inicio\Programas\Inicio\
HP Digital Imaging Monitor.lnk - c:\archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\archivos de programa\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-12 02:44 548352 ----a-w- c:\archivos de programa\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2006-10-10 04:38 69120 ----a-r- c:\archivos de programa\Bioscrypt\VeriSoft\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2009-02-10 00:20 229376 ----a-w- c:\archivos de programa\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-01 18:59 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=
"c:\\Archivos de programa\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe"=
"c:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [01/09/2009 10:59 a.m. 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [01/09/2009 10:59 a.m. 108552]
R1 SASDIFSV;SASDIFSV;c:\archivos de programa\SUPERAntiSpyware\sasdifsv.sys [23/06/2009 10:01 a.m. 9968]
R1 SASKUTIL;SASKUTIL;c:\archivos de programa\SUPERAntiSpyware\SASKUTIL.SYS [23/06/2009 10:01 a.m. 74480]
R2 ASBroker;Broker de inicio de sesión;c:\windows\System32\svchost.exe -k Cognizance [13/04/2008 09:49 p.m. 14336]
R2 ASChannel;Canal de comunicación local;c:\windows\System32\svchost.exe -k Cognizance [13/04/2008 09:49 p.m. 14336]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\archiv~1\AVG\AVG8\avgemc.exe [01/09/2009 10:59 a.m. 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\archiv~1\AVG\AVG8\avgwdsvc.exe [01/09/2009 10:59 a.m. 297752]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [04/01/2009 09:42 p.m. 16384]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [04/01/2009 09:42 p.m. 37888]
R3 SASENUM;SASENUM;c:\archivos de programa\SUPERAntiSpyware\SASENUM.SYS [23/06/2009 10:01 a.m. 7408]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [04/01/2009 09:42 p.m. 91648]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportar a Microsoft Excel - c:\archiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\admin\Datos de programa\Mozilla\Firefox\Profiles\w2ap4c7d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-25 15:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"A0C0110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(892)
c:\archivos de programa\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\archivos de programa\Bioscrypt\VeriSoft\Bin\ASWLNPkg.dll
c:\archivos de programa\Bioscrypt\VeriSoft\bin\ItMsg.dll
c:\archivos de programa\Stardock\Object Desktop\WindowBlinds\wbsrv.dll

- - - - - - - > 'lsass.exe'(948)
c:\archivos de programa\Bioscrypt\VeriSoft\bin\ASWLNPkg.dll
c:\archivos de programa\Bioscrypt\VeriSoft\bin\ItMsg.dll

- - - - - - - > 'explorer.exe'(488)
c:\windows\system32\WININET.dll
c:\windows\system32\APSHook.dll
c:\archivos de programa\Stardock\Object Desktop\WindowBlinds\tray.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\DllHost.exe
c:\archivos de programa\Bioscrypt\VeriSoft\Bin\AsGHost.exe
c:\archivos de programa\Bonjour\mDNSResponder.exe
c:\windows\system32\nvsvc32.exe
c:\archiv~1\AVG\AVG8\avgrsx.exe
c:\archiv~1\AVG\AVG8\avgnsx.exe
c:\archivos de programa\Hewlett-Packard\Shared\hpqwmiex.exe
c:\archivos de programa\AVG\AVG8\avgcsrvx.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\wscntfy.exe
c:\combofix\CF31486.exe
c:\windows\system32\RUNDLL32.EXE
c:\archivos de programa\Hewlett-Packard\Shared\HpqToaster.exe
c:\archivos de programa\HP\Digital Imaging\bin\hpqSTE08.exe
c:\\?\c:\windows\system32\WBEM\WMIADAP.EXE
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-25 15:20 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-25 23:20
ComboFix2.txt 2009-10-25 19:13

Pre-Run: 86,740,586,496 bytes libres
Post-Run: 86,607,081,472 bytes libres

- - End Of File - - 34240916A4DBEC2C327765961215D438

Also, the file [4]-Submit_2009-10-25_15.09.47 was successfully submitted.

I´ll be uninstalling the Limewire program shortly per your suggestion. Awaiting further instructions. Thanks.

[chemist]

Hello again, Arturo Rios. Good job! Thanks for submitting the file. Please tell us how your system is behaving.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

We need to install Java on your machine in order to run an online scan with Kaspersky.

• Download the latest version of Java Runtime Environment (JRE) 6 and Save it to your Desktop.
• Scroll down to where it says Java Runtime Environment (JRE) 6 Update 16 The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
• Click the Download button to the right.
• Select the Windows platform from the dropdown menu.
• Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement
• Click Continue
• Click on the link to download Windows Offline Installation and Save the file to your Desktop.
• Close any programs you may have running - especially your web browser.
• Then from your desktop double-click on jre-6u16-windows-i586-p.exe to install the newest version.

• After the install is complete, go back to your Control Panel(using Classic View) and click the Java icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button.
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
    • Trace and Log Files
  • Click OK on Delete Temporary Files Window.
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
  • Click OK to leave the Temporary Files Window.
  • Click OK to leave the Java Control Panel.
  • Delete jre-6u16-windows-i586-p.exe from your desktop.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants. Ensure your external and/or USB drives are inserted during the scan.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at any Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Please post the following in your next reply:

Kaspersky report
report on system behavior

[Arturo Rios]

Thanks so much, Chemist. The system is behaving fine. I´m now able to log into safe mode with no problems.

I´m going to log off now and continue later on today following the instructions on your last post.

Arturo.

[chemist]

You're very welcome, Arturo! Glad to hear it. I await your next post.

[Arturo Rios]

Hello Chemist. This is the report from Kapersky:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, October 26, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, October 26, 2009 06:11:20
Records in database: 3078354
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 103378
Threats found: 2
Infected objects found: 3
Suspicious objects found: 0
Scan duration: 03:19:34


File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Infected: Rootkit.Win32.TDSS.u 1
C:\Qoobox\Quarantine\[4]-Submit_2009-10-25_15.09.47.zip Infected: Worm.Win32.VBNA.jdx 1
C:\System Volume Information\_restore{1CFEAB1F-7A1F-4FDB-9938-B6C26DC2DED6}\RP75\A0094748.exe Infected: Worm.Win32.VBNA.jdx 1

Selected area has been scanned.

Also, the system is running without a glitch. I have not noticed any virus activity so far. Looking forward to hearing from you.

[chemist]

Hello again, Arturo Rios. Qoobox is ComboFix's quarantine folder. System Volume Information is where Windows keeps old system restore points. Both will get deleted when we uninstall ComboFix.

------------------------------------------------------

Congratulations. Well done! Your logs appear clean. You should be good to go.

Please disable AVG before uninstalling ComboFix and then re-enable it after doing so.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK:

combofix /uninstall

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

• How Did I Get Infected In The First Place? by TonyKlein
• How to Prevent Malware by miekiemoes

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an add-on available for both Firefox and IE.
  
• SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
  
• MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Download Host.zip and Save it to your Desktop.
  • Right-click hosts.zip and select 'Extract all files' or 'Extract files...'.
  • Follow the prompts and click 'Finish'.
  • This will open the newly created hosts folder on your Desktop.
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  • Once updated you should see another prompt that the task was completed.

Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.

[Arturo Rios]

Chemist, I installed the Spywareblaster, the MVPS HOSTS file, but the WOT, for some unknown reason would not install. Also, I uninstall the Limewire program and the Combofix. Deleted all the tools that were used in the process of cleaning of this machine, which BTW has all the latest updates from Microsoft.

So, please recommend something for the WOT not being able to install.

[chemist]

Please tell me exactly what happened when you tried to install it. What did it say? At what step? Did you use IE or Firefox?

[Arturo Rios]

Since I´m currently using Firefox, the link you provided took me to another page with a button called Add to Firefox which when clicked attempted to apply the Add-on directly to Firefox. Almost immediately e message appears saying that "Firefox could not install the Add-on in https://addons.mozilla.org/en-US/fir...rc=addondetail


and then the message continues saying Unexpected end of installation. Please review the error console for more details. -203.

This is what the error console show on this error:

Error: e.location.getItemLocation(e.id) is undefined
Archivo de origen: file:///C:/Archivos%20de%20programa/Mozilla%20Firefox/components/nsExtensionManager.js
Línea: 4082

[Arturo Rios]

I also downloaded both versions and saved to disk. The one for IE was installed OK. The one for Firefox has a *.xpi (wot-20090918-fx+sm.xpi) extension and I don`t know which program opens it.

[chemist]

Please read this and see if it helps:

http://support.mozilla.com/en-US/kb/...alling+add-ons

[Arturo Rios]

Thank you very much, Chemist, that article was very helpful. After I deleted those files and restarted Firefox, the WOT install went through without a problem.

So I guess I´m all set, right?