Please help with malware situation

Kay27 · 10-29-2009, 12:01 AM

Hello,

I'm not very savy with all this malware/virus/trojan thing, sorry. My computer was recently infected with malware. I was being warned about a problem with system32, my internet explorer wasn't responding, I was being prompted to download a virus protection software offered by 'Microsoft', I had a problem with reaching the capacity on my profile, and most recently I keep getting an error message that reads "Microsoft Feed Synchronization" has encountered a problem and needs to close.... I ran McAfee it reported it got rid of 7 trojan threats but my computer is still giving me that error message. I'm not sure if I still have a malware problem or if this is something else. Please help. I've attached the reports requested by the instructions. I'm very thankful in advance for your help. This forum is very helpful.

DDS (Ver_09-10-26.01) - NTFSx86
Run by Kalet at 1:40:21.87 on Thu 10/29/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.392 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\FastNetSrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Mcafee\MWL\MwlSvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Mcafee\MWL\MWLGui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kalet\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\system32\DfrgNtfs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kalet\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: McAfee Phishing Filter: {377c180e-6f0e-4d4c-980f-f45bd3d40cf4} - c:\progra~1\mcafee\msk\mcapbho.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [Aim6]
uRun: [wow64main.exe] c:\docume~1\kalet\locals~1\temp\wow64main.exe
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1150595.exe -Update -1150595 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.miniclip.com/games/air-show/en/"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [SoundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [system tool] c:\program files\brnnax\qumksysguard.exe
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [MWLExe] c:\program files\mcafee\mwl\MWLGui.exe /Start
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
StartupFolder: c:\docume~1\kalet\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\kalet\application data\dropbox\bin\Dropbox.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
IE: &AIM Toolbar Search - c:\documents and settings\all users\application data\aim toolbar\ietoolbar\resources\en-us\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://navarro.lifepics.com/net/Uploader/LPUploader57.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
TCP: {CF0D8AC6-84D9-428D-ADF6-E75BE5E00E89} = 4.2.2.1,4.2.2.2
TCP: {D9ADC467-AF12-45ED-863A-BE1263E295E3} = 4.2.2.1,4.2.2.2
TCP: {FD1DF127-4FA1-4692-9795-B3312857C65F} = 4.2.2.1,4.2.2.2
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [2004-8-4 47104]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-10-29 210216]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-4-27 24652]
S2 0316501256793296mcinstcleanup;McAfee Application Installer Cleanup (0316501256793296);c:\docume~1\kalet\locals~1\temp\031650~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\kalet\locals~1\temp\031650~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S2 gupdate1c9e13f264b717c;Google Update Service (gupdate1c9e13f264b717c);c:\program files\google\update\GoogleUpdate.exe [2009-5-30 133104]
S3 isapeep;isapeep;c:\windows\system32\isapeep.sys [2004-8-4 2304]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2009-6-4 17408]

=============== Created Last 30 ================

2009-10-29 04:10:33 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-10-29 04:10:19 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-10-29 04:10:18 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-29 04:10:17 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-10-29 04:10:14 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-10-29 04:10:11 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-10-29 04:09:49 11069440 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-10-29 02:53:21 4748 ----a-w- c:\windows\system32\Config.MPF
2009-10-29 00:31:57 0 d-----w- c:\program files\SiteAdvisor
2009-10-29 00:31:55 0 d-----w- c:\docume~1\kalet\applic~1\SiteAdvisor
2009-10-29 00:27:07 86880 ----a-w- c:\windows\system32\drivers\WscNetDr.sys
2009-10-29 00:22:45 143360 ----a-w- c:\windows\system32\dunzip32.dll
2009-10-29 00:17:29 33832 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-10-29 00:17:28 40488 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-10-29 00:17:27 35240 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-10-29 00:17:21 201320 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-10-29 00:17:19 79304 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-10-29 00:16:55 113952 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2009-10-29 00:13:01 0 d-----w- c:\program files\McAfee.com
2009-10-29 00:12:33 0 d-----w- c:\program files\common files\McAfee
2009-10-29 00:11:56 0 d-----w- c:\program files\McAfee
2009-10-29 00:01:30 61440 ----a-w- c:\windows\system32\lsm32.sys
2009-10-28 04:05:30 0 d-----w- c:\docume~1\alluse~1\applic~1\Downloaded Installations
2009-10-28 03:41:32 163840 ----a-r- c:\windows\system32\igfxres.dll
2009-10-28 03:34:20 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2009-10-28 03:34:20 31232 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2009-10-28 03:34:16 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2009-10-28 03:34:00 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2009-10-28 03:32:53 38912 -c--a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2009-10-28 03:32:43 111104 -c--a-w- c:\windows\system32\dllcache\mtstocom.exe
2009-10-28 03:32:14 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2009-10-28 03:32:13 92416 -c--a-w- c:\windows\system32\dllcache\mga.sys
2009-10-28 03:32:13 92032 -c--a-w- c:\windows\system32\dllcache\mga.dll
2009-10-28 03:32:11 65536 -c--a-w- c:\windows\system32\dllcache\EXCH_mailmsg.dll
2009-10-28 03:32:10 22528 -c--a-w- c:\windows\system32\dllcache\lpdsvc.dll
2009-10-28 03:32:10 18944 -c--a-w- c:\windows\system32\dllcache\lprmon.dll
2009-10-28 03:32:07 33792 -c--a-w- c:\windows\system32\dllcache\lmmib2.dll
2009-10-28 03:30:55 18944 -c--a-w- c:\windows\system32\dllcache\cprofile.exe
2009-10-28 03:29:54 32827 -c--a-w- c:\windows\system32\dllcache\tcptest.exe
2009-10-28 03:27:08 488 ---ha-r- c:\windows\system32\logonui.exe.manifest
2009-10-28 03:26:57 749 ---ha-r- c:\windows\WindowsShell.Manifest
2009-10-28 03:26:57 749 ---ha-r- c:\windows\system32\wuaucpl.cpl.manifest
2009-10-28 03:26:57 749 ---ha-r- c:\windows\system32\sapi.cpl.manifest
2009-10-28 03:26:57 749 ---ha-r- c:\windows\system32\ncpa.cpl.manifest
2009-10-28 03:26:25 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2009-10-28 03:25:48 32768 -c--a-w- c:\windows\system32\dllcache\icwdl.dll
2009-10-28 03:25:47 86016 -c--a-w- c:\windows\system32\dllcache\icwconn2.exe
2009-10-28 03:25:47 214528 -c--a-w- c:\windows\system32\dllcache\icwconn1.exe
2009-10-28 03:25:47 20480 -c--a-w- c:\windows\system32\dllcache\inetwiz.exe
2009-10-28 03:11:34 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-10-28 03:10:58 1086058 ----a-r- c:\windows\SET9A.tmp
2009-10-28 03:10:53 1042903 ----a-r- c:\windows\SET97.tmp
2009-10-24 00:13:47 121344 ----a-w- c:\windows\syssvc.exe
2009-10-24 00:09:52 0 ----a-w- c:\windows\win32k.sys
2009-10-23 20:13:35 0 d-----w- c:\program files\brnnax
2009-10-23 20:12:21 399872 ----a-w- c:\windows\system32\~.exe
2009-10-10 08:03:50 0 d-----w- c:\docume~1\kalet\applic~1\Dropbox
2009-10-10 05:28:29 0 d-----w- c:\program files\IrfanView
2009-10-09 05:46:01 130 ----a-w- c:\documents and settings\kalet\webct_upload_applet.properties

==================== Find3M ====================

2009-10-28 03:25:13 23348 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-12 23:13:29 52536 ---ha-w- c:\windows\system32\mlfcache.dat
2009-09-09 02:48:46 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_netaapl_01005.Wdf
2009-09-09 02:48:40 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-08-29 08:08:21 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-28 23:42:52 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-04 23:52:22 1193832 ----a-w- c:\windows\system32\FM20.DLL

============= FINISH: 1:41:57.28 ===============

tetonbob · 11-01-2009, 09:48 AM

Hello, and Welcome to TSF.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum.

---------------------------------------------------------------------------------------------

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Place combofix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

You can get help on disabling your protection programs here

How to disable McAfee:
- Please open McAfee Security Centre
- Under Common Tasks click on Home
- Click Computer Files
- Click Configure
- Make sure the following are disabled by ticking the "Off" button.
  Virus protection
  Spyware protection
  System Guards Protection
  Script Scanning Protection (you may have to scroll down to see it)
- Next, select never for "When to re-enable real time scanning"
- and click OK.
Further info on disabling and re-enabling McAfee: http://help.aol.com/help/microsites/...ernalID=222820
Double click on combofix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.

ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.

Click on Yes, to continue scanning for malware.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

---------------------------------------------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

---------------------------------------------------------------------------------------------

Kay27 · 11-01-2009, 12:02 PM

Thank you very much for your help. Below is the Combofix log.

ComboFix 09-10-30.01 - Kalet 11/01/2009 13:21.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.533 [GMT -5:00]
Running from: c:\documents and settings\Kalet\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\010112010146118114.dat
c:\windows\0101120101464849.dat
c:\windows\0101120101465749.dat
c:\windows\irc.txt
c:\windows\pusk_1247592413.exe
c:\windows\syssvc.exe
c:\windows\system32\~.exe
c:\windows\system32\certstore.dat
c:\windows\system32\FInstall.sys
c:\windows\system32\Install.txt
c:\windows\system32\isapeep.sys
c:\windows\system32\wbem\proquota.exe
c:\windows\TEMP\mta13187.dll
c:\windows\TEMP\t4m0_149385252372.bk.old
c:\windows\TEMP\x1c57503.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}
-------\Service_6to4
-------\Legacy_isapeep
-------\Service_isapeep

((((((((((((((((((((((((( Files Created from 2009-10-01 to 2009-11-01 )))))))))))))))))))))))))))))))
.

2009-10-31 16:02 . 2009-10-31 16:02 -------- d-----w- c:\documents and settings\Kalet\Local Settings\Application Data\Temp
2009-10-30 04:53 . 2009-10-30 05:39 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-10-30 04:49 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-10-30 04:45 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-10-30 04:44 . 2009-08-04 13:58 2136064 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-10-30 04:44 . 2009-08-04 14:00 2180352 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-30 04:44 . 2009-08-04 13:13 2015744 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-10-30 04:44 . 2009-08-04 13:13 2057728 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-10-29 07:40 . 2009-10-29 07:40 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2009-10-29 07:28 . 2009-10-29 07:28 -------- d-----w- c:\documents and settings\Kalet\Application Data\McAfee
2009-10-29 05:24 . 2009-10-31 23:38 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-10-29 05:24 . 2009-10-29 05:24 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore
2009-10-29 05:15 . 2009-10-29 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-10-29 04:10 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-10-29 04:10 . 2009-08-29 08:08 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-10-29 04:10 . 2009-08-29 08:08 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-29 04:10 . 2009-08-29 08:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-10-29 04:10 . 2009-08-29 08:08 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-10-29 04:10 . 2009-08-29 08:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-10-29 04:09 . 2009-08-29 08:08 11069440 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-10-29 00:36 . 2009-10-29 00:36 128 ----a-w- c:\documents and settings\Kalet\Local Settings\Application Data\fusioncache.dat
2009-10-29 00:31 . 2009-10-29 01:31 -------- d-----w- c:\program files\SiteAdvisor
2009-10-29 00:31 . 2009-10-29 04:04 -------- d-----w- c:\documents and settings\Kalet\Application Data\SiteAdvisor
2009-10-29 00:27 . 2006-05-15 21:24 86880 ----a-w- c:\windows\system32\drivers\WscNetDr.sys
2009-10-29 00:22 . 2006-03-03 13:07 143360 ----a-w- c:\windows\system32\dunzip32.dll
2009-10-29 00:17 . 2007-11-22 11:44 33832 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-10-29 00:17 . 2007-12-02 17:51 40488 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-10-29 00:17 . 2007-11-22 11:44 35240 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-10-29 00:17 . 2007-11-22 11:44 201320 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-10-29 00:17 . 2007-11-22 11:44 79304 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-10-29 00:16 . 2007-07-13 11:20 113952 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2009-10-29 00:13 . 2009-10-29 00:14 -------- d-----w- c:\program files\McAfee.com
2009-10-29 00:12 . 2009-10-29 02:48 -------- d-----w- c:\program files\Common Files\McAfee
2009-10-29 00:11 . 2009-10-30 04:34 -------- d-----w- c:\program files\McAfee
2009-10-29 00:02 . 2009-10-29 07:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-10-28 04:05 . 2009-10-28 04:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-10-28 03:41 . 2005-02-08 10:31 163840 ----a-r- c:\windows\system32\igfxres.dll
2009-10-28 03:34 . 2004-08-04 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2009-10-28 03:34 . 2004-08-04 12:00 31232 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2009-10-28 03:34 . 2004-08-04 12:00 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2009-10-28 03:34 . 2004-08-04 12:00 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2009-10-28 03:32 . 2001-08-18 02:36 38912 -c--a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2009-10-28 03:32 . 2004-08-04 12:00 111104 -c--a-w- c:\windows\system32\dllcache\mtstocom.exe
2009-10-28 03:32 . 2004-08-04 12:00 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2009-10-28 03:32 . 2004-08-04 12:00 92416 -c--a-w- c:\windows\system32\dllcache\mga.sys
2009-10-28 03:32 . 2004-08-04 12:00 92032 -c--a-w- c:\windows\system32\dllcache\mga.dll
2009-10-28 03:32 . 2001-08-18 02:36 65536 -c--a-w- c:\windows\system32\dllcache\EXCH_mailmsg.dll
2009-10-28 03:32 . 2004-08-04 12:00 22528 -c--a-w- c:\windows\system32\dllcache\lpdsvc.dll
2009-10-28 03:32 . 2004-08-04 12:00 18944 -c--a-w- c:\windows\system32\dllcache\lprmon.dll
2009-10-28 03:32 . 2004-08-04 12:00 33792 -c--a-w- c:\windows\system32\dllcache\lmmib2.dll
2009-10-28 03:30 . 2004-08-04 12:00 18944 -c--a-w- c:\windows\system32\dllcache\cprofile.exe
2009-10-28 03:30 . 2004-08-04 12:00 15872 -c--a-w- c:\windows\system32\dllcache\chgport.exe
2009-10-28 03:30 . 2004-08-04 12:00 14336 -c--a-w- c:\windows\system32\dllcache\chgusr.exe
2009-10-28 03:30 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\chglogon.exe
2009-10-28 03:30 . 2004-08-04 12:00 9728 -c--a-w- c:\windows\system32\dllcache\change.exe
2009-10-28 03:30 . 2004-08-04 12:00 54528 -c--a-w- c:\windows\system32\dllcache\cap7146.sys
2009-10-28 03:30 . 2004-08-04 12:00 331264 -c--a-w- c:\windows\system32\dllcache\aqueue.dll
2009-10-28 03:30 . 2001-08-18 02:36 45056 -c--a-w- c:\windows\system32\dllcache\EXCH_aqadmin.dll
2009-10-28 03:30 . 2001-08-18 02:36 5632 -c--a-w- c:\windows\system32\dllcache\EXCH_adsiisex.dll
2009-10-28 03:26 . 2004-08-04 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2009-10-28 03:25 . 2004-08-04 12:00 32768 -c--a-w- c:\windows\system32\dllcache\icwdl.dll
2009-10-28 03:25 . 2004-08-04 12:00 86016 -c--a-w- c:\windows\system32\dllcache\icwconn2.exe
2009-10-28 03:25 . 2004-08-04 12:00 214528 -c--a-w- c:\windows\system32\dllcache\icwconn1.exe
2009-10-28 03:25 . 2004-08-04 12:00 20480 -c--a-w- c:\windows\system32\dllcache\inetwiz.exe
2009-10-28 03:12 . 2004-08-04 12:00 480256 -c--a-w- c:\windows\system32\dllcache\cintsetp.exe
2009-10-28 03:12 . 2004-08-04 12:00 198656 -c--a-w- c:\windows\system32\dllcache\cintime.dll
2009-10-28 03:12 . 2004-08-04 12:00 97792 -c--a-w- c:\windows\system32\dllcache\chtmbx.dll
2009-10-28 03:12 . 2004-08-04 12:00 56320 -c--a-w- c:\windows\system32\dllcache\chtskdic.dll
2009-10-28 03:12 . 2004-08-04 12:00 455168 -c--a-w- c:\windows\system32\dllcache\tintsetp.exe
2009-10-28 03:12 . 2004-08-04 12:00 44032 -c--a-w- c:\windows\system32\dllcache\tintlphr.exe
2009-10-28 03:12 . 2004-08-04 12:00 173568 -c--a-w- c:\windows\system32\dllcache\chtskf.dll
2009-10-28 03:12 . 2004-08-04 12:00 10240 -c--a-w- c:\windows\system32\dllcache\tmigrate.dll
2009-10-28 03:12 . 2004-08-04 12:00 70144 -c--a-w- c:\windows\system32\dllcache\pintlphr.exe
2009-10-28 03:12 . 2004-08-04 12:00 67584 -c--a-w- c:\windows\system32\dllcache\pmigrate.dll
2009-10-28 03:12 . 2004-08-04 12:00 59392 -c--a-w- c:\windows\system32\dllcache\imscinst.exe
2009-10-28 03:12 . 2004-08-04 12:00 10096640 -c--a-w- c:\windows\system32\dllcache\hwxcht.dll
2009-10-28 03:11 . 2004-08-04 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-10-28 03:11 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2009-10-28 03:11 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2009-10-28 03:11 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2009-10-24 00:14 . 2009-10-24 00:14 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-10-24 00:09 . 2009-10-27 12:56 0 ----a-w- c:\windows\win32k.sys
2009-10-23 20:13 . 2009-10-29 00:27 -------- d-----w- c:\program files\brnnax
2009-10-15 18:51 . 2009-10-15 18:51 -------- d-----w- c:\documents and settings\Kalet\Application Data\Viewpoint
2009-10-10 08:03 . 2009-11-01 18:33 -------- d-----w- c:\documents and settings\Kalet\Application Data\Dropbox
2009-10-10 05:28 . 2009-10-10 05:28 -------- d-----w- c:\program files\IrfanView
2009-10-06 05:16 . 2009-10-06 05:16 -------- d-----w- c:\documents and settings\Kalet\Local Settings\Application Data\Yahoo!

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-29 04:28 . 2009-08-21 00:40 -------- d-----w- c:\program files\Stop Motion Pro v5
2009-10-29 00:36 . 2009-04-14 01:14 65136 ----a-w- c:\documents and settings\Kalet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-28 03:25 . 2009-04-10 03:28 23348 ----a-w- c:\windows\system32\emptyregdb.dat
2009-10-24 00:55 . 2009-06-19 23:06 -------- d-----w- c:\program files\AVG
2009-10-23 20:11 . 2009-04-19 08:12 -------- d-----w- c:\documents and settings\Kalet\Application Data\LimeWire
2009-10-17 04:59 . 2009-04-10 03:42 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-25 22:54 . 2009-09-25 22:52 -------- d-----w- c:\program files\iTunes
2009-09-25 22:53 . 2009-09-25 22:53 -------- d-----w- c:\program files\iPod
2009-09-25 22:53 . 2009-04-14 01:05 -------- d-----w- c:\program files\Common Files\Apple
2009-09-12 23:13 . 2009-09-12 23:13 52536 ---ha-w- c:\windows\system32\mlfcache.dat
2009-09-11 14:33 . 2004-08-04 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 02:36 . 2009-04-14 01:09 -------- d-----w- c:\documents and settings\Kalet\Application Data\Apple Computer
2009-09-11 02:30 . 2009-09-11 02:30 -------- d-----w- c:\program files\iPhone Configuration Utility
2009-09-11 02:27 . 2009-09-11 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-11 02:21 . 2009-09-11 02:20 -------- d-----w- c:\program files\QuickTime
2009-09-10 23:39 . 2009-04-14 06:17 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-09 02:48 . 2009-09-09 02:48 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_netaapl_01005.Wdf
2009-09-09 02:48 . 2009-09-09 02:48 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-09-03 04:46 . 2009-09-03 04:46 -------- d-----w- c:\documents and settings\Kalet\Application Data\InterVideo
2009-08-29 08:08 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-28 23:42 . 2009-06-05 03:12 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-28 23:42 . 2009-06-05 03:12 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-07 00:24 . 2009-04-10 03:29 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 00:24 . 2009-04-10 03:29 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 00:24 . 2009-04-10 03:29 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 00:24 . 2008-10-16 18:09 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 00:24 . 2009-04-10 03:29 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-07 00:24 . 2004-08-04 12:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 00:23 . 2009-08-07 00:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 00:23 . 2009-04-10 03:29 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:11 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 23:52 . 2009-08-04 23:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 14:00 . 2004-08-04 12:00 2180352 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 13:13 . 2004-08-03 22:59 2057728 ----a-w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150595.exe" [2009-03-19 460216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-03-29 233534]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 794624]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"MWLExe"="c:\program files\Mcafee\MWL\MWLGui.exe" [2006-07-26 1287792]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"MBkLogOnHook"="c:\program files\McAfee\MBK\LogOnHook.exe" [2007-01-08 20480]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209]

c:\documents and settings\Kalet\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Kalet\Application Data\Dropbox\bin\Dropbox.exe [2009-10-8 26805255]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\McAfee\\MWL\\MwlSvc.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 7:00 AM 14336]
R2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [8/4/2004 7:00 AM 47616]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/29/2009 12:14 AM 210216]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/27/2009 6:53 PM 24652]
S2 gupdate1c9e13f264b717c;Google Update Service (gupdate1c9e13f264b717c);c:\program files\Google\Update\GoogleUpdate.exe [5/30/2009 10:56 AM 133104]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [6/4/2009 10:12 PM 17408]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - BTWSRV
*NewlyCreated* - CLASSPNP_2
*NewlyCreated* - MBR
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
BtwSrv
.
Contents of the 'Scheduled Tasks' folder

2009-10-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-11-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-30 15:52]

2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 15:55]

2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 15:55]

2009-10-29 c:\windows\Tasks\McDefragTask.job
- c:\windows\system32\defrag.exe [2004-08-04 12:00]

2009-10-29 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2009-10-29 18:32]

2009-11-01 c:\windows\Tasks\User_Feed_Synchronization-{21625C07-F477-4236-98A2-185C02C5BD0E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: {CF0D8AC6-84D9-428D-ADF6-E75BE5E00E89} = 4.2.2.1,4.2.2.2
TCP: {D9ADC467-AF12-45ED-863A-BE1263E295E3} = 4.2.2.1,4.2.2.2
TCP: {FD1DF127-4FA1-4692-9795-B3312857C65F} = 4.2.2.1,4.2.2.2
DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://navarro.lifepics.com/net/Uploader/LPUploader57.cab
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-03402f96-3dc7-4285-bc50-9e81fefafe43} - (no file)
URLSearchHooks-CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
URLSearchHooks-EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-Aim6 - (no file)
MSConfigStartUp-CTFMON - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-01 13:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????6?8?7?6??`???? ???B?????????????hLC? ??????

scanning hidden files ...

c:\windows\system32\wbem\Performance\WmiApRpl_new.ini 924 bytes
c:\windows\system32\Install.txt 266 bytes

scan completed successfully
hidden files: 2

**************************************************************************
"ServiceDll"="c:\windows\system32\BtwSrv.dll\00ÇEÌ\08@\00\00ƒ=\00Ñ@\00\00u\18h\00Ñ@\00hÔ!@\00èc¶ÿÿÇE°\00Ñ@\00ë\07ÇE°\00Ñ@\00j\10Xè)´ÿÿuÌ‹ü¥¥¥¥j\01jh‹E°‹\00‹M°‹\09‹\09Pÿ‘\14\03\00\00PEÜPè\01µÿÿPè!¶ÿÿƒÄ\1cMÜèä´ÿÿÇEÈ\03\00\00\00EÈPèÞ\01\00\00èåûÿÿÿu\08èuüÿÿèèµÿÿë\05èáµÿÿèz´ÿÿhùd@\00ë\09MÜè§´ÿÿÃMàèP´ÿÿÃ‹Mäd‰\0d\00\00\00\00_^
[ÉÂ\04\00U‹ìƒì\0ch¦\18@\00d¡\00\00\00\00Pd‰%"

.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1409082233-2111687655-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EB02EBF2-2DB7-35E0-CB02-563ACE0A7833}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iakfmcbfdebnpbcamp"=hex:63,61,66,65,61,6a,00,7c
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3428)
c:\windows\system32\WININET.dll
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\MBK\MBackMonitor.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\program files\McAfee\MSK\MskSrver.exe
c:\program files\Mcafee\MWL\MwlSvc.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\progra~1\McAfee\MSC\mcregist.exe
c:\program files\Apoint2K\Apntex.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wmdtc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HPQ\shared\hpqwmi.exe
c:\progra~1\mcafee\msc\mcuimgr.exe
c:\windows\system32\lsm32.sys
.
**************************************************************************
.
Completion time: 2009-11-01 13:40 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-01 18:40

Pre-Run: 46,164,545,536 bytes free
Post-Run: 57,187,098,624 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 5EAF8B6D1F7DC0D5EEE87F6A0EB12D96

tetonbob · 11-01-2009, 01:12 PM

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

Open notepad and copy/paste the text in the quotebox below into it:

Code:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/426707-please-help-malware-situation.html#post2421345

File::
c:\windows\win32k.sys
Folder::
c:\Program Files\brnnax
Driver::
BtwSrv
fastnetsrv
NetSvc::
BtwSrv
Collect::
c:\windows\system32\FastNetSrv.exe
c:\windows\system32\BtwSrv.dll
c:\program files\brnnax\qumksysguard.exe
Comment::
End Copy Here

Save this as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

ComboFix may request an update; please allow it.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
- Ensure you are connected to the internet and click OK on the message box.
Please let me know if the file was successfully submitted . Thanks.

------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

---------------------------------------------------------------------------------------------

Kay27 · 11-01-2009, 07:54 PM

I followed your instructions and got the log which I've posted below, however I did not get a message box with the log. Please let me know how to proceed.

ComboFix 09-10-30.01 - Kalet 11/01/2009 21:29.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.530 [GMT -5:00]
Running from: c:\documents and settings\Kalet\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kalet\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

FILE ::
"c:\windows\win32k.sys"

file zipped: c:\windows\system32\BtwSrv.dll
file zipped: c:\windows\system32\FastNetSrv.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\brnnax
c:\windows\system32\btwsrv.dll
c:\windows\system32\FastNetSrv.exe
c:\windows\system32\Install.txt
c:\windows\TEMP\mta13187.dll
c:\windows\win32k.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BTWSRV
-------\Legacy_FASTNETSRV
-------\Service_BtwSrv
-------\Service_fastnetsrv

((((((((((((((((((((((((( Files Created from 2009-10-02 to 2009-11-02 )))))))))))))))))))))))))))))))
.

2009-10-31 16:02 . 2009-10-31 16:02 -------- d-----w- c:\documents and settings\Kalet\Local Settings\Application Data\Temp
2009-10-30 04:53 . 2009-10-30 05:39 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-10-30 04:49 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-10-30 04:45 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-10-30 04:44 . 2009-08-04 13:58 2136064 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-10-30 04:44 . 2009-08-04 14:00 2180352 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-30 04:44 . 2009-08-04 13:13 2015744 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-10-30 04:44 . 2009-08-04 13:13 2057728 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-10-29 07:40 . 2009-10-29 07:40 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2009-10-29 07:28 . 2009-10-29 07:28 -------- d-----w- c:\documents and settings\Kalet\Application Data\McAfee
2009-10-29 05:24 . 2009-10-31 23:38 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-10-29 05:24 . 2009-10-29 05:24 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore
2009-10-29 05:15 . 2009-10-29 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-10-29 04:10 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-10-29 04:10 . 2009-08-29 08:08 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-10-29 04:10 . 2009-08-29 08:08 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-29 04:10 . 2009-08-29 08:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-10-29 04:10 . 2009-08-29 08:08 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-10-29 04:10 . 2009-08-29 08:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-10-29 04:09 . 2009-08-29 08:08 11069440 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-10-29 00:36 . 2009-10-29 00:36 128 ----a-w- c:\documents and settings\Kalet\Local Settings\Application Data\fusioncache.dat
2009-10-29 00:31 . 2009-10-29 01:31 -------- d-----w- c:\program files\SiteAdvisor
2009-10-29 00:31 . 2009-10-29 04:04 -------- d-----w- c:\documents and settings\Kalet\Application Data\SiteAdvisor
2009-10-29 00:27 . 2006-05-15 21:24 86880 ----a-w- c:\windows\system32\drivers\WscNetDr.sys
2009-10-29 00:22 . 2006-03-03 13:07 143360 ----a-w- c:\windows\system32\dunzip32.dll
2009-10-29 00:17 . 2007-11-22 11:44 33832 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-10-29 00:17 . 2007-12-02 17:51 40488 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-10-29 00:17 . 2007-11-22 11:44 35240 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-10-29 00:17 . 2007-11-22 11:44 201320 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-10-29 00:17 . 2007-11-22 11:44 79304 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-10-29 00:16 . 2007-07-13 11:20 113952 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2009-10-29 00:13 . 2009-10-29 00:14 -------- d-----w- c:\program files\McAfee.com
2009-10-29 00:12 . 2009-10-29 02:48 -------- d-----w- c:\program files\Common Files\McAfee
2009-10-29 00:11 . 2009-10-30 04:34 -------- d-----w- c:\program files\McAfee
2009-10-29 00:02 . 2009-10-29 07:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-10-28 04:05 . 2009-10-28 04:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-10-28 03:41 . 2005-02-08 10:31 163840 ----a-r- c:\windows\system32\igfxres.dll
2009-10-28 03:34 . 2004-08-04 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2009-10-28 03:34 . 2004-08-04 12:00 31232 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2009-10-28 03:34 . 2004-08-04 12:00 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2009-10-28 03:34 . 2004-08-04 12:00 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2009-10-28 03:32 . 2001-08-18 02:36 38912 -c--a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2009-10-28 03:32 . 2004-08-04 12:00 111104 -c--a-w- c:\windows\system32\dllcache\mtstocom.exe
2009-10-28 03:32 . 2004-08-04 12:00 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2009-10-28 03:32 . 2004-08-04 12:00 92416 -c--a-w- c:\windows\system32\dllcache\mga.sys
2009-10-28 03:32 . 2004-08-04 12:00 92032 -c--a-w- c:\windows\system32\dllcache\mga.dll
2009-10-28 03:32 . 2001-08-18 02:36 65536 -c--a-w- c:\windows\system32\dllcache\EXCH_mailmsg.dll
2009-10-28 03:32 . 2004-08-04 12:00 22528 -c--a-w- c:\windows\system32\dllcache\lpdsvc.dll
2009-10-28 03:32 . 2004-08-04 12:00 18944 -c--a-w- c:\windows\system32\dllcache\lprmon.dll
2009-10-28 03:32 . 2004-08-04 12:00 33792 -c--a-w- c:\windows\system32\dllcache\lmmib2.dll
2009-10-28 03:30 . 2004-08-04 12:00 18944 -c--a-w- c:\windows\system32\dllcache\cprofile.exe
2009-10-28 03:30 . 2004-08-04 12:00 15872 -c--a-w- c:\windows\system32\dllcache\chgport.exe
2009-10-28 03:30 . 2004-08-04 12:00 14336 -c--a-w- c:\windows\system32\dllcache\chgusr.exe
2009-10-28 03:30 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\chglogon.exe
2009-10-28 03:30 . 2004-08-04 12:00 9728 -c--a-w- c:\windows\system32\dllcache\change.exe
2009-10-28 03:30 . 2004-08-04 12:00 54528 -c--a-w- c:\windows\system32\dllcache\cap7146.sys
2009-10-28 03:30 . 2004-08-04 12:00 331264 -c--a-w- c:\windows\system32\dllcache\aqueue.dll
2009-10-28 03:30 . 2001-08-18 02:36 45056 -c--a-w- c:\windows\system32\dllcache\EXCH_aqadmin.dll
2009-10-28 03:30 . 2001-08-18 02:36 5632 -c--a-w- c:\windows\system32\dllcache\EXCH_adsiisex.dll
2009-10-28 03:26 . 2004-08-04 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2009-10-28 03:25 . 2004-08-04 12:00 32768 -c--a-w- c:\windows\system32\dllcache\icwdl.dll
2009-10-28 03:25 . 2004-08-04 12:00 86016 -c--a-w- c:\windows\system32\dllcache\icwconn2.exe
2009-10-28 03:25 . 2004-08-04 12:00 214528 -c--a-w- c:\windows\system32\dllcache\icwconn1.exe
2009-10-28 03:25 . 2004-08-04 12:00 20480 -c--a-w- c:\windows\system32\dllcache\inetwiz.exe
2009-10-28 03:12 . 2004-08-04 12:00 480256 -c--a-w- c:\windows\system32\dllcache\cintsetp.exe
2009-10-28 03:12 . 2004-08-04 12:00 198656 -c--a-w- c:\windows\system32\dllcache\cintime.dll
2009-10-28 03:12 . 2004-08-04 12:00 97792 -c--a-w- c:\windows\system32\dllcache\chtmbx.dll
2009-10-28 03:12 . 2004-08-04 12:00 56320 -c--a-w- c:\windows\system32\dllcache\chtskdic.dll
2009-10-28 03:12 . 2004-08-04 12:00 455168 -c--a-w- c:\windows\system32\dllcache\tintsetp.exe
2009-10-28 03:12 . 2004-08-04 12:00 44032 -c--a-w- c:\windows\system32\dllcache\tintlphr.exe
2009-10-28 03:12 . 2004-08-04 12:00 173568 -c--a-w- c:\windows\system32\dllcache\chtskf.dll
2009-10-28 03:12 . 2004-08-04 12:00 10240 -c--a-w- c:\windows\system32\dllcache\tmigrate.dll
2009-10-28 03:12 . 2004-08-04 12:00 70144 -c--a-w- c:\windows\system32\dllcache\pintlphr.exe
2009-10-28 03:12 . 2004-08-04 12:00 67584 -c--a-w- c:\windows\system32\dllcache\pmigrate.dll
2009-10-28 03:12 . 2004-08-04 12:00 59392 -c--a-w- c:\windows\system32\dllcache\imscinst.exe
2009-10-28 03:12 . 2004-08-04 12:00 10096640 -c--a-w- c:\windows\system32\dllcache\hwxcht.dll
2009-10-28 03:11 . 2004-08-04 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-10-28 03:11 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2009-10-28 03:11 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2009-10-28 03:11 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2009-10-24 00:14 . 2009-10-24 00:14 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-10-15 18:51 . 2009-10-15 18:51 -------- d-----w- c:\documents and settings\Kalet\Application Data\Viewpoint
2009-10-10 08:03 . 2009-11-01 18:33 -------- d-----w- c:\documents and settings\Kalet\Application Data\Dropbox
2009-10-10 05:28 . 2009-10-10 05:28 -------- d-----w- c:\program files\IrfanView
2009-10-06 05:16 . 2009-10-06 05:16 -------- d-----w- c:\documents and settings\Kalet\Local Settings\Application Data\Yahoo!

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-29 04:28 . 2009-08-21 00:40 -------- d-----w- c:\program files\Stop Motion Pro v5
2009-10-29 00:36 . 2009-04-14 01:14 65136 ----a-w- c:\documents and settings\Kalet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-28 03:25 . 2009-04-10 03:28 23348 ----a-w- c:\windows\system32\emptyregdb.dat
2009-10-24 00:55 . 2009-06-19 23:06 -------- d-----w- c:\program files\AVG
2009-10-23 20:11 . 2009-04-19 08:12 -------- d-----w- c:\documents and settings\Kalet\Application Data\LimeWire
2009-10-17 04:59 . 2009-04-10 03:42 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-25 22:54 . 2009-09-25 22:52 -------- d-----w- c:\program files\iTunes
2009-09-25 22:53 . 2009-09-25 22:53 -------- d-----w- c:\program files\iPod
2009-09-25 22:53 . 2009-04-14 01:05 -------- d-----w- c:\program files\Common Files\Apple
2009-09-12 23:13 . 2009-09-12 23:13 52536 ---ha-w- c:\windows\system32\mlfcache.dat
2009-09-11 14:33 . 2004-08-04 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 02:36 . 2009-04-14 01:09 -------- d-----w- c:\documents and settings\Kalet\Application Data\Apple Computer
2009-09-11 02:30 . 2009-09-11 02:30 -------- d-----w- c:\program files\iPhone Configuration Utility
2009-09-11 02:27 . 2009-09-11 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-11 02:21 . 2009-09-11 02:20 -------- d-----w- c:\program files\QuickTime
2009-09-10 23:39 . 2009-04-14 06:17 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-09 02:48 . 2009-09-09 02:48 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_netaapl_01005.Wdf
2009-09-09 02:48 . 2009-09-09 02:48 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-09-03 04:46 . 2009-09-03 04:46 -------- d-----w- c:\documents and settings\Kalet\Application Data\InterVideo
2009-08-29 08:08 . 2004-08-04 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-08-28 23:42 . 2009-06-05 03:12 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-28 23:42 . 2009-06-05 03:12 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-07 00:24 . 2009-04-10 03:29 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 00:24 . 2009-04-10 03:29 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 00:24 . 2009-04-10 03:29 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 00:24 . 2008-10-16 18:09 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 00:24 . 2009-04-10 03:29 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-07 00:24 . 2004-08-04 12:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 00:23 . 2009-08-07 00:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 00:23 . 2009-04-10 03:29 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:11 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 23:52 . 2009-08-04 23:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 14:00 . 2004-08-04 12:00 2180352 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 13:13 . 2004-08-03 22:59 2057728 ------w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-11-01_18.34.05 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-02 02:40 . 2009-11-02 02:40 16384 c:\windows\Temp\Perflib_Perfdata_150.dat
+ 2004-08-04 12:00 . 2009-11-01 18:37 72306 c:\windows\system32\perfc009.dat
- 2004-08-04 12:00 . 2009-11-01 18:35 72306 c:\windows\system32\perfc009.dat
+ 2009-04-10 03:35 . 2009-11-02 00:36 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-04-10 03:35 . 2009-11-01 16:09 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-10 03:35 . 2009-11-02 00:36 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-04-10 03:35 . 2009-11-01 16:09 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-04-10 03:35 . 2009-11-01 16:09 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-11-01 20:23 . 2009-11-02 00:36 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-04 12:00 . 2009-11-01 18:37 444596 c:\windows\system32\perfh009.dat
- 2004-08-04 12:00 . 2009-11-01 18:35 444596 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150595.exe" [2009-03-19 460216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-03-29 233534]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 794624]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"MWLExe"="c:\program files\Mcafee\MWL\MWLGui.exe" [2006-07-26 1287792]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"MBkLogOnHook"="c:\program files\McAfee\MBK\LogOnHook.exe" [2007-01-08 20480]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209]

c:\documents and settings\Kalet\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Kalet\Application Data\Dropbox\bin\Dropbox.exe [2009-10-8 26805255]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\McAfee\\MWL\\MwlSvc.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/29/2009 12:14 AM 210216]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/27/2009 6:53 PM 24652]
S2 gupdate1c9e13f264b717c;Google Update Service (gupdate1c9e13f264b717c);c:\program files\Google\Update\GoogleUpdate.exe [5/30/2009 10:56 AM 133104]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [6/4/2009 10:12 PM 17408]

--- Other Services/Drivers In Memory ---

*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-10-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-11-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-30 15:52]

2009-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 15:55]

2009-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 15:55]

2009-10-29 c:\windows\Tasks\McDefragTask.job
- c:\windows\system32\defrag.exe [2004-08-04 12:00]

2009-10-29 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2009-10-29 18:32]

2009-11-02 c:\windows\Tasks\User_Feed_Synchronization-{21625C07-F477-4236-98A2-185C02C5BD0E}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: {CF0D8AC6-84D9-428D-ADF6-E75BE5E00E89} = 4.2.2.1,4.2.2.2
TCP: {D9ADC467-AF12-45ED-863A-BE1263E295E3} = 4.2.2.1,4.2.2.2
TCP: {FD1DF127-4FA1-4692-9795-B3312857C65F} = 4.2.2.1,4.2.2.2
DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://navarro.lifepics.com/net/Uploader/LPUploader57.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-01 21:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????6?8?7?6??P???? ???B?????????????hLC? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1409082233-2111687655-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EB02EBF2-2DB7-35E0-CB02-563ACE0A7833}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iakfmcbfdebnpbcamp"=hex:63,61,66,65,61,6a,00,7c
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2276)
c:\windows\system32\WININET.dll
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\MBK\MBackMonitor.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\program files\McAfee\MSK\MskSrver.exe
c:\program files\Mcafee\MWL\MwlSvc.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\progra~1\McAfee\MSC\mcregist.exe
c:\windows\system32\wscntfy.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\mcafee\msc\mcuimgr.exe
c:\program files\HPQ\shared\hpqwmi.exe
.
**************************************************************************
.
Completion time: 2009-11-02 21:49 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-02 02:48
ComboFix2.txt 2009-11-01 18:40

Pre-Run: 57,311,645,696 bytes free
Post-Run: 57,306,046,464 bytes free

- - End Of File - - A2EDB67667E31856CF37D8E3F4DD9085

tetonbob · 11-01-2009, 08:41 PM

OK, let's do this next..

Please go to Start > Run and copy/paste the following, then press Enter:

C:\QooBox\ComboFix-quarantined-files.txt

Post the contents of the logfile which will open.

Kay27 · 11-02-2009, 11:33 PM

Here is the log.

2009-11-02 02:35:44 . 2009-11-02 02:35:44 2,566 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_fastnetsrv.reg.dat
2009-11-02 02:35:44 . 2009-11-02 02:35:44 6,056 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_BtwSrv.reg.dat
2009-11-02 02:35:44 . 2009-11-02 02:35:44 1,080 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_FASTNETSRV.reg.dat
2009-11-02 02:35:44 . 2009-11-02 02:35:44 1,080 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_BTWSRV.reg.dat
2009-11-02 02:29:31 . 2009-11-02 02:29:34 51,795 ----a-w- C:\Qoobox\Quarantine\[4]-Submit_2009-11-01_21.29.22.zip
2009-11-01 18:38:59 . 2009-11-01 18:38:59 256 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-CTFMON.reg.dat
2009-11-01 18:38:37 . 2009-11-01 18:38:37 91 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-Aim6.reg.dat
2009-11-01 18:38:35 . 2009-11-01 18:38:35 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829}.reg.dat
2009-11-01 18:38:34 . 2009-11-01 18:38:34 132 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829}.reg.dat
2009-11-01 18:38:32 . 2009-11-01 18:38:32 117 ----a-w- C:\Qoobox\Quarantine\Registry_backups\URLSearchHooks-EF99BD32-C1FB-11D2-892F-0090271D4F88}.reg.dat
2009-11-01 18:38:32 . 2009-11-01 18:38:32 162 ----a-w- C:\Qoobox\Quarantine\Registry_backups\URLSearchHooks-CFBFAE00-17A6-11D0-99CB-00C04FD64497}.reg.dat
2009-11-01 18:38:31 . 2009-11-01 18:38:31 117 ----a-w- C:\Qoobox\Quarantine\Registry_backups\URLSearchHooks-03402f96-3dc7-4285-bc50-9e81fefafe43}.reg.dat
2009-11-01 18:34:42 . 2009-08-29 08:08:21 1,208,832 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\mta13187.dll.vir
2009-11-01 18:29:33 . 2009-11-01 18:29:33 274 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_Install_.txt.zip
2009-11-01 18:28:10 . 2009-11-01 18:28:10 2,534 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_isapeep.reg.dat
2009-11-01 18:28:10 . 2009-11-01 18:28:10 1,208 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_isapeep.reg.dat
2009-11-01 18:26:57 . 2009-11-01 18:26:57 4,028 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_6to4.reg.dat
2009-11-01 18:26:57 . 2009-11-01 18:26:57 1,046 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}.reg.dat
2009-11-01 18:26:57 . 2009-11-01 18:26:57 1,046 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}.reg.dat
2009-11-01 18:26:57 . 2009-11-01 18:26:57 990 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_6TO4.reg.dat
2009-11-01 18:26:35 . 2009-11-02 02:35:21 8,861 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2009-11-01 18:18:02 . 2009-11-02 02:27:20 320 ----a-w- C:\Qoobox\Quarantine\catchme.log
2009-10-31 20:57:02 . 2009-08-29 08:08:21 1,208,832 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\x1c57503.dll.vir
2009-10-24 00:13:47 . 2009-10-24 00:13:49 121,344 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\syssvc.exe.vir
2009-10-24 00:09:52 . 2009-10-27 12:56:53 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\win32k.sys.vir
2009-10-23 20:12:21 . 2009-10-23 20:12:23 399,872 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\~.exe.vir
2009-07-14 17:26:55 . 2009-07-14 17:26:55 2 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\0101120101465749.dat.vir
2009-07-14 17:26:55 . 2009-07-14 17:26:55 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\pusk_1247592413.exe.vir
2009-07-14 07:42:23 . 2009-07-14 07:42:23 2 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\0101120101464849.dat.vir
2009-07-14 07:42:15 . 2009-07-14 07:42:15 2 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\010112010146118114.dat.vir
2004-08-04 12:00:00 . 2004-08-04 12:00:00 45,568 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\BtwSrv.dll.vir
2004-08-04 12:00:00 . 2008-04-14 00:11:56 48,966 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\certstore.dat.vir
2004-08-04 12:00:00 . 2004-08-04 12:00:00 47,616 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\FastNetSrv.exe.vir
2004-08-04 12:00:00 . 2004-08-04 12:00:00 5 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\FInstall.sys.vir
2004-08-04 12:00:00 . 2004-08-04 12:00:00 272 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Install.txt.vir
2004-08-04 12:00:00 . 2008-04-14 00:11:56 2,304 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\isapeep.sys.vir
2004-08-04 12:00:00 . 2008-04-14 00:12:36 31,744 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\proquota.exe.vir
2004-08-04 12:00:00 . 2004-08-04 12:00:00 87,552 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\t4m0_149385252372.bk.old.vir

tetonbob · 11-02-2009, 11:38 PM

Please visit this site:

http://www.bleepingcomputer.com/subm....php?channel=4
In the Link to topic where this file was requested: area, copy and paste this

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/426707-please-help-malware-situation.html#post2423665
In the Browse to the file you want to submit: area, copy and paste this

C:\Qoobox\Quarantine\[4]-Submit_2009-11-01_21.29.22.zip
Then click Send File.
Once it shows:

Quote:

Your file was successfully submitted. Please let the user helping you know that you have submitted the file.
Close the site and continue with the steps below.

As mentioned in our preposting topic:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

Quote:

3. Uninstall the following via Add or Remove Programs in Control Panel:

p2p programs like uTorrent, Bittorrent, LimeWire, Morpheus, etc., as they are a major conduit for malware and a likely source of your current issues.

P2P - I see you have P2P software ( LimeWire 5.3.6 ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing

I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.

---------------------------------------------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 16 and save it to your desktop.
Scroll down to where it says "Java SE Runtime Environment (JRE) - JRE 6 Update 16 -"
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u16 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.

J2SE Runtime Environment 5.0 Update 4
Java(TM) 6 Update 11
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u16-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Save it to your desktop. Malwarebytes' Anti-Malware may require a reboot to complete removals. After a reboot, if required, post that saved log in your next reply.

---------------------------------------------------------------------------------------------

Go here to run an online scannner from ESET.

Note: You will need to use Internet explorer for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic and also let me know how things are now.

Also post a new set of logs from DDS.

Kay27 · 11-03-2009, 10:49 PM

Ok, so I followed your instructions. I submitted the file to bleepingcomputer.com, I deleted limewire, I updated java, I downloaded and installed the Malwarebyte's anti-malware, and I ran ESET. I now have a new problem, however, today when I went on my computer, I saw a new icon on my desktop for 'Alpha Antivirus' which I can't delete. I tried deleting it through add/remove programs, but it doesn't give me an uninstall option, only a purchase option. Also, I can't use my browser. When I logged on to TSF, I got a message that the website is unsafe and if I would like to continue unprotected or purchase their software, at which point clicking on 'continue unprotected' just comes up again and again. I attaced a Word file with two print screens so that you could see what I'm getting. Thanks for all your help and please let me know how I should proceed.

Malwarebytes' Anti-Malware 1.41
Database version: 3090
Windows 5.1.2600 Service Pack 2

11/3/2009 3:01:21 AM
mbam-log-2009-11-03 (03-01-21).txt

Scan type: Quick Scan
Objects scanned: 100223
Time elapsed: 10 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mBt (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udfa (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mfa (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\WINDOWS\addins\addins (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\opeia.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wmdtc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lsm32.sys (Backdoor.Bot) -> Quarantined and deleted successfully.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=cf3682d16ded6c4aa96d4397f028f59c
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-11-03 08:23:52
# local_time=2009-11-03 03:23:52 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=1024 16777215 100 0 0 0 0 0
# compatibility_mode=5121 16776533 100 96 0 71018099 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=772
# found=0
# cleaned=0
# scan_time=438
# version=7
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=cf3682d16ded6c4aa96d4397f028f59c
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-11-04 05:27:04
# local_time=2009-11-04 12:27:04 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=1024 16777215 100 0 39096 39096 0 0
# compatibility_mode=5121 16776533 100 96 0 71088341 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=55908
# found=1
# cleaned=0
# scan_time=5989
C:\Qoobox\Quarantine\C\WINDOWS\system32\isapeep.sys.vir Win32/Agent.QEV trojan 00000000000000000000000000000000 I

DDS (Ver_09-10-26.01) - NTFSx86
Run by Kalet at 0:46:22.20 on Wed 11/04/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.389 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Kalet\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Apoint2K\Apntex.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\shared\hpqwmi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mcafee\MWL\MwlGui.exe
C:\Program Files\Mcafee\MWL\MwlSvc.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\AlphaAV\alpha.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Documents and Settings\Kalet\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Advanced Explorer Editor: {35a5b43b-cb8a-49ca-a9f4-d3b308d2e3cc} - c:\windows\system32\AdvancedIEupdate.dll
BHO: McAfee Phishing Filter: {377c180e-6f0e-4d4c-980f-f45bd3d40cf4} - c:\progra~1\mcafee\msk\mcapbho.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [AlphaAV] c:\program files\alphaav\alpha.exe
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1150595.exe -Update -1150595 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.miniclip.com/games/air-show/en/"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [MWLExe] c:\program files\mcafee\mwl\MWLGui.exe /Start
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [MBkLogOnHook] c:\program files\mcafee\mbk\LogOnHook.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\docume~1\kalet\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\kalet\application data\dropbox\bin\Dropbox.exe
IE: &AIM Toolbar Search - c:\documents and settings\all users\application data\aim toolbar\ietoolbar\resources\en-us\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://navarro.lifepics.com/net/Uploader/LPUploader57.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {CF0D8AC6-84D9-428D-ADF6-E75BE5E00E89} = 4.2.2.1,4.2.2.2
TCP: {D9ADC467-AF12-45ED-863A-BE1263E295E3} = 4.2.2.1,4.2.2.2
TCP: {FD1DF127-4FA1-4692-9795-B3312857C65F} = 4.2.2.1,4.2.2.2
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-10-29 210216]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-4-27 24652]
S2 gupdate1c9e13f264b717c;Google Update Service (gupdate1c9e13f264b717c);c:\program files\google\update\GoogleUpdate.exe [2009-5-30 133104]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2009-6-4 17408]

=============== Created Last 30 ================

2009-11-03 19:44:03 0 d-----w- c:\program files\common files\AlphaAVUninstall
2009-11-03 19:43:59 354816 ----a-w- c:\windows\system32\AdvancedIEupdate.dll
2009-11-03 19:43:42 0 d-----w- c:\program files\AlphaAV
2009-11-03 08:10:20 0 d-----w- c:\program files\ESET
2009-11-03 07:48:32 0 d-----w- c:\docume~1\kalet\applic~1\Malwarebytes
2009-11-03 07:48:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-03 07:48:23 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-03 07:48:23 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-11-03 07:48:22 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-03 07:44:22 73728 ----a-w- c:\windows\system32\javacpl.cpl
2009-11-01 18:19:41 0 d-sha-r- C:\cmdcons
2009-11-01 18:18:10 98816 ----a-w- c:\windows\sed.exe
2009-11-01 18:18:10 77312 ----a-w- c:\windows\MBR.exe
2009-11-01 18:18:10 236544 ----a-w- c:\windows\PEV.exe
2009-11-01 18:18:10 161792 ----a-w- c:\windows\SWREG.exe
2009-10-30 04:53:36 0 d-----w- c:\windows\system32\CatRoot_bak
2009-10-30 04:49:47 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-10-30 04:45:48 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-10-30 04:44:54 2136064 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-10-30 04:44:43 2180352 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-30 04:44:36 2015744 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-10-30 04:44:29 2057728 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-10-30 04:40:29 0 d-----w- c:\windows\pss
2009-10-29 07:28:09 0 d-----w- c:\docume~1\kalet\applic~1\McAfee
2009-10-29 04:10:33 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-10-29 04:10:19 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-10-29 04:10:18 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-29 04:10:17 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-10-29 04:10:14 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-10-29 04:10:11 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-10-29 04:09:49 11069440 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-10-29 02:53:21 9782 ----a-w- c:\windows\system32\Config.MPF
2009-10-29 00:31:57 0 d-----w- c:\program files\SiteAdvisor
2009-10-29 00:31:55 0 d-----w- c:\docume~1\kalet\applic~1\SiteAdvisor
2009-10-29 00:27:07 86880 ----a-w- c:\windows\system32\drivers\WscNetDr.sys
2009-10-29 00:22:45 143360 ----a-w- c:\windows\system32\dunzip32.dll
2009-10-29 00:17:29 33832 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-10-29 00:17:28 40488 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-10-29 00:17:27 35240 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-10-29 00:17:21 201320 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-10-29 00:17:19 79304 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-10-29 00:16:55 113952 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2009-10-29 00:13:01 0 d-----w- c:\program files\McAfee.com
2009-10-29 00:12:33 0 d-----w- c:\program files\common files\McAfee
2009-10-29 00:11:56 0 d-----w- c:\program files\McAfee
2009-10-28 04:05:30 0 d-----w- c:\docume~1\alluse~1\applic~1\Downloaded Installations
2009-10-28 03:41:32 163840 ----a-r- c:\windows\system32\igfxres.dll
2009-10-28 03:34:20 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2009-10-28 03:34:20 31232 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2009-10-28 03:34:16 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2009-10-28 03:34:00 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2009-10-28 03:32:53 38912 -c--a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2009-10-28 03:32:43 111104 -c--a-w- c:\windows\system32\dllcache\mtstocom.exe
2009-10-28 03:32:14 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2009-10-28 03:32:13 92416 -c--a-w- c:\windows\system32\dllcache\mga.sys
2009-10-28 03:32:13 92032 -c--a-w- c:\windows\system32\dllcache\mga.dll
2009-10-28 03:32:11 65536 -c--a-w- c:\windows\system32\dllcache\EXCH_mailmsg.dll
2009-10-28 03:32:10 22528 -c--a-w- c:\windows\system32\dllcache\lpdsvc.dll
2009-10-28 03:32:10 18944 -c--a-w- c:\windows\system32\dllcache\lprmon.dll
2009-10-28 03:32:07 33792 -c--a-w- c:\windows\system32\dllcache\lmmib2.dll
2009-10-28 03:30:55 18944 -c--a-w- c:\windows\system32\dllcache\cprofile.exe
2009-10-28 03:29:54 32827 -c--a-w- c:\windows\system32\dllcache\tcptest.exe
2009-10-28 03:27:08 488 ---ha-r- c:\windows\system32\logonui.exe.manifest
2009-10-28 03:26:57 749 ---ha-r- c:\windows\WindowsShell.Manifest
2009-10-28 03:26:57 749 ---ha-r- c:\windows\system32\wuaucpl.cpl.manifest
2009-10-28 03:26:57 749 ---ha-r- c:\windows\system32\sapi.cpl.manifest
2009-10-28 03:26:57 749 ---ha-r- c:\windows\system32\ncpa.cpl.manifest
2009-10-28 03:26:25 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2009-10-28 03:25:48 32768 -c--a-w- c:\windows\system32\dllcache\icwdl.dll
2009-10-28 03:25:47 86016 -c--a-w- c:\windows\system32\dllcache\icwconn2.exe
2009-10-28 03:25:47 214528 -c--a-w- c:\windows\system32\dllcache\icwconn1.exe
2009-10-28 03:25:47 20480 -c--a-w- c:\windows\system32\dllcache\inetwiz.exe
2009-10-28 03:11:34 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2009-10-28 03:10:58 1086058 ----a-r- c:\windows\SET9A.tmp
2009-10-28 03:10:53 1042903 ----a-r- c:\windows\SET97.tmp
2009-10-28 03:10:06 1028709 ----a-w- c:\windows\setupapi.log.0.old
2009-10-10 08:03:50 0 d-----w- c:\docume~1\kalet\applic~1\Dropbox
2009-10-10 05:28:29 0 d-----w- c:\program files\IrfanView
2009-10-09 05:46:01 130 ----a-w- c:\documents and settings\kalet\webct_upload_applet.properties

==================== Find3M ====================

2009-11-03 07:43:52 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-28 03:25:13 23348 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-12 23:13:29 52536 ---ha-w- c:\windows\system32\mlfcache.dat
2009-09-11 14:33:52 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 02:48:46 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_netaapl_01005.Wdf
2009-09-09 02:48:40 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-09-04 20:45:26 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08:21 916480 ------w- c:\windows\system32\wininet.dll
2009-08-28 23:42:52 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-26 08:16:37 247326 ----a-w- c:\windows\system32\strmdll.dll

============= FINISH: 0:46:56.81 ===============

Kay27 · 11-03-2009, 10:51 PM

I forgot to mention, I am using InPrivate browsing in order to avoid the ad.

tetonbob · 11-03-2009, 10:55 PM

Don't go too far....I'll be back shortly with a fix. Seems you've picked up a new rogue. Where has anyone been surfing on this machine while we've been fixing it?

tetonbob · 11-03-2009, 10:58 PM

MBAM is frequently updated. We will use it again shortly.

1. Download TFC (Temp File Cleaner) to your desktop, or other location.
2. Save any unsaved work. TFC will close all open application windows.
3. Double-click TFC.exe to run the program.
4. If prompted, click "Yes" to reboot.

I see you have Malwarebytes' AntiMalware installed.

Please update it's definitions, and run a new Quick Scan.

Launch Malwarebytes' Antimalware
On the updates tab, click on Check for Updates
If an update is found, it will begin. Once the update is complete..
Click on the Scanner tab. Select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Save it to your desktop. Malwarebytes' Anti-Malware may require a reboot to complete removals. After a reboot, if required, post that saved log in your next reply.

Also post new logs from DDS.

Kay27 · 11-03-2009, 10:59 PM

That's one of the problems, this machine gets shared with two other people and I'm not aware of their activity.

Kay27 · 11-03-2009, 11:22 PM

I ran the TFC.exe but I'm having problems with Malwarebytes. When I open it it autimatically closes after 2 or 3 seconds.

tetonbob · 11-03-2009, 11:24 PM

Ok....then it seems y'all need to have a chat.

Not sure if you saw my last post about updating MBAM and running it again. It should remove this pest, but if it doesn't, we'll break out a bigger hammer.

Kay27 · 11-03-2009, 11:28 PM

Yes we do.

I went to start, programs, MBAM, but when I open it, it closes after a couple seconds of the window opening. I even tried uninstalling it and reinstalling, but still have the same problem. Can't run a scan.

tetonbob · 11-03-2009, 11:30 PM

Stand by.

tetonbob · 11-03-2009, 11:32 PM

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

Open notepad and copy/paste the text in the quotebox below into it:

Code:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/426707-please-help-malware-situation.html#post2425336
File::
c:\windows\SET9A.tmp
c:\windows\SET97.tmp
Folder::
c:\Program Files\Common Files\AlphaAVUninstall
c:\Program Files\AlphaAV
Collect::
c:\program files\alphaav\alpha.exe
c:\windows\system32\AdvancedIEupdate.dll
Comment::
End Copy Here

Save this as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

ComboFix may request an update; please allow it.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
- Ensure you are connected to the internet and click OK on the message box.
Please let me know if the file was successfully submitted . Thanks.

------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

---------------------------------------------------------------------------------------------

tetonbob · 11-04-2009, 12:10 AM

I see the files have been uploaded.

See if you can now run MBAM again, update it if so, run a full system scan with it.

Something else I should ask...these other users of the machine, do they have their own accounts, or do you all use the same user account?

If there are multiple user accounts on the machine, I should review DDS logs from the other accounts as well.

Kay27 · 11-04-2009, 07:53 AM

The CFScript file got rid of the AlphaAV and I was able to run MBAM which detected 11 threats and got removed them. There is only one general account which everyone who uses the machine logs on to.

11-01-2009, 09:48 AM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,501 OS: 2000 Pro; XP Pro; XP Home	Re: Please help with malware situation Hello, and Welcome to TSF. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum. --------------------------------------------------------------------------------------------- Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Place combofix.exe on your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. You can get help on disabling your protection programs here How to disable McAfee: Please open McAfee Security Centre Under Common Tasks click on Home Click Computer Files Click Configure Make sure the following are disabled by ticking the "Off" button. Virus protection Spyware protection System Guards Protection Script Scanning Protection (you may have to scroll down to see it) Next, select never for "When to re-enable real time scanning" and click OK. Further info on disabling and re-enabling McAfee: http://help.aol.com/help/microsites/...ernalID=222820 Double click on combofix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement. ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed. Click on Yes, to continue scanning for malware. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. --------------------------------------------------------------------------------------------- Ensure your AntiVirus and AntiSpyware applications are re-enabled. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-01-2009, 12:02 PM	#3 (permalink)
Kay27 Registered User Join Date: Oct 2009 Posts: 12 OS: Windows XP	Re: Please help with malware situation Thank you very much for your help. Below is the Combofix log. ComboFix 09-10-30.01 - Kalet 11/01/2009 13:21.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.533 [GMT -5:00] Running from: c:\documents and settings\Kalet\Desktop\ComboFix.exe AV: McAfee VirusScan On-access scanning disabled (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall enabled {94894B63-8C7F-4050-BDA4-813CA00DA3E8} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\010112010146118114.dat c:\windows\0101120101464849.dat c:\windows\0101120101465749.dat c:\windows\irc.txt c:\windows\pusk_1247592413.exe c:\windows\syssvc.exe c:\windows\system32\~.exe c:\windows\system32\certstore.dat c:\windows\system32\FInstall.sys c:\windows\system32\Install.txt c:\windows\system32\isapeep.sys c:\windows\system32\wbem\proquota.exe c:\windows\TEMP\mta13187.dll c:\windows\TEMP\t4m0_149385252372.bk.old c:\windows\TEMP\x1c57503.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_6TO4 -------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED} -------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE} -------\Service_6to4 -------\Legacy_isapeep -------\Service_isapeep ((((((((((((((((((((((((( Files Created from 2009-10-01 to 2009-11-01 ))))))))))))))))))))))))))))))) . 2009-10-31 16:02 . 2009-10-31 16:02 -------- d-----w- c:\documents and settings\Kalet\Local Settings\Application Data\Temp 2009-10-30 04:53 . 2009-10-30 05:39 -------- d-----w- c:\windows\system32\CatRoot_bak 2009-10-30 04:49 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys 2009-10-30 04:45 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys 2009-10-30 04:44 . 2009-08-04 13:58 2136064 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-10-30 04:44 . 2009-08-04 14:00 2180352 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe 2009-10-30 04:44 . 2009-08-04 13:13 2015744 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe 2009-10-30 04:44 . 2009-08-04 13:13 2057728 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-10-29 07:40 . 2009-10-29 07:40 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee 2009-10-29 07:28 . 2009-10-29 07:28 -------- d-----w- c:\documents and settings\Kalet\Application Data\McAfee 2009-10-29 05:24 . 2009-10-31 23:38 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore 2009-10-29 05:24 . 2009-10-29 05:24 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore 2009-10-29 05:15 . 2009-10-29 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor 2009-10-29 04:10 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-10-29 04:10 . 2009-08-29 08:08 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll 2009-10-29 04:10 . 2009-08-29 08:08 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll 2009-10-29 04:10 . 2009-08-29 08:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-10-29 04:10 . 2009-08-29 08:08 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll 2009-10-29 04:10 . 2009-08-29 08:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-10-29 04:09 . 2009-08-29 08:08 11069440 -c----w- c:\windows\system32\dllcache\ieframe.dll 2009-10-29 00:36 . 2009-10-29 00:36 128 ----a-w- c:\documents and settings\Kalet\Local Settings\Application Data\fusioncache.dat 2009-10-29 00:31 . 2009-10-29 01:31 -------- d-----w- c:\program files\SiteAdvisor 2009-10-29 00:31 . 2009-10-29 04:04 -------- d-----w- c:\documents and settings\Kalet\Application Data\SiteAdvisor 2009-10-29 00:27 . 2006-05-15 21:24 86880 ----a-w- c:\windows\system32\drivers\WscNetDr.sys 2009-10-29 00:22 . 2006-03-03 13:07 143360 ----a-w- c:\windows\system32\dunzip32.dll 2009-10-29 00:17 . 2007-11-22 11:44 33832 ----a-w- c:\windows\system32\drivers\mferkdk.sys 2009-10-29 00:17 . 2007-12-02 17:51 40488 ----a-w- c:\windows\system32\drivers\mfesmfk.sys 2009-10-29 00:17 . 2007-11-22 11:44 35240 ----a-w- c:\windows\system32\drivers\mfebopk.sys 2009-10-29 00:17 . 2007-11-22 11:44 201320 ----a-w- c:\windows\system32\drivers\mfehidk.sys 2009-10-29 00:17 . 2007-11-22 11:44 79304 ----a-w- c:\windows\system32\drivers\mfeavfk.sys 2009-10-29 00:16 . 2007-07-13 11:20 113952 ----a-w- c:\windows\system32\drivers\Mpfp.sys 2009-10-29 00:13 . 2009-10-29 00:14 -------- d-----w- c:\program files\McAfee.com 2009-10-29 00:12 . 2009-10-29 02:48 -------- d-----w- c:\program files\Common Files\McAfee 2009-10-29 00:11 . 2009-10-30 04:34 -------- d-----w- c:\program files\McAfee 2009-10-29 00:02 . 2009-10-29 07:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2009-10-28 04:05 . 2009-10-28 04:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Downloaded Installations 2009-10-28 03:41 . 2005-02-08 10:31 163840 ----a-r- c:\windows\system32\igfxres.dll 2009-10-28 03:34 . 2004-08-04 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll 2009-10-28 03:34 . 2004-08-04 12:00 31232 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys 2009-10-28 03:34 . 2004-08-04 12:00 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll 2009-10-28 03:34 . 2004-08-04 12:00 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe 2009-10-28 03:32 . 2001-08-18 02:36 38912 -c--a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll 2009-10-28 03:32 . 2004-08-04 12:00 111104 -c--a-w- c:\windows\system32\dllcache\mtstocom.exe 2009-10-28 03:32 . 2004-08-04 12:00 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe 2009-10-28 03:32 . 2004-08-04 12:00 92416 -c--a-w- c:\windows\system32\dllcache\mga.sys 2009-10-28 03:32 . 2004-08-04 12:00 92032 -c--a-w- c:\windows\system32\dllcache\mga.dll 2009-10-28 03:32 . 2001-08-18 02:36 65536 -c--a-w- c:\windows\system32\dllcache\EXCH_mailmsg.dll 2009-10-28 03:32 . 2004-08-04 12:00 22528 -c--a-w- c:\windows\system32\dllcache\lpdsvc.dll 2009-10-28 03:32 . 2004-08-04 12:00 18944 -c--a-w- c:\windows\system32\dllcache\lprmon.dll 2009-10-28 03:32 . 2004-08-04 12:00 33792 -c--a-w- c:\windows\system32\dllcache\lmmib2.dll 2009-10-28 03:30 . 2004-08-04 12:00 18944 -c--a-w- c:\windows\system32\dllcache\cprofile.exe 2009-10-28 03:30 . 2004-08-04 12:00 15872 -c--a-w- c:\windows\system32\dllcache\chgport.exe 2009-10-28 03:30 . 2004-08-04 12:00 14336 -c--a-w- c:\windows\system32\dllcache\chgusr.exe 2009-10-28 03:30 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\chglogon.exe 2009-10-28 03:30 . 2004-08-04 12:00 9728 -c--a-w- c:\windows\system32\dllcache\change.exe 2009-10-28 03:30 . 2004-08-04 12:00 54528 -c--a-w- c:\windows\system32\dllcache\cap7146.sys 2009-10-28 03:30 . 2004-08-04 12:00 331264 -c--a-w- c:\windows\system32\dllcache\aqueue.dll 2009-10-28 03:30 . 2001-08-18 02:36 45056 -c--a-w- c:\windows\system32\dllcache\EXCH_aqadmin.dll 2009-10-28 03:30 . 2001-08-18 02:36 5632 -c--a-w- c:\windows\system32\dllcache\EXCH_adsiisex.dll 2009-10-28 03:26 . 2004-08-04 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe 2009-10-28 03:25 . 2004-08-04 12:00 32768 -c--a-w- c:\windows\system32\dllcache\icwdl.dll 2009-10-28 03:25 . 2004-08-04 12:00 86016 -c--a-w- c:\windows\system32\dllcache\icwconn2.exe 2009-10-28 03:25 . 2004-08-04 12:00 214528 -c--a-w- c:\windows\system32\dllcache\icwconn1.exe 2009-10-28 03:25 . 2004-08-04 12:00 20480 -c--a-w- c:\windows\system32\dllcache\inetwiz.exe 2009-10-28 03:12 . 2004-08-04 12:00 480256 -c--a-w- c:\windows\system32\dllcache\cintsetp.exe 2009-10-28 03:12 . 2004-08-04 12:00 198656 -c--a-w- c:\windows\system32\dllcache\cintime.dll 2009-10-28 03:12 . 2004-08-04 12:00 97792 -c--a-w- c:\windows\system32\dllcache\chtmbx.dll 2009-10-28 03:12 . 2004-08-04 12:00 56320 -c--a-w- c:\windows\system32\dllcache\chtskdic.dll 2009-10-28 03:12 . 2004-08-04 12:00 455168 -c--a-w- c:\windows\system32\dllcache\tintsetp.exe 2009-10-28 03:12 . 2004-08-04 12:00 44032 -c--a-w- c:\windows\system32\dllcache\tintlphr.exe 2009-10-28 03:12 . 2004-08-04 12:00 173568 -c--a-w- c:\windows\system32\dllcache\chtskf.dll 2009-10-28 03:12 . 2004-08-04 12:00 10240 -c--a-w- c:\windows\system32\dllcache\tmigrate.dll 2009-10-28 03:12 . 2004-08-04 12:00 70144 -c--a-w- c:\windows\system32\dllcache\pintlphr.exe 2009-10-28 03:12 . 2004-08-04 12:00 67584 -c--a-w- c:\windows\system32\dllcache\pmigrate.dll 2009-10-28 03:12 . 2004-08-04 12:00 59392 -c--a-w- c:\windows\system32\dllcache\imscinst.exe 2009-10-28 03:12 . 2004-08-04 12:00 10096640 -c--a-w- c:\windows\system32\dllcache\hwxcht.dll 2009-10-28 03:11 . 2004-08-04 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll 2009-10-28 03:11 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll 2009-10-28 03:11 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll 2009-10-28 03:11 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll 2009-10-24 00:14 . 2009-10-24 00:14 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-10-24 00:09 . 2009-10-27 12:56 0 ----a-w- c:\windows\win32k.sys 2009-10-23 20:13 . 2009-10-29 00:27 -------- d-----w- c:\program files\brnnax 2009-10-15 18:51 . 2009-10-15 18:51 -------- d-----w- c:\documents and settings\Kalet\Application Data\Viewpoint 2009-10-10 08:03 . 2009-11-01 18:33 -------- d-----w- c:\documents and settings\Kalet\Application Data\Dropbox 2009-10-10 05:28 . 2009-10-10 05:28 -------- d-----w- c:\program files\IrfanView 2009-10-06 05:16 . 2009-10-06 05:16 -------- d-----w- c:\documents and settings\Kalet\Local Settings\Application Data\Yahoo! . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-29 04:28 . 2009-08-21 00:40 -------- d-----w- c:\program files\Stop Motion Pro v5 2009-10-29 00:36 . 2009-04-14 01:14 65136 ----a-w- c:\documents and settings\Kalet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-28 03:25 . 2009-04-10 03:28 23348 ----a-w- c:\windows\system32\emptyregdb.dat 2009-10-24 00:55 . 2009-06-19 23:06 -------- d-----w- c:\program files\AVG 2009-10-23 20:11 . 2009-04-19 08:12 -------- d-----w- c:\documents and settings\Kalet\Application Data\LimeWire 2009-10-17 04:59 . 2009-04-10 03:42 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-09-25 22:54 . 2009-09-25 22:52 -------- d-----w- c:\program files\iTunes 2009-09-25 22:53 . 2009-09-25 22:53 -------- d-----w- c:\program files\iPod 2009-09-25 22:53 . 2009-04-14 01:05 -------- d-----w- c:\program files\Common Files\Apple 2009-09-12 23:13 . 2009-09-12 23:13 52536 ---ha-w- c:\windows\system32\mlfcache.dat 2009-09-11 14:33 . 2004-08-04 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-11 02:36 . 2009-04-14 01:09 -------- d-----w- c:\documents and settings\Kalet\Application Data\Apple Computer 2009-09-11 02:30 . 2009-09-11 02:30 -------- d-----w- c:\program files\iPhone Configuration Utility 2009-09-11 02:27 . 2009-09-11 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-09-11 02:21 . 2009-09-11 02:20 -------- d-----w- c:\program files\QuickTime 2009-09-10 23:39 . 2009-04-14 06:17 -------- d-----w- c:\program files\Microsoft Silverlight 2009-09-09 02:48 . 2009-09-09 02:48 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_netaapl_01005.Wdf 2009-09-09 02:48 . 2009-09-09 02:48 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2009-09-03 04:46 . 2009-09-03 04:46 -------- d-----w- c:\documents and settings\Kalet\Application Data\InterVideo 2009-08-29 08:08 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll 2009-08-28 23:42 . 2009-06-05 03:12 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-08-28 23:42 . 2009-06-05 03:12 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-08-07 00:24 . 2009-04-10 03:29 327896 ----a-w- c:\windows\system32\wucltui.dll 2009-08-07 00:24 . 2009-04-10 03:29 209632 ----a-w- c:\windows\system32\wuweb.dll 2009-08-07 00:24 . 2009-04-10 03:29 35552 ----a-w- c:\windows\system32\wups.dll 2009-08-07 00:24 . 2008-10-16 18:09 44768 ----a-w- c:\windows\system32\wups2.dll 2009-08-07 00:24 . 2009-04-10 03:29 53472 ----a-w- c:\windows\system32\wuauclt.exe 2009-08-07 00:24 . 2004-08-04 12:00 96480 ----a-w- c:\windows\system32\cdm.dll 2009-08-07 00:23 . 2009-08-07 00:23 575704 ----a-w- c:\windows\system32\wuapi.dll 2009-08-07 00:23 . 2009-04-10 03:29 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-08-05 09:11 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-04 23:52 . 2009-08-04 23:52 1193832 ----a-w- c:\windows\system32\FM20.DLL 2009-08-04 14:00 . 2004-08-04 12:00 2180352 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-08-04 13:13 . 2004-08-03 22:59 2057728 ----a-w- c:\windows\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150595.exe" [2009-03-19 460216] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-03-29 233534] "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816] "hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 794624] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392] "MWLExe"="c:\program files\Mcafee\MWL\MWLGui.exe" [2006-07-26 1287792] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "MBkLogOnHook"="c:\program files\McAfee\MBK\LogOnHook.exe" [2007-01-08 20480] "AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209] c:\documents and settings\Kalet\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\Kalet\Application Data\Dropbox\bin\Dropbox.exe [2009-10-8 26805255] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\McAfee\\MWL\\MwlSvc.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 7:00 AM 14336] R2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [8/4/2004 7:00 AM 47616] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/29/2009 12:14 AM 210216] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/27/2009 6:53 PM 24652] S2 gupdate1c9e13f264b717c;Google Update Service (gupdate1c9e13f264b717c);c:\program files\Google\Update\GoogleUpdate.exe [5/30/2009 10:56 AM 133104] S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [6/4/2009 10:12 PM 17408] --- Other Services/Drivers In Memory --- NewlyCreated - BTWSRV NewlyCreated - CLASSPNP_2 NewlyCreated - MBR Deregistered - CLASSPNP_2 Deregistered - mbr HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs BtwSrv . Contents of the 'Scheduled Tasks' folder 2009-10-23 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] 2009-11-01 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-30 15:52] 2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 15:55] 2009-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 15:55] 2009-10-29 c:\windows\Tasks\McDefragTask.job - c:\windows\system32\defrag.exe [2004-08-04 12:00] 2009-10-29 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2009-10-29 18:32] 2009-11-01 c:\windows\Tasks\User_Feed_Synchronization-{21625C07-F477-4236-98A2-185C02C5BD0E}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 08:31] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/http://www.yahoo.com IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 TCP: {CF0D8AC6-84D9-428D-ADF6-E75BE5E00E89} = 4.2.2.1,4.2.2.2 TCP: {D9ADC467-AF12-45ED-863A-BE1263E295E3} = 4.2.2.1,4.2.2.2 TCP: {FD1DF127-4FA1-4692-9795-B3312857C65F} = 4.2.2.1,4.2.2.2 DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://navarro.lifepics.com/net/Uploader/LPUploader57.cab . - - - - ORPHANS REMOVED - - - - URLSearchHooks-03402f96-3dc7-4285-bc50-9e81fefafe43} - (no file) URLSearchHooks-CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) URLSearchHooks-EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) HKCU-Run-Aim6 - (no file) MSConfigStartUp-CTFMON - (no file) ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-01 13:33 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????6?8?7?6??`???? ???B?????????????hLC? ?????? scanning hidden files ... c:\windows\system32\wbem\Performance\WmiApRpl_new.ini 924 bytes c:\windows\system32\Install.txt 266 bytes scan completed successfully hidden files: 2 ************************************************************************ "ServiceDll"="c:\windows\system32\BtwSrv.dll\00ÇEÌ\08@\00\00ƒ=\00Ñ@\00\00u\18h\00Ñ@\00hÔ!@\00èc¶ÿÿÇE°\00Ñ@\00ë\07ÇE°\00Ñ@\00j\10Xè)´ÿÿuÌ‹ü¥¥¥¥j\01jh‹E°‹\00‹M°‹\09‹\09Pÿ‘\14\03\00\00PEÜPè\01µÿÿPè!¶ÿÿƒÄ\1cMÜèä´ÿÿÇEÈ\03\00\00\00EÈPèÞ\01\00\00èåûÿÿÿu\08èuüÿÿèèµÿÿë\05èáµÿÿèz´ÿÿhùd@\00ë\09MÜè§´ÿÿÃMàèP´ÿÿÃ‹Mäd‰\0d\00\00\00\00_^ [ÉÂ\04\00U‹ìƒì\0ch¦\18@\00d¡\00\00\00\00Pd‰%" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1409082233-2111687655-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EB02EBF2-2DB7-35E0-CB02-563ACE0A7833}] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "iakfmcbfdebnpbcamp"=hex:63,61,66,65,61,6a,00,7c . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(3428) c:\windows\system32\WININET.dll c:\program files\McAfee\SiteAdvisor\saHook.dll c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll c:\windows\system32\msi.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\McAfee\MBK\MBackMonitor.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\progra~1\McAfee\VIRUSS~1\mcshield.exe c:\program files\McAfee\MPF\MPFSrv.exe c:\program files\McAfee\MSK\MskSrver.exe c:\program files\Mcafee\MWL\MwlSvc.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\progra~1\mcafee.com\agent\mcagent.exe c:\progra~1\McAfee\MSC\mcregist.exe c:\program files\Apoint2K\Apntex.exe c:\windows\system32\wscntfy.exe c:\windows\system32\wmdtc.exe c:\program files\iPod\bin\iPodService.exe c:\program files\HPQ\shared\hpqwmi.exe c:\progra~1\mcafee\msc\mcuimgr.exe c:\windows\system32\lsm32.sys . ************************************************************************* . Completion time: 2009-11-01 13:40 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-01 18:40 Pre-Run: 46,164,545,536 bytes free Post-Run: 57,187,098,624 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect - - End Of File - - 5EAF8B6D1F7DC0D5EEE87F6A0EB12D96

11-01-2009, 01:12 PM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,501 OS: 2000 Pro; XP Pro; XP Home	Re: Please help with malware situation Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. Open notepad and copy/paste the text in the quotebox below into it: Code: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/426707-please-help-malware-situation.html#post2421345 File:: c:\windows\win32k.sys Folder:: c:\Program Files\brnnax Driver:: BtwSrv fastnetsrv NetSvc:: BtwSrv Collect:: c:\windows\system32\FastNetSrv.exe c:\windows\system32\BtwSrv.dll c:\program files\brnnax\qumksysguard.exe Comment:: End Copy Here Save this as CFScript.txt Referring to the picture above, drag CFScript.txt into ComboFix.exe ComboFix may request an update; please allow it. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Note When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. Please let me know if the file was successfully submitted . Thanks. ------------------------------------------------------ Ensure your AntiVirus and AntiSpyware applications are re-enabled. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-01-2009, 07:54 PM	#5 (permalink)
Kay27 Registered User Join Date: Oct 2009 Posts: 12 OS: Windows XP	Re: Please help with malware situation I followed your instructions and got the log which I've posted below, however I did not get a message box with the log. Please let me know how to proceed. ComboFix 09-10-30.01 - Kalet 11/01/2009 21:29.2.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.530 [GMT -5:00] Running from: c:\documents and settings\Kalet\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Kalet\Desktop\CFScript.txt AV: McAfee VirusScan On-access scanning disabled (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall enabled {94894B63-8C7F-4050-BDA4-813CA00DA3E8} FILE :: "c:\windows\win32k.sys" file zipped: c:\windows\system32\BtwSrv.dll file zipped: c:\windows\system32\FastNetSrv.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\brnnax c:\windows\system32\btwsrv.dll c:\windows\system32\FastNetSrv.exe c:\windows\system32\Install.txt c:\windows\TEMP\mta13187.dll c:\windows\win32k.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_BTWSRV -------\Legacy_FASTNETSRV -------\Service_BtwSrv -------\Service_fastnetsrv ((((((((((((((((((((((((( Files Created from 2009-10-02 to 2009-11-02 ))))))))))))))))))))))))))))))) . 2009-10-31 16:02 . 2009-10-31 16:02 -------- d-----w- c:\documents and settings\Kalet\Local Settings\Application Data\Temp 2009-10-30 04:53 . 2009-10-30 05:39 -------- d-----w- c:\windows\system32\CatRoot_bak 2009-10-30 04:49 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys 2009-10-30 04:45 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys 2009-10-30 04:44 . 2009-08-04 13:58 2136064 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-10-30 04:44 . 2009-08-04 14:00 2180352 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe 2009-10-30 04:44 . 2009-08-04 13:13 2015744 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe 2009-10-30 04:44 . 2009-08-04 13:13 2057728 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-10-29 07:40 . 2009-10-29 07:40 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee 2009-10-29 07:28 . 2009-10-29 07:28 -------- d-----w- c:\documents and settings\Kalet\Application Data\McAfee 2009-10-29 05:24 . 2009-10-31 23:38 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore 2009-10-29 05:24 . 2009-10-29 05:24 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore 2009-10-29 05:15 . 2009-10-29 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor 2009-10-29 04:10 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-10-29 04:10 . 2009-08-29 08:08 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll 2009-10-29 04:10 . 2009-08-29 08:08 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll 2009-10-29 04:10 . 2009-08-29 08:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-10-29 04:10 . 2009-08-29 08:08 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll 2009-10-29 04:10 . 2009-08-29 08:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-10-29 04:09 . 2009-08-29 08:08 11069440 -c----w- c:\windows\system32\dllcache\ieframe.dll 2009-10-29 00:36 . 2009-10-29 00:36 128 ----a-w- c:\documents and settings\Kalet\Local Settings\Application Data\fusioncache.dat 2009-10-29 00:31 . 2009-10-29 01:31 -------- d-----w- c:\program files\SiteAdvisor 2009-10-29 00:31 . 2009-10-29 04:04 -------- d-----w- c:\documents and settings\Kalet\Application Data\SiteAdvisor 2009-10-29 00:27 . 2006-05-15 21:24 86880 ----a-w- c:\windows\system32\drivers\WscNetDr.sys 2009-10-29 00:22 . 2006-03-03 13:07 143360 ----a-w- c:\windows\system32\dunzip32.dll 2009-10-29 00:17 . 2007-11-22 11:44 33832 ----a-w- c:\windows\system32\drivers\mferkdk.sys 2009-10-29 00:17 . 2007-12-02 17:51 40488 ----a-w- c:\windows\system32\drivers\mfesmfk.sys 2009-10-29 00:17 . 2007-11-22 11:44 35240 ----a-w- c:\windows\system32\drivers\mfebopk.sys 2009-10-29 00:17 . 2007-11-22 11:44 201320 ----a-w- c:\windows\system32\drivers\mfehidk.sys 2009-10-29 00:17 . 2007-11-22 11:44 79304 ----a-w- c:\windows\system32\drivers\mfeavfk.sys 2009-10-29 00:16 . 2007-07-13 11:20 113952 ----a-w- c:\windows\system32\drivers\Mpfp.sys 2009-10-29 00:13 . 2009-10-29 00:14 -------- d-----w- c:\program files\McAfee.com 2009-10-29 00:12 . 2009-10-29 02:48 -------- d-----w- c:\program files\Common Files\McAfee 2009-10-29 00:11 . 2009-10-30 04:34 -------- d-----w- c:\program files\McAfee 2009-10-29 00:02 . 2009-10-29 07:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2009-10-28 04:05 . 2009-10-28 04:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Downloaded Installations 2009-10-28 03:41 . 2005-02-08 10:31 163840 ----a-r- c:\windows\system32\igfxres.dll 2009-10-28 03:34 . 2004-08-04 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll 2009-10-28 03:34 . 2004-08-04 12:00 31232 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys 2009-10-28 03:34 . 2004-08-04 12:00 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll 2009-10-28 03:34 . 2004-08-04 12:00 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe 2009-10-28 03:32 . 2001-08-18 02:36 38912 -c--a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll 2009-10-28 03:32 . 2004-08-04 12:00 111104 -c--a-w- c:\windows\system32\dllcache\mtstocom.exe 2009-10-28 03:32 . 2004-08-04 12:00 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe 2009-10-28 03:32 . 2004-08-04 12:00 92416 -c--a-w- c:\windows\system32\dllcache\mga.sys 2009-10-28 03:32 . 2004-08-04 12:00 92032 -c--a-w- c:\windows\system32\dllcache\mga.dll 2009-10-28 03:32 . 2001-08-18 02:36 65536 -c--a-w- c:\windows\system32\dllcache\EXCH_mailmsg.dll 2009-10-28 03:32 . 2004-08-04 12:00 22528 -c--a-w- c:\windows\system32\dllcache\lpdsvc.dll 2009-10-28 03:32 . 2004-08-04 12:00 18944 -c--a-w- c:\windows\system32\dllcache\lprmon.dll 2009-10-28 03:32 . 2004-08-04 12:00 33792 -c--a-w- c:\windows\system32\dllcache\lmmib2.dll 2009-10-28 03:30 . 2004-08-04 12:00 18944 -c--a-w- c:\windows\system32\dllcache\cprofile.exe 2009-10-28 03:30 . 2004-08-04 12:00 15872 -c--a-w- c:\windows\system32\dllcache\chgport.exe 2009-10-28 03:30 . 2004-08-04 12:00 14336 -c--a-w- c:\windows\system32\dllcache\chgusr.exe 2009-10-28 03:30 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\chglogon.exe 2009-10-28 03:30 . 2004-08-04 12:00 9728 -c--a-w- c:\windows\system32\dllcache\change.exe 2009-10-28 03:30 . 2004-08-04 12:00 54528 -c--a-w- c:\windows\system32\dllcache\cap7146.sys 2009-10-28 03:30 . 2004-08-04 12:00 331264 -c--a-w- c:\windows\system32\dllcache\aqueue.dll 2009-10-28 03:30 . 2001-08-18 02:36 45056 -c--a-w- c:\windows\system32\dllcache\EXCH_aqadmin.dll 2009-10-28 03:30 . 2001-08-18 02:36 5632 -c--a-w- c:\windows\system32\dllcache\EXCH_adsiisex.dll 2009-10-28 03:26 . 2004-08-04 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe 2009-10-28 03:25 . 2004-08-04 12:00 32768 -c--a-w- c:\windows\system32\dllcache\icwdl.dll 2009-10-28 03:25 . 2004-08-04 12:00 86016 -c--a-w- c:\windows\system32\dllcache\icwconn2.exe 2009-10-28 03:25 . 2004-08-04 12:00 214528 -c--a-w- c:\windows\system32\dllcache\icwconn1.exe 2009-10-28 03:25 . 2004-08-04 12:00 20480 -c--a-w- c:\windows\system32\dllcache\inetwiz.exe 2009-10-28 03:12 . 2004-08-04 12:00 480256 -c--a-w- c:\windows\system32\dllcache\cintsetp.exe 2009-10-28 03:12 . 2004-08-04 12:00 198656 -c--a-w- c:\windows\system32\dllcache\cintime.dll 2009-10-28 03:12 . 2004-08-04 12:00 97792 -c--a-w- c:\windows\system32\dllcache\chtmbx.dll 2009-10-28 03:12 . 2004-08-04 12:00 56320 -c--a-w- c:\windows\system32\dllcache\chtskdic.dll 2009-10-28 03:12 . 2004-08-04 12:00 455168 -c--a-w- c:\windows\system32\dllcache\tintsetp.exe 2009-10-28 03:12 . 2004-08-04 12:00 44032 -c--a-w- c:\windows\system32\dllcache\tintlphr.exe 2009-10-28 03:12 . 2004-08-04 12:00 173568 -c--a-w- c:\windows\system32\dllcache\chtskf.dll 2009-10-28 03:12 . 2004-08-04 12:00 10240 -c--a-w- c:\windows\system32\dllcache\tmigrate.dll 2009-10-28 03:12 . 2004-08-04 12:00 70144 -c--a-w- c:\windows\system32\dllcache\pintlphr.exe 2009-10-28 03:12 . 2004-08-04 12:00 67584 -c--a-w- c:\windows\system32\dllcache\pmigrate.dll 2009-10-28 03:12 . 2004-08-04 12:00 59392 -c--a-w- c:\windows\system32\dllcache\imscinst.exe 2009-10-28 03:12 . 2004-08-04 12:00 10096640 -c--a-w- c:\windows\system32\dllcache\hwxcht.dll 2009-10-28 03:11 . 2004-08-04 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll 2009-10-28 03:11 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll 2009-10-28 03:11 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll 2009-10-28 03:11 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll 2009-10-24 00:14 . 2009-10-24 00:14 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-10-15 18:51 . 2009-10-15 18:51 -------- d-----w- c:\documents and settings\Kalet\Application Data\Viewpoint 2009-10-10 08:03 . 2009-11-01 18:33 -------- d-----w- c:\documents and settings\Kalet\Application Data\Dropbox 2009-10-10 05:28 . 2009-10-10 05:28 -------- d-----w- c:\program files\IrfanView 2009-10-06 05:16 . 2009-10-06 05:16 -------- d-----w- c:\documents and settings\Kalet\Local Settings\Application Data\Yahoo! . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-29 04:28 . 2009-08-21 00:40 -------- d-----w- c:\program files\Stop Motion Pro v5 2009-10-29 00:36 . 2009-04-14 01:14 65136 ----a-w- c:\documents and settings\Kalet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-28 03:25 . 2009-04-10 03:28 23348 ----a-w- c:\windows\system32\emptyregdb.dat 2009-10-24 00:55 . 2009-06-19 23:06 -------- d-----w- c:\program files\AVG 2009-10-23 20:11 . 2009-04-19 08:12 -------- d-----w- c:\documents and settings\Kalet\Application Data\LimeWire 2009-10-17 04:59 . 2009-04-10 03:42 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-09-25 22:54 . 2009-09-25 22:52 -------- d-----w- c:\program files\iTunes 2009-09-25 22:53 . 2009-09-25 22:53 -------- d-----w- c:\program files\iPod 2009-09-25 22:53 . 2009-04-14 01:05 -------- d-----w- c:\program files\Common Files\Apple 2009-09-12 23:13 . 2009-09-12 23:13 52536 ---ha-w- c:\windows\system32\mlfcache.dat 2009-09-11 14:33 . 2004-08-04 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-11 02:36 . 2009-04-14 01:09 -------- d-----w- c:\documents and settings\Kalet\Application Data\Apple Computer 2009-09-11 02:30 . 2009-09-11 02:30 -------- d-----w- c:\program files\iPhone Configuration Utility 2009-09-11 02:27 . 2009-09-11 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-09-11 02:21 . 2009-09-11 02:20 -------- d-----w- c:\program files\QuickTime 2009-09-10 23:39 . 2009-04-14 06:17 -------- d-----w- c:\program files\Microsoft Silverlight 2009-09-09 02:48 . 2009-09-09 02:48 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_netaapl_01005.Wdf 2009-09-09 02:48 . 2009-09-09 02:48 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2009-09-03 04:46 . 2009-09-03 04:46 -------- d-----w- c:\documents and settings\Kalet\Application Data\InterVideo 2009-08-29 08:08 . 2004-08-04 12:00 916480 ------w- c:\windows\system32\wininet.dll 2009-08-28 23:42 . 2009-06-05 03:12 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-08-28 23:42 . 2009-06-05 03:12 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-08-07 00:24 . 2009-04-10 03:29 327896 ----a-w- c:\windows\system32\wucltui.dll 2009-08-07 00:24 . 2009-04-10 03:29 209632 ----a-w- c:\windows\system32\wuweb.dll 2009-08-07 00:24 . 2009-04-10 03:29 35552 ----a-w- c:\windows\system32\wups.dll 2009-08-07 00:24 . 2008-10-16 18:09 44768 ----a-w- c:\windows\system32\wups2.dll 2009-08-07 00:24 . 2009-04-10 03:29 53472 ------w- c:\windows\system32\wuauclt.exe 2009-08-07 00:24 . 2004-08-04 12:00 96480 ----a-w- c:\windows\system32\cdm.dll 2009-08-07 00:23 . 2009-08-07 00:23 575704 ----a-w- c:\windows\system32\wuapi.dll 2009-08-07 00:23 . 2009-04-10 03:29 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-08-05 09:11 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-04 23:52 . 2009-08-04 23:52 1193832 ----a-w- c:\windows\system32\FM20.DLL 2009-08-04 14:00 . 2004-08-04 12:00 2180352 ------w- c:\windows\system32\ntoskrnl.exe 2009-08-04 13:13 . 2004-08-03 22:59 2057728 ------w- c:\windows\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((( SnapShot@2009-11-01_18.34.05 ))))))))))))))))))))))))))))))))))))))))) . + 2009-11-02 02:40 . 2009-11-02 02:40 16384 c:\windows\Temp\Perflib_Perfdata_150.dat + 2004-08-04 12:00 . 2009-11-01 18:37 72306 c:\windows\system32\perfc009.dat - 2004-08-04 12:00 . 2009-11-01 18:35 72306 c:\windows\system32\perfc009.dat + 2009-04-10 03:35 . 2009-11-02 00:36 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2009-04-10 03:35 . 2009-11-01 16:09 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2009-04-10 03:35 . 2009-11-02 00:36 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2009-04-10 03:35 . 2009-11-01 16:09 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2009-04-10 03:35 . 2009-11-01 16:09 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat + 2009-11-01 20:23 . 2009-11-02 00:36 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat + 2004-08-04 12:00 . 2009-11-01 18:37 444596 c:\windows\system32\perfh009.dat - 2004-08-04 12:00 . 2009-11-01 18:35 444596 c:\windows\system32\perfh009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-10-08 21:18 77824 ----a-w- c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150595.exe" [2009-03-19 460216] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-03-29 233534] "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816] "hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-05-04 794624] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392] "MWLExe"="c:\program files\Mcafee\MWL\MWLGui.exe" [2006-07-26 1287792] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "MBkLogOnHook"="c:\program files\McAfee\MBK\LogOnHook.exe" [2007-01-08 20480] "AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209] c:\documents and settings\Kalet\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\Kalet\Application Data\Dropbox\bin\Dropbox.exe [2009-10-8 26805255] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\McAfee\\MWL\\MwlSvc.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/29/2009 12:14 AM 210216] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/27/2009 6:53 PM 24652] S2 gupdate1c9e13f264b717c;Google Update Service (gupdate1c9e13f264b717c);c:\program files\Google\Update\GoogleUpdate.exe [5/30/2009 10:56 AM 133104] S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [6/4/2009 10:12 PM 17408] --- Other Services/Drivers In Memory --- Deregistered - CLASSPNP_2 Deregistered - mbr . Contents of the 'Scheduled Tasks' folder 2009-10-23 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] 2009-11-02 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-30 15:52] 2009-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 15:55] 2009-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 15:55] 2009-10-29 c:\windows\Tasks\McDefragTask.job - c:\windows\system32\defrag.exe [2004-08-04 12:00] 2009-10-29 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2009-10-29 18:32] 2009-11-02 c:\windows\Tasks\User_Feed_Synchronization-{21625C07-F477-4236-98A2-185C02C5BD0E}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 08:31] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/http://www.yahoo.com IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 TCP: {CF0D8AC6-84D9-428D-ADF6-E75BE5E00E89} = 4.2.2.1,4.2.2.2 TCP: {D9ADC467-AF12-45ED-863A-BE1263E295E3} = 4.2.2.1,4.2.2.2 TCP: {FD1DF127-4FA1-4692-9795-B3312857C65F} = 4.2.2.1,4.2.2.2 DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://navarro.lifepics.com/net/Uploader/LPUploader57.cab . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-01 21:41 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????6?8?7?6??P???? ???B?????????????hLC? ?????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1409082233-2111687655-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EB02EBF2-2DB7-35E0-CB02-563ACE0A7833}] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "iakfmcbfdebnpbcamp"=hex:63,61,66,65,61,6a,00,7c . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2276) c:\windows\system32\WININET.dll c:\program files\McAfee\SiteAdvisor\saHook.dll c:\documents and settings\Kalet\Application Data\Dropbox\bin\DropboxExt.3.dll c:\windows\system32\ieframe.dll c:\windows\system32\msi.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\McAfee\MBK\MBackMonitor.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\progra~1\McAfee\VIRUSS~1\mcshield.exe c:\program files\McAfee\MPF\MPFSrv.exe c:\program files\McAfee\MSK\MskSrver.exe c:\program files\Mcafee\MWL\MwlSvc.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\progra~1\mcafee.com\agent\mcagent.exe c:\progra~1\McAfee\MSC\mcregist.exe c:\windows\system32\wscntfy.exe c:\program files\Apoint2K\Apntex.exe c:\program files\iPod\bin\iPodService.exe c:\progra~1\mcafee\msc\mcuimgr.exe c:\program files\HPQ\shared\hpqwmi.exe . ************************************************************************* . Completion time: 2009-11-02 21:49 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-02 02:48 ComboFix2.txt 2009-11-01 18:40 Pre-Run: 57,311,645,696 bytes free Post-Run: 57,306,046,464 bytes free - - End Of File - - A2EDB67667E31856CF37D8E3F4DD9085

11-01-2009, 08:41 PM	#6 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,501 OS: 2000 Pro; XP Pro; XP Home	Re: Please help with malware situation OK, let's do this next.. Please go to Start > Run and copy/paste the following, then press Enter: C:\QooBox\ComboFix-quarantined-files.txt Post the contents of the logfile which will open. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-02-2009, 11:33 PM	#7 (permalink)
Kay27 Registered User Join Date: Oct 2009 Posts: 12 OS: Windows XP	Re: Please help with malware situation Here is the log. 2009-11-02 02:35:44 . 2009-11-02 02:35:44 2,566 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_fastnetsrv.reg.dat 2009-11-02 02:35:44 . 2009-11-02 02:35:44 6,056 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_BtwSrv.reg.dat 2009-11-02 02:35:44 . 2009-11-02 02:35:44 1,080 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_FASTNETSRV.reg.dat 2009-11-02 02:35:44 . 2009-11-02 02:35:44 1,080 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_BTWSRV.reg.dat 2009-11-02 02:29:31 . 2009-11-02 02:29:34 51,795 ----a-w- C:\Qoobox\Quarantine\[4]-Submit_2009-11-01_21.29.22.zip 2009-11-01 18:38:59 . 2009-11-01 18:38:59 256 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-CTFMON.reg.dat 2009-11-01 18:38:37 . 2009-11-01 18:38:37 91 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-Aim6.reg.dat 2009-11-01 18:38:35 . 2009-11-01 18:38:35 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829}.reg.dat 2009-11-01 18:38:34 . 2009-11-01 18:38:34 132 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829}.reg.dat 2009-11-01 18:38:32 . 2009-11-01 18:38:32 117 ----a-w- C:\Qoobox\Quarantine\Registry_backups\URLSearchHooks-EF99BD32-C1FB-11D2-892F-0090271D4F88}.reg.dat 2009-11-01 18:38:32 . 2009-11-01 18:38:32 162 ----a-w- C:\Qoobox\Quarantine\Registry_backups\URLSearchHooks-CFBFAE00-17A6-11D0-99CB-00C04FD64497}.reg.dat 2009-11-01 18:38:31 . 2009-11-01 18:38:31 117 ----a-w- C:\Qoobox\Quarantine\Registry_backups\URLSearchHooks-03402f96-3dc7-4285-bc50-9e81fefafe43}.reg.dat 2009-11-01 18:34:42 . 2009-08-29 08:08:21 1,208,832 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\mta13187.dll.vir 2009-11-01 18:29:33 . 2009-11-01 18:29:33 274 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_Install_.txt.zip 2009-11-01 18:28:10 . 2009-11-01 18:28:10 2,534 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_isapeep.reg.dat 2009-11-01 18:28:10 . 2009-11-01 18:28:10 1,208 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_isapeep.reg.dat 2009-11-01 18:26:57 . 2009-11-01 18:26:57 4,028 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_6to4.reg.dat 2009-11-01 18:26:57 . 2009-11-01 18:26:57 1,046 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}.reg.dat 2009-11-01 18:26:57 . 2009-11-01 18:26:57 1,046 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}.reg.dat 2009-11-01 18:26:57 . 2009-11-01 18:26:57 990 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_6TO4.reg.dat 2009-11-01 18:26:35 . 2009-11-02 02:35:21 8,861 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2009-11-01 18:18:02 . 2009-11-02 02:27:20 320 ----a-w- C:\Qoobox\Quarantine\catchme.log 2009-10-31 20:57:02 . 2009-08-29 08:08:21 1,208,832 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\x1c57503.dll.vir 2009-10-24 00:13:47 . 2009-10-24 00:13:49 121,344 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\syssvc.exe.vir 2009-10-24 00:09:52 . 2009-10-27 12:56:53 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\win32k.sys.vir 2009-10-23 20:12:21 . 2009-10-23 20:12:23 399,872 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\~.exe.vir 2009-07-14 17:26:55 . 2009-07-14 17:26:55 2 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\0101120101465749.dat.vir 2009-07-14 17:26:55 . 2009-07-14 17:26:55 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\pusk_1247592413.exe.vir 2009-07-14 07:42:23 . 2009-07-14 07:42:23 2 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\0101120101464849.dat.vir 2009-07-14 07:42:15 . 2009-07-14 07:42:15 2 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\010112010146118114.dat.vir 2004-08-04 12:00:00 . 2004-08-04 12:00:00 45,568 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\BtwSrv.dll.vir 2004-08-04 12:00:00 . 2008-04-14 00:11:56 48,966 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\certstore.dat.vir 2004-08-04 12:00:00 . 2004-08-04 12:00:00 47,616 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\FastNetSrv.exe.vir 2004-08-04 12:00:00 . 2004-08-04 12:00:00 5 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\FInstall.sys.vir 2004-08-04 12:00:00 . 2004-08-04 12:00:00 272 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Install.txt.vir 2004-08-04 12:00:00 . 2008-04-14 00:11:56 2,304 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\isapeep.sys.vir 2004-08-04 12:00:00 . 2008-04-14 00:12:36 31,744 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\proquota.exe.vir 2004-08-04 12:00:00 . 2004-08-04 12:00:00 87,552 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\t4m0_149385252372.bk.old.vir

11-03-2009, 10:51 PM	#10 (permalink)
Kay27 Registered User Join Date: Oct 2009 Posts: 12 OS: Windows XP	Re: Please help with malware situation I forgot to mention, I am using InPrivate browsing in order to avoid the ad.

11-03-2009, 10:55 PM	#11 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,501 OS: 2000 Pro; XP Pro; XP Home	Re: Please help with malware situation Don't go too far....I'll be back shortly with a fix. Seems you've picked up a new rogue. Where has anyone been surfing on this machine while we've been fixing it? __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-03-2009, 10:58 PM	#12 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,501 OS: 2000 Pro; XP Pro; XP Home	Re: Please help with malware situation MBAM is frequently updated. We will use it again shortly. 1. Download TFC (Temp File Cleaner) to your desktop, or other location. 2. Save any unsaved work. TFC will close all open application windows. 3. Double-click TFC.exe to run the program. 4. If prompted, click "Yes" to reboot. I see you have Malwarebytes' AntiMalware installed. Please update it's definitions, and run a new Quick Scan. Launch Malwarebytes' Antimalware On the updates tab, click on Check for Updates If an update is found, it will begin. Once the update is complete.. Click on the Scanner tab. Select Perform quick scan, then click Scan. When the scan is complete, click OK, then Show Results to view the results. Be sure that everything is checked, and click Remove Selected. When completed, a log will open in Notepad. Save it to your desktop. Malwarebytes' Anti-Malware may require a reboot to complete removals. After a reboot, if required, post that saved log in your next reply. Also post new logs from DDS. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-03-2009, 10:59 PM	#13 (permalink)
Kay27 Registered User Join Date: Oct 2009 Posts: 12 OS: Windows XP	Re: Please help with malware situation That's one of the problems, this machine gets shared with two other people and I'm not aware of their activity.

11-03-2009, 11:22 PM	#14 (permalink)
Kay27 Registered User Join Date: Oct 2009 Posts: 12 OS: Windows XP	Re: Please help with malware situation I ran the TFC.exe but I'm having problems with Malwarebytes. When I open it it autimatically closes after 2 or 3 seconds.

11-03-2009, 11:24 PM	#15 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,501 OS: 2000 Pro; XP Pro; XP Home	Re: Please help with malware situation Ok....then it seems y'all need to have a chat. Not sure if you saw my last post about updating MBAM and running it again. It should remove this pest, but if it doesn't, we'll break out a bigger hammer. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-03-2009, 11:28 PM	#16 (permalink)
Kay27 Registered User Join Date: Oct 2009 Posts: 12 OS: Windows XP	Re: Please help with malware situation Yes we do. I went to start, programs, MBAM, but when I open it, it closes after a couple seconds of the window opening. I even tried uninstalling it and reinstalling, but still have the same problem. Can't run a scan.

11-03-2009, 11:30 PM	#17 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,501 OS: 2000 Pro; XP Pro; XP Home	Re: Please help with malware situation Stand by. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-03-2009, 11:32 PM	#18 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,501 OS: 2000 Pro; XP Pro; XP Home	Re: Please help with malware situation Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. Open notepad and copy/paste the text in the quotebox below into it: Code: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/426707-please-help-malware-situation.html#post2425336 File:: c:\windows\SET9A.tmp c:\windows\SET97.tmp Folder:: c:\Program Files\Common Files\AlphaAVUninstall c:\Program Files\AlphaAV Collect:: c:\program files\alphaav\alpha.exe c:\windows\system32\AdvancedIEupdate.dll Comment:: End Copy Here Save this as CFScript.txt Referring to the picture above, drag CFScript.txt into ComboFix.exe ComboFix may request an update; please allow it. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Note When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. Please let me know if the file was successfully submitted . Thanks. ------------------------------------------------------ Ensure your AntiVirus and AntiSpyware applications are re-enabled. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-04-2009, 12:10 AM	#19 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,501 OS: 2000 Pro; XP Pro; XP Home	Re: Please help with malware situation I see the files have been uploaded. See if you can now run MBAM again, update it if so, run a full system scan with it. Something else I should ask...these other users of the machine, do they have their own accounts, or do you all use the same user account? If there are multiple user accounts on the machine, I should review DDS logs from the other accounts as well. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-04-2009, 07:53 AM	#20 (permalink)
Kay27 Registered User Join Date: Oct 2009 Posts: 12 OS: Windows XP	Re: Please help with malware situation The CFScript file got rid of the AlphaAV and I was able to run MBAM which detected 11 threats and got removed them. There is only one general account which everyone who uses the machine logs on to.