Comsvcs32.dll virus..2nd attempt..Correct logs.

So_X_PLicit · 02-05-2010, 08:00 PM

Hello, this is my 2nd time posting this.. My appologies to tetonbob for bumpin my first thread after only 4 hours, i appreciate the time you guys take to help others and i should wait more patiently this time.

I was hoping i can be helped to resolve this little issue i have on my computer.

Everytime i boot up my pc, i get an error that reads "Windows/system32/comsvcs.dll is either not designed to run on windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support" , also appears when i try and run any other program or even internet explorer. Im running widows vista

No windows or boot cd's. Flyer states i can restore my system without disks through harddrive. hopefully this isnt needed

Here are the requested logs:

DDS (Ver_09-12-01.01) - NTFSx86
Run by mario at 19:05:44.62 on Fri 02/05/2010
Internet Explorer: 8.0.6001.18882
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.2092 [GMT -8:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\DllHost.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Users\mario\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.8.0.41\IPSBHO.DLL
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [OnScreenDisplay] c:\program files\hewlett-packard\hp quicktouch\HPKBDAPP.exe
mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" update "software\cyberlink\youcam\1.0"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [WAWifiMessage] c:\program files\hewlett-packard\hp wireless assistant\WiFiMsg.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_02\bin\jusched.exe"
mRun: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\lumixs~1.lnk - c:\program files\panasonic\lumixsimpleviewer\PhLeAutoRun.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.8.0.41\CoIEPlg.dll
AppInit_DLLs: c:\windows\system32\comsvcs32.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-2-4 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-2-4 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-2-4 482432]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100204.001\IDSvix86.sys [2010-2-5 343088]
R2 N360;Norton 360;c:\program files\norton 360\engine\3.8.0.41\ccSvcHst.exe [2010-2-4 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-11-13 102448]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\n360\0308000.029\symndisv.sys [2010-2-4 48688]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\system32\drivers\swnc8u56.sys [2008-8-8 101248]
S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\system32\drivers\swumx56.sys [2008-8-8 73856]

=============== Created Last 30 ================

2010-02-06 02:45:52 407439500 ----a-w- c:\windows\MEMORY.DMP
2010-02-05 20:21:47 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-05 19:54:11 0 d-----w- c:\program files\Trend Micro
2010-02-05 05:14:52 0 d-----w- C:\$AVG
2010-02-05 05:13:14 0 d-----w- c:\program files\AVG
2010-02-05 05:13:04 0 d-----w- c:\programdata\avg9
2010-02-05 03:01:38 0 d-----w- c:\program files\iPod
2010-02-05 03:01:35 0 d-----w- c:\program files\iTunes
2010-02-05 02:46:05 0 d-----w- c:\programdata\Office Genuine Advantage
2010-02-05 00:46:06 0 d-----r- c:\program files\Norton Support
2010-02-05 00:42:38 65536 --sha-w- c:\users\mario\ntuser.dat{0b7beee8-11ee-11df-a8ca-001e68851c74}.TM.blf
2010-02-05 00:42:38 524288 --sha-w- c:\users\mario\ntuser.dat{0b7beee8-11ee-11df-a8ca-001e68851c74}.TMContainer00000000000000000002.regtrans-ms
2010-02-05 00:42:38 524288 --sha-w- c:\users\mario\ntuser.dat{0b7beee8-11ee-11df-a8ca-001e68851c74}.TMContainer00000000000000000001.regtrans-ms
2010-02-04 22:54:37 0 d-----w- c:\users\mario\appdata\roaming\Malwarebytes
2010-02-04 22:54:32 0 d-----w- c:\programdata\Malwarebytes
2010-02-04 22:54:32 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-04 21:54:01 0 d-----w- c:\programdata\WindowsSearch
2010-01-20 09:12:24 1372 ----a-w- c:\users\mario\appdata\roaming\NU5agc4.vbs
2010-01-20 09:12:01 1372 ----a-w- c:\users\mario\appdata\roaming\H0gjVwzrvQy1v5Z.vbs
2010-01-20 05:31:13 1372 ----a-w- c:\users\mario\appdata\roaming\CJk2Lfd.vbs
2010-01-20 05:31:12 1372 ----a-w- c:\users\mario\appdata\roaming\NbQVnxV.vbs
2010-01-19 21:47:31 1372 ----a-w- c:\users\mario\appdata\roaming\I7xeKdb.vbs
2010-01-19 21:47:23 1372 ----a-w- c:\users\mario\appdata\roaming\ZG53kmsq7VR1J.vbs
2010-01-18 10:57:22 1372 ----a-w- c:\users\mario\appdata\roaming\7LcPK8jUxMyJK.vbs
2010-01-18 10:57:20 1372 ----a-w- c:\users\mario\appdata\roaming\XOzJXoWGr9yZKnw.vbs
2010-01-18 09:05:21 1372 ----a-w- c:\users\mario\appdata\roaming\xdUME.vbs
2010-01-18 09:05:18 1372 ----a-w- c:\users\mario\appdata\roaming\uqiM7i6.vbs
2010-01-16 04:28:19 1372 ----a-w- c:\users\mario\appdata\roaming\o67zODBTDIP3T.vbs
2010-01-16 04:28:16 1372 ----a-w- c:\users\mario\appdata\roaming\2pRfQ.vbs
2010-01-14 22:42:38 1372 ----a-w- c:\users\mario\appdata\roaming\O8EkshgpBtAW6.vbs
2010-01-14 22:42:24 1372 ----a-w- c:\users\mario\appdata\roaming\dvlXanW5hRHbrMY.vbs
2010-01-14 09:25:02 1372 ----a-w- c:\users\mario\appdata\roaming\hl4ehCR.vbs
2010-01-14 09:24:58 1372 ----a-w- c:\users\mario\appdata\roaming\8M64v.vbs
2010-01-13 05:40:51 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 05:40:50 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-01-13 05:34:51 1372 ----a-w- c:\users\mario\appdata\roaming\8hebDNf4ZBplT.vbs
2010-01-09 20:24:04 1372 ----a-w- c:\users\mario\appdata\roaming\P3K3K.vbs
2010-01-09 20:23:46 1372 ----a-w- c:\users\mario\appdata\roaming\04AVJ.vbs
2010-01-09 08:34:12 1372 ----a-w- c:\users\mario\appdata\roaming\kJRfHpc.vbs
2010-01-09 08:33:56 1372 ----a-w- c:\users\mario\appdata\roaming\ygQhUdb65Snyv.vbs

==================== Find3M ====================

2010-02-05 20:02:32 86016 ----a-w- c:\windows\inf\infpub.dat
2010-02-05 20:02:32 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-02-05 20:02:32 143360 ----a-w- c:\windows\inf\infstor.dat
2010-02-05 01:18:09 122880 ------w- c:\windows\system32\comsvcs32.dll
2010-02-04 22:31:00 27839 ----a-w- c:\programdata\nvModes.dat
2010-01-03 11:02:44 1372 ----a-w- c:\users\mario\appdata\roaming\dZvHt8v.vbs
2010-01-02 06:38:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32:33 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32:33 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57:00 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-16 23:08:08 77351 ----a-w- c:\windows\hpqins05.dat
2009-11-16 21:55:05 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-15 01:45:26 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-11-14 03:15:57 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2009-11-10 09:43:10 1126 ----a-w- c:\users\mario\appdata\roaming\wklnhst.dat
2009-11-09 12:31:42 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 12:30:03 30720 ----a-w- c:\windows\system32\httpapi.dll
2008-01-21 02:43:21 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 19:07:40.97 ===============

tetonbob · 02-07-2010, 08:52 AM

Hello again. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

---------------------------------------------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum.

---------------------------------------------------------------------------------------------

Please visit this webpage for download links, and instructions for running combofix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

You can get help on disabling your protection programs here

Please include the C:\ComboFix.txt in your next reply for further review.

So_X_PLicit · 02-07-2010, 02:16 PM

Havent received the error after running combo fix.

Heres my log:

ComboFix 10-02-07.05 - mario 02/07/2010 14:01:04.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1893 [GMT -8:00]
Running from: c:\users\mario\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2695667671-3800818802-3671548774-1001
c:\$recycle.bin\S-1-5-21-2695667671-3800818802-3671548774-500
c:\$recycle.bin\S-1-5-21-4032420410-2436607233-278619374-500
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
c:\users\mario\AppData\Local\Microsoft\Windows\Temporary Internet Files\80c39984-be4f-20f4-5457-afc6fcec2400
c:\users\mario\AppData\Local\Microsoft\Windows\Temporary Internet Files\ae33e1ea-a038-df24-ae14-0ad9b26b644b
c:\users\mario\AppData\Local\Microsoft\Windows\Temporary Internet Files\FB6F.tmp
c:\users\mario\AppData\Roaming\02000000caba23ec724C.manifest
c:\users\mario\AppData\Roaming\02000000caba23ec724O.manifest
c:\users\mario\AppData\Roaming\02000000caba23ec724P.manifest
c:\users\mario\AppData\Roaming\02000000caba23ec724S.manifest
c:\users\mario\AppData\Roaming\SystemProc
c:\windows\system32\14447fb4-cae3-9a7e-b5ea-0aa15a09dcbe.exe
c:\windows\system32\KBL.LOG

.
((((((((((((((((((((((((( Files Created from 2010-01-07 to 2010-02-07 )))))))))))))))))))))))))))))))
.

2010-02-07 22:08 . 2010-02-07 22:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-05 23:41 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSvix86.sys
2010-02-05 23:41 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSXpx86.sys
2010-02-05 23:41 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\Scxpx86.dll
2010-02-05 23:41 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSxpx86.dll
2010-02-05 23:41 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSviA64.sys
2010-02-05 20:21 . 2010-01-14 19:12 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-05 19:54 . 2010-02-05 19:54 -------- d-----w- c:\program files\Trend Micro
2010-02-05 10:59 . 2010-02-05 10:59 84912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\naveng.sys
2010-02-05 10:59 . 2010-02-05 10:59 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\eeCtrl.sys
2010-02-05 10:59 . 2010-02-05 10:59 2747440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\cceraser.dll
2010-02-05 10:59 . 2010-02-05 10:59 259440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\ecmsvr32.dll
2010-02-05 10:59 . 2010-02-05 10:59 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\naveng32.dll
2010-02-05 10:59 . 2010-02-05 10:59 1647984 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\navex32a.dll
2010-02-05 10:59 . 2010-02-05 10:59 1324720 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\navex15.sys
2010-02-05 10:59 . 2010-02-05 10:59 102448 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\eraser.sys
2010-02-05 05:14 . 2010-02-05 05:14 -------- d-----w- C:\$AVG
2010-02-05 05:13 . 2010-02-05 05:13 -------- d-----w- c:\program files\AVG
2010-02-05 05:13 . 2010-02-05 20:10 -------- d-----w- c:\programdata\avg9
2010-02-05 03:01 . 2010-02-05 03:01 -------- d-----w- c:\program files\iPod
2010-02-05 03:01 . 2010-02-05 03:02 -------- d-----w- c:\program files\iTunes
2010-02-05 02:58 . 2010-02-05 02:58 -------- d-----w- c:\program files\QuickTime
2010-02-05 02:55 . 2010-02-05 02:55 72488 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-05 02:46 . 2010-02-05 02:46 -------- d-----w- c:\programdata\Office Genuine Advantage
2010-02-05 00:46 . 2010-02-05 00:46 -------- d-----r- c:\program files\Norton Support
2010-02-05 00:45 . 2010-02-05 00:45 -------- d-----w- c:\users\mario\AppData\Local\Symantec
2010-02-04 22:54 . 2010-02-04 22:54 -------- d-----w- c:\users\mario\AppData\Roaming\Malwarebytes
2010-02-04 22:54 . 2010-02-06 03:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-04 22:54 . 2010-02-04 22:54 -------- d-----w- c:\programdata\Malwarebytes
2010-02-04 21:54 . 2010-02-04 21:54 -------- d-----w- c:\programdata\WindowsSearch
2010-02-02 09:15 . 2010-02-04 23:54 -------- d-----w- c:\users\mario\AppData\Local\ijdffl
2010-01-20 05:55 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\Scxpx86.dll
2010-01-20 05:55 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSvix86.sys
2010-01-20 05:55 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSXpx86.sys
2010-01-20 05:55 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSxpx86.dll
2010-01-20 05:55 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSviA64.sys
2010-01-18 09:08 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\Scxpx86.dll
2010-01-18 09:08 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSvix86.sys
2010-01-18 09:08 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSXpx86.sys
2010-01-18 09:08 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSxpx86.dll
2010-01-18 09:08 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSviA64.sys
2010-01-13 05:40 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 05:40 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-06 04:02 . 2008-06-14 15:59 1076 ----a-w- c:\windows\bthservsdp.dat
2010-02-05 03:50 . 2009-06-15 05:43 -------- d-----w- c:\users\mario\AppData\Roaming\LimeWire
2010-02-05 03:40 . 2009-11-16 22:55 -------- d-----w- c:\users\mario\AppData\Roaming\HpUpdate
2010-02-05 03:17 . 2009-11-14 14:51 -------- d-----w- c:\program files\Microsoft
2010-02-05 03:01 . 2008-07-23 05:12 -------- d-----w- c:\program files\Common Files\Apple
2010-02-05 01:18 . 2010-01-03 11:02 122880 ------w- c:\windows\system32\comsvcs32.dll
2010-02-05 00:24 . 2008-07-22 08:25 7620 ----a-w- c:\users\mario\AppData\Local\d3d9caps.dat
2010-02-04 22:31 . 2009-03-20 06:44 27839 ----a-w- c:\programdata\nvModes.dat
2010-01-29 00:30 . 2009-11-22 08:09 -------- d-----w- c:\program files\Google
2010-01-20 09:12 . 2010-01-20 09:12 1372 ----a-w- c:\users\mario\AppData\Roaming\NU5agc4.vbs
2010-01-20 09:12 . 2010-01-20 09:12 1372 ----a-w- c:\users\mario\AppData\Roaming\H0gjVwzrvQy1v5Z.vbs
2010-01-20 06:31 . 2008-07-23 05:15 -------- d-----w- c:\users\mario\AppData\Roaming\Apple Computer
2010-01-20 05:44 . 2008-04-25 02:04 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-20 05:31 . 2010-01-20 05:31 1372 ----a-w- c:\users\mario\AppData\Roaming\CJk2Lfd.vbs
2010-01-20 05:31 . 2010-01-20 05:31 1372 ----a-w- c:\users\mario\AppData\Roaming\NbQVnxV.vbs
2010-01-20 05:20 . 2009-11-14 19:11 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-19 21:47 . 2010-01-19 21:47 1372 ----a-w- c:\users\mario\AppData\Roaming\I7xeKdb.vbs
2010-01-19 21:47 . 2010-01-19 21:47 1372 ----a-w- c:\users\mario\AppData\Roaming\ZG53kmsq7VR1J.vbs
2010-01-18 10:57 . 2010-01-18 10:57 1372 ----a-w- c:\users\mario\AppData\Roaming\7LcPK8jUxMyJK.vbs
2010-01-18 10:57 . 2010-01-18 10:57 1372 ----a-w- c:\users\mario\AppData\Roaming\XOzJXoWGr9yZKnw.vbs
2010-01-18 09:05 . 2010-01-18 09:05 1372 ----a-w- c:\users\mario\AppData\Roaming\xdUME.vbs
2010-01-18 09:05 . 2010-01-18 09:05 1372 ----a-w- c:\users\mario\AppData\Roaming\uqiM7i6.vbs
2010-01-16 04:28 . 2010-01-16 04:28 1372 ----a-w- c:\users\mario\AppData\Roaming\o67zODBTDIP3T.vbs
2010-01-16 04:28 . 2010-01-16 04:28 1372 ----a-w- c:\users\mario\AppData\Roaming\2pRfQ.vbs
2010-01-14 22:42 . 2010-01-14 22:42 1372 ----a-w- c:\users\mario\AppData\Roaming\O8EkshgpBtAW6.vbs
2010-01-14 22:42 . 2010-01-14 22:42 1372 ----a-w- c:\users\mario\AppData\Roaming\dvlXanW5hRHbrMY.vbs
2010-01-14 09:25 . 2010-01-14 09:25 1372 ----a-w- c:\users\mario\AppData\Roaming\hl4ehCR.vbs
2010-01-14 09:24 . 2010-01-14 09:24 1372 ----a-w- c:\users\mario\AppData\Roaming\8M64v.vbs
2010-01-13 10:13 . 2008-04-25 01:58 -------- d-----w- c:\programdata\Microsoft Help
2010-01-13 10:13 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-13 05:34 . 2010-01-13 05:34 1372 ----a-w- c:\users\mario\AppData\Roaming\8hebDNf4ZBplT.vbs
2010-01-09 20:24 . 2010-01-09 20:24 1372 ----a-w- c:\users\mario\AppData\Roaming\P3K3K.vbs
2010-01-09 20:23 . 2010-01-09 20:23 1372 ----a-w- c:\users\mario\AppData\Roaming\04AVJ.vbs
2010-01-09 08:34 . 2010-01-09 08:34 1372 ----a-w- c:\users\mario\AppData\Roaming\kJRfHpc.vbs
2010-01-09 08:33 . 2010-01-09 08:33 1372 ----a-w- c:\users\mario\AppData\Roaming\ygQhUdb65Snyv.vbs
2010-01-03 11:02 . 2010-01-03 11:02 1372 ----a-w- c:\users\mario\AppData\Roaming\dZvHt8v.vbs
2010-01-02 06:38 . 2010-02-05 02:35 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-02-05 02:35 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-02-05 02:35 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-02-05 02:35 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-25 07:29 . 2009-11-25 07:29 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb3780.tmp.exe
2009-11-22 08:10 . 2009-11-22 08:10 471664 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb3982.tmp.exe
2009-11-17 08:14 . 2008-07-21 07:49 104728 ----a-w- c:\users\mario\AppData\Local\GDIPFONTCACHEV1.DAT
2009-11-16 23:08 . 2009-11-16 23:05 77351 ----a-w- c:\windows\hpqins05.dat
2009-11-16 21:55 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-14 19:46 . 2009-11-14 19:46 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2009-11-14 03:17 . 2009-11-14 01:06 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-11-14 03:15 . 2009-11-14 03:18 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-11-14 03:15 . 2009-11-14 03:18 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2009-11-14 00:47 . 2009-11-14 00:47 1290592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2009-11-14 00:47 . 2009-11-14 00:47 136840 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2009-11-14 00:47 . 2009-11-14 00:47 796016 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2009-11-10 09:43 . 2009-07-30 21:13 1126 ----a-w- c:\users\mario\AppData\Roaming\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-24 455968]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-22 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-12-20 468264]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 218408]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2008-8-14 63696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-27 00:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):45,4f,5a,29,9d,65,ca,01

R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\N360\0308000.029\SymEFA.sys [2/4/2010 6:55 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\N360\0308000.029\BHDrvx86.sys [2/4/2010 6:55 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\N360\0308000.029\cchpx86.sys [2/4/2010 6:55 PM 482432]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSvix86.sys [2/5/2010 3:41 PM 343088]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [2/4/2010 6:55 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/13/2009 1:00 AM 102448]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\N360\0308000.029\symndisv.sys [2/4/2010 6:55 PM 48688]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [1/20/2008 6:23 PM 21504]
S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\System32\drivers\swnc8u56.sys [8/8/2008 8:46 PM 101248]
S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\System32\drivers\swumx56.sys [8/8/2008 8:46 PM 73856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-24 00:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-28 c:\windows\Tasks\HPCeeScheduleFormario.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2008-04-25 18:58]

2026-11-09 c:\windows\Tasks\User_Feed_Synchronization-{86F74A44-742A-4105-B3D6-9610C84AC8ED}.job
- c:\windows\system32\msfeedssync.exe [2010-02-05 04:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe
MSConfigStartUp-15102514 - c:\programdata\15102514\15102514.exe
MSConfigStartUp-60227623 - c:\programdata\60227623\60227623.exe
AddRemove-14447fb4-cae3-9a7e-b5ea-0aa15a09dcbe - c:\windows\system32\14447fb4-cae3-9a7e-b5ea-0aa15a09dcbe.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 14:08
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-02-07 14:12:10
ComboFix-quarantined-files.txt 2010-02-07 22:12

Pre-Run: 145,695,100,928 bytes free
Post-Run: 146,136,281,088 bytes free

- - End Of File - - 5126D318D8F6F3129213D33D95810631

tetonbob · 02-07-2010, 02:32 PM

Please visit this site:

http://www.bleepingcomputer.com/subm...php?channel=28
In the Link to topic where this file was requested: area, copy and paste this

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/459300-comsvcs32-dll-virus-2nd-attempt-correct-logs.html#post2584208
In the Browse to the file you want to submit: area, copy and paste this

c:\users\mario\AppData\Roaming\dvlXanW5hRHbrMY.vbs
Then click Send File.
Once it shows:

Quote:

Your file was successfully submitted. Please let the user helping you know that you have submitted the file.
Close the site and continue with the steps below.

Please go to: VirusTotal

On the page you'll find a "Browse" button.
Next to the browse button you'll see a box to enter text.
Please copy/paste the following:

c:\windows\system32\comsvcs32.dll
Then click the "Send File " button just below.
This will scan the file. Please be patient.
If you get a message saying File has already been analyzed: click Reanalyze file now
Once scanned, copy and paste the link to the results page in your next reply.
Please repeat for the following files:
- c:\programdata\Google\Google Toolbar\Update\gtb3780.tmp.exe

So_X_PLicit · 02-07-2010, 02:56 PM

file submitted

http://www.virustotal.com/analisis/6...625-1265583053

http://www.virustotal.com/analisis/2...916-1265583264

tetonbob · 02-07-2010, 04:55 PM

Hi -

Can you also upload these files

c:\windows\system32\comsvcs32.dll

c:\users\mario\AppData\Roaming\04AVJ.vbs

to this site

http://www.bleepingcomputer.com/subm...php?channel=28

Do you have know what's created all those randomly named .vbs files 1372bytes in size? Seem like firewall/networking rules to me, but any info you can provide would be helpful.

So_X_PLicit · 02-07-2010, 05:44 PM

Files have been uploaded.

I dont know what created these files because this is my cousins computer. He was complaining that "Antivirus Soft" was in his system and wouldnt let him do anything, and before that, when he would open the internet, multiple tabs and pop-ups for school ads would appear.

He gave me his pc to be looked at and after a system restore, this was the next problem, ran malwarebytes before resorting to asking for help. Malware did delete some stuff, dont remember wgat, but this problem continued so then thats when i came to you guys

tetonbob · 02-07-2010, 06:54 PM

Ok, thanks. I can't see any reason for those files to remain on the machine, so we're going to delete them with ComboFix. The .dll is not a PE file, and of little use. The .vbs are identical. They will for a time be on the machine in quarantine. Should any application complain about missing files, let me know.

Next steps...

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

DirLook::
c:\users\mario\AppData\Local\ijdffl
File::
c:\windows\system32\comsvcs32.dll
c:\users\mario\AppData\Roaming\NU5agc4.vbs
c:\users\mario\AppData\Roaming\H0gjVwzrvQy1v5Z.vbs
c:\users\mario\AppData\Roaming\Apple Computer
c:\users\mario\AppData\Roaming\CJk2Lfd.vbs
c:\users\mario\AppData\Roaming\NbQVnxV.vbs
c:\users\mario\AppData\Roaming\I7xeKdb.vbs
c:\users\mario\AppData\Roaming\ZG53kmsq7VR1J.vbs
c:\users\mario\AppData\Roaming\7LcPK8jUxMyJK.vbs
c:\users\mario\AppData\Roaming\XOzJXoWGr9yZKnw.vbs
c:\users\mario\AppData\Roaming\xdUME.vbs
c:\users\mario\AppData\Roaming\uqiM7i6.vbs
c:\users\mario\AppData\Roaming\o67zODBTDIP3T.vbs
c:\users\mario\AppData\Roaming\2pRfQ.vbs
c:\users\mario\AppData\Roaming\O8EkshgpBtAW6.vbs
c:\users\mario\AppData\Roaming\dvlXanW5hRHbrMY.vbs
c:\users\mario\AppData\Roaming\hl4ehCR.vbs
c:\users\mario\AppData\Roaming\8M64v.vbs
c:\users\mario\AppData\Roaming\8hebDNf4ZBplT.vbs
c:\users\mario\AppData\Roaming\P3K3K.vbs
c:\users\mario\AppData\Roaming\04AVJ.vbs
c:\users\mario\AppData\Roaming\kJRfHpc.vbs
c:\users\mario\AppData\Roaming\ygQhUdb65Snyv.vbs
c:\users\mario\AppData\Roaming\dZvHt8v.vbs

Save this as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

ComboFix may request an update; please allow it.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

---------------------------------------------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

---------------------------------------------------------------------------------------------

So_X_PLicit · 02-07-2010, 07:22 PM

Here you go

ComboFix 10-02-07.06 - mario 02/07/2010 19:07:48.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1855 [GMT -8:00]
Running from: c:\users\mario\Desktop\ComboFix.exe
Command switches used :: c:\users\mario\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\users\mario\AppData\Roaming\04AVJ.vbs"
"c:\users\mario\AppData\Roaming\2pRfQ.vbs"
"c:\users\mario\AppData\Roaming\7LcPK8jUxMyJK.vbs"
"c:\users\mario\AppData\Roaming\8hebDNf4ZBplT.vbs"
"c:\users\mario\AppData\Roaming\8M64v.vbs"
"c:\users\mario\AppData\Roaming\Apple Computer"
"c:\users\mario\AppData\Roaming\CJk2Lfd.vbs"
"c:\users\mario\AppData\Roaming\dvlXanW5hRHbrMY.vbs"
"c:\users\mario\AppData\Roaming\dZvHt8v.vbs"
"c:\users\mario\AppData\Roaming\H0gjVwzrvQy1v5Z.vbs"
"c:\users\mario\AppData\Roaming\hl4ehCR.vbs"
"c:\users\mario\AppData\Roaming\I7xeKdb.vbs"
"c:\users\mario\AppData\Roaming\kJRfHpc.vbs"
"c:\users\mario\AppData\Roaming\NbQVnxV.vbs"
"c:\users\mario\AppData\Roaming\NU5agc4.vbs"
"c:\users\mario\AppData\Roaming\o67zODBTDIP3T.vbs"
"c:\users\mario\AppData\Roaming\O8EkshgpBtAW6.vbs"
"c:\users\mario\AppData\Roaming\P3K3K.vbs"
"c:\users\mario\AppData\Roaming\uqiM7i6.vbs"
"c:\users\mario\AppData\Roaming\xdUME.vbs"
"c:\users\mario\AppData\Roaming\XOzJXoWGr9yZKnw.vbs"
"c:\users\mario\AppData\Roaming\ygQhUdb65Snyv.vbs"
"c:\users\mario\AppData\Roaming\ZG53kmsq7VR1J.vbs"
"c:\windows\system32\comsvcs32.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\mario\AppData\Roaming\04AVJ.vbs
c:\users\mario\AppData\Roaming\2pRfQ.vbs
c:\users\mario\AppData\Roaming\7LcPK8jUxMyJK.vbs
c:\users\mario\AppData\Roaming\8hebDNf4ZBplT.vbs
c:\users\mario\AppData\Roaming\8M64v.vbs
c:\users\mario\AppData\Roaming\CJk2Lfd.vbs
c:\users\mario\AppData\Roaming\dvlXanW5hRHbrMY.vbs
c:\users\mario\AppData\Roaming\dZvHt8v.vbs
c:\users\mario\AppData\Roaming\H0gjVwzrvQy1v5Z.vbs
c:\users\mario\AppData\Roaming\hl4ehCR.vbs
c:\users\mario\AppData\Roaming\I7xeKdb.vbs
c:\users\mario\AppData\Roaming\kJRfHpc.vbs
c:\users\mario\AppData\Roaming\NbQVnxV.vbs
c:\users\mario\AppData\Roaming\NU5agc4.vbs
c:\users\mario\AppData\Roaming\o67zODBTDIP3T.vbs
c:\users\mario\AppData\Roaming\O8EkshgpBtAW6.vbs
c:\users\mario\AppData\Roaming\P3K3K.vbs
c:\users\mario\AppData\Roaming\uqiM7i6.vbs
c:\users\mario\AppData\Roaming\xdUME.vbs
c:\users\mario\AppData\Roaming\XOzJXoWGr9yZKnw.vbs
c:\users\mario\AppData\Roaming\ygQhUdb65Snyv.vbs
c:\users\mario\AppData\Roaming\ZG53kmsq7VR1J.vbs
c:\windows\system32\comsvcs32.dll

.
((((((((((((((((((((((((( Files Created from 2010-01-08 to 2010-02-08 )))))))))))))))))))))))))))))))
.

2010-02-08 03:14 . 2010-02-08 03:14 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-02-08 03:14 . 2010-02-08 03:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-08 01:27 . 2010-02-08 01:26 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-08 01:14 . 2010-02-08 01:14 -------- d-----w- c:\users\mario\AppData\Local\Mozilla
2010-02-08 01:13 . 2010-02-05 02:55 554352 ----a-r- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2010-02-08 01:05 . 2010-02-05 10:59 84912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100207.021\NAVENG.SYS
2010-02-08 01:05 . 2010-02-05 10:59 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100207.021\EECTRL.SYS
2010-02-08 01:05 . 2010-02-05 10:59 2747440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100207.021\CCERASER.DLL
2010-02-08 01:05 . 2010-02-05 10:59 259440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100207.021\ECMSVR32.DLL
2010-02-08 01:05 . 2010-02-05 10:59 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100207.021\NAVENG32.DLL
2010-02-08 01:05 . 2010-02-05 10:59 1647984 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100207.021\NAVEX32A.DLL
2010-02-08 01:05 . 2010-02-05 10:59 1324720 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100207.021\NAVEX15.SYS
2010-02-08 01:05 . 2010-02-05 10:59 102448 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100207.021\ERASER.SYS
2010-02-05 23:41 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSvix86.sys
2010-02-05 23:41 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSXpx86.sys
2010-02-05 23:41 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\Scxpx86.dll
2010-02-05 23:41 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSxpx86.dll
2010-02-05 23:41 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSviA64.sys
2010-02-05 20:21 . 2010-01-14 19:12 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-05 19:54 . 2010-02-05 19:54 -------- d-----w- c:\program files\Trend Micro
2010-02-05 05:14 . 2010-02-05 05:14 -------- d-----w- C:\$AVG
2010-02-05 05:13 . 2010-02-05 05:13 -------- d-----w- c:\program files\AVG
2010-02-05 05:13 . 2010-02-05 20:10 -------- d-----w- c:\programdata\avg9
2010-02-05 03:01 . 2010-02-05 03:01 -------- d-----w- c:\program files\iPod
2010-02-05 03:01 . 2010-02-05 03:02 -------- d-----w- c:\program files\iTunes
2010-02-05 02:58 . 2010-02-05 02:58 -------- d-----w- c:\program files\QuickTime
2010-02-05 02:55 . 2010-02-05 02:55 72488 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-05 02:55 . 2009-08-22 08:14 165240 ----a-r- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2010-02-05 02:46 . 2010-02-05 02:46 -------- d-----w- c:\programdata\Office Genuine Advantage
2010-02-05 00:46 . 2010-02-05 00:46 -------- d-----r- c:\program files\Norton Support
2010-02-05 00:45 . 2010-02-05 00:45 -------- d-----w- c:\users\mario\AppData\Local\Symantec
2010-02-04 22:54 . 2010-02-04 22:54 -------- d-----w- c:\users\mario\AppData\Roaming\Malwarebytes
2010-02-04 22:54 . 2010-02-06 03:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-04 22:54 . 2010-02-04 22:54 -------- d-----w- c:\programdata\Malwarebytes
2010-02-04 21:54 . 2010-02-04 21:54 -------- d-----w- c:\programdata\WindowsSearch
2010-02-02 09:15 . 2010-02-04 23:54 -------- d-----w- c:\users\mario\AppData\Local\ijdffl
2010-01-20 05:55 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\Scxpx86.dll
2010-01-20 05:55 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSvix86.sys
2010-01-20 05:55 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSXpx86.sys
2010-01-20 05:55 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSxpx86.dll
2010-01-20 05:55 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSviA64.sys
2010-01-18 09:08 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\Scxpx86.dll
2010-01-18 09:08 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSvix86.sys
2010-01-18 09:08 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSXpx86.sys
2010-01-18 09:08 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSxpx86.dll
2010-01-18 09:08 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSviA64.sys
2010-01-13 05:40 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 05:40 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-08 01:27 . 2008-04-25 02:26 -------- d-----w- c:\program files\Common Files\Java
2010-02-08 01:25 . 2008-04-25 02:26 -------- d-----w- c:\program files\Java
2010-02-08 01:20 . 2008-06-14 15:59 1076 ----a-w- c:\windows\bthservsdp.dat
2010-02-08 01:03 . 2009-11-16 22:55 -------- d-----w- c:\users\mario\AppData\Roaming\HpUpdate
2010-02-05 03:50 . 2009-06-15 05:43 -------- d-----w- c:\users\mario\AppData\Roaming\LimeWire
2010-02-05 03:17 . 2009-11-14 14:51 -------- d-----w- c:\program files\Microsoft
2010-02-05 03:01 . 2008-07-23 05:12 -------- d-----w- c:\program files\Common Files\Apple
2010-02-05 00:24 . 2008-07-22 08:25 7620 ----a-w- c:\users\mario\AppData\Local\d3d9caps.dat
2010-02-04 22:31 . 2009-03-20 06:44 27839 ----a-w- c:\programdata\nvModes.dat
2010-01-29 00:30 . 2009-11-22 08:09 -------- d-----w- c:\program files\Google
2010-01-20 06:31 . 2008-07-23 05:15 -------- d-----w- c:\users\mario\AppData\Roaming\Apple Computer
2010-01-20 05:44 . 2008-04-25 02:04 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-20 05:20 . 2009-11-14 19:11 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-13 10:13 . 2008-04-25 01:58 -------- d-----w- c:\programdata\Microsoft Help
2010-01-13 10:13 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-02 06:38 . 2010-02-05 02:35 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-02-05 02:35 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-02-05 02:35 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-02-05 02:35 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-25 07:29 . 2009-11-25 07:29 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb3780.tmp.exe
2009-11-22 08:10 . 2009-11-22 08:10 471664 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb3982.tmp.exe
2009-11-17 08:14 . 2008-07-21 07:49 104728 ----a-w- c:\users\mario\AppData\Local\GDIPFONTCACHEV1.DAT
2009-11-16 23:08 . 2009-11-16 23:05 77351 ----a-w- c:\windows\hpqins05.dat
2009-11-16 21:55 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-14 19:46 . 2009-11-14 19:46 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2009-11-14 03:17 . 2009-11-14 01:06 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-11-14 03:15 . 2009-11-14 03:18 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-11-14 03:15 . 2009-11-14 03:18 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2009-11-14 00:47 . 2009-11-14 00:47 1290592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2009-11-14 00:47 . 2009-11-14 00:47 136840 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2009-11-14 00:47 . 2009-11-14 00:47 796016 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2009-11-10 09:43 . 2009-07-30 21:13 1126 ----a-w- c:\users\mario\AppData\Roaming\wklnhst.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\users\mario\AppData\Local\ijdffl ----

((((((((((((((((((((((((((((( SnapShot@2010-02-07_22.08.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2010-02-08 01:25 29938 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-07-21 07:33 . 2010-02-08 01:25 14238 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2695667671-3800818802-3671548774-1000_UserData.bin
- 2008-04-25 01:35 . 2010-02-05 02:38 84507 c:\windows\System32\Macromed\Flash\uninstall_activeX.exe
+ 2008-04-25 01:35 . 2010-02-08 01:28 84507 c:\windows\System32\Macromed\Flash\uninstall_activeX.exe
+ 2008-07-21 07:33 . 2010-02-08 01:22 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-07-21 07:33 . 2010-02-07 21:51 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-07-21 07:33 . 2010-02-08 01:22 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-07-21 07:33 . 2010-02-07 21:51 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-07-21 07:33 . 2010-02-07 21:51 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-07-21 07:33 . 2010-02-08 01:22 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-09-28 08:33 . 2010-02-07 21:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-09-28 08:33 . 2010-02-08 01:22 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-09-28 08:33 . 2010-02-08 01:22 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-09-28 08:33 . 2010-02-07 21:46 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-09-28 08:33 . 2010-02-08 01:22 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-09-28 08:33 . 2010-02-07 21:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-02-07 21:46 . 2010-02-07 21:46 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-02-08 01:22 . 2010-02-08 01:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-02-07 21:46 . 2010-02-07 21:46 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-02-08 01:22 . 2010-02-08 01:22 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 13:05 . 2010-02-08 01:25 102612 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 10:33 . 2010-02-08 01:27 595684 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-02-07 21:52 595684 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-02-07 21:52 101350 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2010-02-08 01:27 101350 c:\windows\System32\perfc009.dat
- 2009-10-28 03:31 . 2009-10-28 03:31 257440 c:\windows\System32\Macromed\Flash\FlashUtil10d.exe
+ 2009-11-03 00:24 . 2009-11-03 00:24 257440 c:\windows\System32\Macromed\Flash\FlashUtil10d.exe
+ 2010-02-08 01:27 . 2010-02-08 01:26 153376 c:\windows\System32\javaws.exe
+ 2010-02-08 01:26 . 2010-02-08 01:26 145184 c:\windows\System32\javaw.exe
+ 2010-02-08 01:26 . 2010-02-08 01:26 145184 c:\windows\System32\java.exe
+ 2010-02-08 01:27 . 2010-02-08 01:27 178176 c:\windows\Installer\41957.msi
+ 2010-02-08 01:26 . 2010-02-08 01:26 576000 c:\windows\Installer\41951.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-24 455968]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-22 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-12-20 468264]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 218408]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2008-8-14 63696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-27 00:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):45,4f,5a,29,9d,65,ca,01

R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\N360\0308000.029\SymEFA.sys [2/4/2010 6:55 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\N360\0308000.029\BHDrvx86.sys [2/4/2010 6:55 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\N360\0308000.029\cchpx86.sys [2/4/2010 6:55 PM 482432]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSvix86.sys [2/5/2010 3:41 PM 343088]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [2/4/2010 6:55 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/13/2009 1:00 AM 102448]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\N360\0308000.029\symndisv.sys [2/4/2010 6:55 PM 48688]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [1/20/2008 6:23 PM 21504]
S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\System32\drivers\swnc8u56.sys [8/8/2008 8:46 PM 101248]
S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\System32\drivers\swumx56.sys [8/8/2008 8:46 PM 73856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-24 00:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-28 c:\windows\Tasks\HPCeeScheduleFormario.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2008-04-25 18:58]

2026-11-09 c:\windows\Tasks\User_Feed_Synchronization-{86F74A44-742A-4105-B3D6-9610C84AC8ED}.job
- c:\windows\system32\msfeedssync.exe [2010-02-05 04:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\mario\AppData\Roaming\Mozilla\Firefox\Profiles\le7aegvj.default\
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 19:15
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-02-07 19:18:29
ComboFix-quarantined-files.txt 2010-02-08 03:18
ComboFix2.txt 2010-02-07 22:12

Pre-Run: 146,057,412,608 bytes free
Post-Run: 146,034,397,184 bytes free

- - End Of File - - 7234E55AD0F0AA4F459D4F5249CF6928

tetonbob · 02-07-2010, 07:26 PM

Looks good. Next steps...

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 18 and save it to your desktop.
Scroll down to where it says JDK 6 Update 18 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u18 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser..
Go to Start > Control Panel, click on Uninstall a Program and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name.

Java(TM) 6 Update 2
Click the Uninstall button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jjre-6u18-windows-i586.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Save it to your desktop. Malwarebytes' Anti-Malware may require a reboot to complete removals. After a reboot, if required, post that saved log in your next reply.

---------------------------------------------------------------------------------------------

So_X_PLicit · 02-07-2010, 08:09 PM

No malicious software detected

Malwarebytes' Anti-Malware 1.44
Database version: 3704
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

2/7/2010 8:08:11 PM
mbam-log-2010-02-07 (20-08-11).txt

Scan type: Quick Scan
Objects scanned: 107939
Time elapsed: 7 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

tetonbob · 02-07-2010, 08:18 PM

Great!

One final check, to help ensure nothing is lurking.

Go here to run an online scannner from ESET.

Note: You will need to use Internet explorer for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic and also let me know how things are now.

Also post new logs from DDS.

So_X_PLicit · 02-07-2010, 10:40 PM

Machine is running perfect, stable.

0 threats found

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK

DDS (Ver_09-12-01.01) - NTFSx86
Run by mario at 22:33:08.40 on Sun 02/07/2010
Internet Explorer: 8.0.6001.18882 BrowserJavaVersion: 1.6.0_18
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1878 [GMT -8:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\System32\mobsync.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\mario\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.8.0.41\IPSBHO.DLL
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [OnScreenDisplay] c:\program files\hewlett-packard\hp quicktouch\HPKBDAPP.exe
mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" update "software\cyberlink\youcam\1.0"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [WAWifiMessage] c:\program files\hewlett-packard\hp wireless assistant\WiFiMsg.exe
mRun: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\lumixs~1.lnk - c:\program files\panasonic\lumixsimpleviewer\PhLeAutoRun.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.8.0.41\CoIEPlg.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\users\mario\appdata\roaming\mozilla\firefox\profiles\le7aegvj.default\
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-2-4 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-2-4 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-2-4 482432]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100204.001\IDSvix86.sys [2010-2-5 343088]
R2 N360;Norton 360;c:\program files\norton 360\engine\3.8.0.41\ccSvcHst.exe [2010-2-4 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-11-13 102448]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\n360\0308000.029\symndisv.sys [2010-2-4 48688]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\system32\drivers\swnc8u56.sys [2008-8-8 101248]
S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\system32\drivers\swumx56.sys [2008-8-8 73856]

=============== Created Last 30 ================

2010-02-08 04:32:15 0 d-----w- c:\program files\ESET
2010-02-08 03:59:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-08 03:58:59 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-08 03:55:23 0 d-----w- c:\program files\Sun
2010-02-08 03:18:34 0 d-sh--w- C:\$RECYCLE.BIN
2010-02-08 01:27:25 0 d-----w- c:\programdata\Sun
2010-02-08 01:27:00 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-07 22:00:02 98816 ----a-w- c:\windows\sed.exe
2010-02-07 22:00:02 77312 ----a-w- c:\windows\MBR.exe
2010-02-07 22:00:02 261632 ----a-w- c:\windows\PEV.exe
2010-02-07 22:00:02 161792 ----a-w- c:\windows\SWREG.exe
2010-02-06 02:45:52 407439500 ----a-w- c:\windows\MEMORY.DMP
2010-02-05 20:21:47 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-05 19:54:11 0 d-----w- c:\program files\Trend Micro
2010-02-05 05:14:52 0 d-----w- C:\$AVG
2010-02-05 05:13:14 0 d-----w- c:\program files\AVG
2010-02-05 05:13:04 0 d-----w- c:\programdata\avg9
2010-02-05 03:01:38 0 d-----w- c:\program files\iPod
2010-02-05 03:01:35 0 d-----w- c:\program files\iTunes
2010-02-05 02:46:05 0 d-----w- c:\programdata\Office Genuine Advantage
2010-02-05 00:46:06 0 d-----r- c:\program files\Norton Support
2010-02-05 00:42:38 65536 --sha-w- c:\users\mario\ntuser.dat{0b7beee8-11ee-11df-a8ca-001e68851c74}.TM.blf
2010-02-05 00:42:38 524288 --sha-w- c:\users\mario\ntuser.dat{0b7beee8-11ee-11df-a8ca-001e68851c74}.TMContainer00000000000000000002.regtrans-ms
2010-02-05 00:42:38 524288 --sha-w- c:\users\mario\ntuser.dat{0b7beee8-11ee-11df-a8ca-001e68851c74}.TMContainer00000000000000000001.regtrans-ms
2010-02-04 22:54:37 0 d-----w- c:\users\mario\appdata\roaming\Malwarebytes
2010-02-04 22:54:32 0 d-----w- c:\programdata\Malwarebytes
2010-02-04 22:54:32 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-04 21:54:01 0 d-----w- c:\programdata\WindowsSearch
2010-01-13 05:40:51 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 05:40:50 72704 ----a-w- c:\windows\system32\fontsub.dll

==================== Find3M ====================

2010-02-05 20:02:32 86016 ----a-w- c:\windows\inf\infpub.dat
2010-02-05 20:02:32 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-02-05 20:02:32 143360 ----a-w- c:\windows\inf\infstor.dat
2010-02-04 22:31:00 27839 ----a-w- c:\programdata\nvModes.dat
2010-01-02 06:38:20 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32:33 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32:33 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57:00 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-16 23:08:08 77351 ----a-w- c:\windows\hpqins05.dat
2009-11-16 21:55:05 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-11-15 01:45:26 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-11-14 03:15:57 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2009-11-10 09:43:10 1126 ----a-w- c:\users\mario\appdata\roaming\wklnhst.dat
2008-01-21 02:43:21 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 22:33:30.68 ===============

tetonbob · 02-08-2010, 06:46 AM

Great. We should be done here. Some final housekeeping instructions, and protection information for you.

Your logs appear clean.You should be good to go. We still have a few items to address.

Adobe Reader 8.2.0 is outdated, and therefore subject to exploit. You can download the most recent version of Adobe Reader here

http://get.adobe.com/reader/

Secunia Online Software Inspector, link below, will show you if there are other outdated and insecure applications on the machine. Please use it.

======================

Disconnect from the internet and disable your AntiVirus temporarily.

Press the Windows key + R -> in the Run box which opens -> copy/paste in the following single line command & click OK

ComboFix /Uninstall

This will uninstall ComboFix. It will also implement some cleanup procedures.

Re-enable your AntiVirus now. Reconnect to the internet at your leisure.

Delete any remaining tools we've used (DDS and GMER) and logs from them.

Empty your Recycle Bin.

After malware removal, it's a good idea to flush out existing, possibly infected System Restore points, and set a new clean point with which to go forward.

Clear & Reset System Restore's Cache

Press the Windows key + R
Type or copy/paste control sysdm.cpl,,4 & press Enter
Click on Continue
Under Automatic Restore points
- Uncheck (untick) all the boxes under Create restore points automatically on the selected disks section.
- Click Turn System Restore Off.
- Click Apply
Turn System Restore back on now.
Check (tick) all the boxes under Create restore points automatically on the selected disks section.
Click OK.

============================================

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:

Microsoft Windows Update -

To update Windows, click on Start > Windows Update (or Start > All Programs > Windows Update if you are using the new Vista Start Menu). If the Windows Update is not found there, go to this link - http://update.microsoft.com/ .

This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
SpywareBlaster to help prevent spyware from installing in the first place.
- Install & update SpywareBlaster with the latest definitions.
  After you have updated, click the button - enable protection for all unprotected items
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites - green to go, yellow for caution and red to stop, helping you avoid the dangerous sites. WOT has an addon available for both Firefox and IE.
Winpatrol

Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.

You can get a free copy of Winpatrol or use the Plus version for more features.

You can read Winpatrol's FAQ if you run into problems.
MVPS HOST FILE
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

Do not install more than one AntiVirus program because they will conflict with each other.
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer
http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.

ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

So_X_PLicit · 02-08-2010, 09:56 AM

All instructions have been completed and i've read the tips.

If ever i need help again, i know where to come, but hopefully i wont have to right? lol.

Thanks for all your help, i greatly appreciate it.. You take care now.

tetonbob · 02-08-2010, 11:03 AM

Cheers, exactly so. I'm happy to have helped.

We hope through our educational links and protection information any visit to this section of the forum is a one-time event.

Surf Safely, and Think Prevention!

Since this issue is resolved, this topic will be archived.

02-07-2010, 08:52 AM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 42,349 OS: 2000 Pro; XP Pro; XP Home	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. Hello again. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. --------------------------------------------------------------------------------------------- Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum. --------------------------------------------------------------------------------------------- Please visit this webpage for download links, and instructions for running combofix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. You can get help on disabling your protection programs here Please include the C:\ComboFix.txt in your next reply for further review. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

02-07-2010, 02:16 PM	#3 (permalink)
So_X_PLicit Registered User Join Date: Feb 2010 Posts: 12 OS: Windows Vista	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. Havent received the error after running combo fix. Heres my log: ComboFix 10-02-07.05 - mario 02/07/2010 14:01:04.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3006.1893 [GMT -8:00] Running from: c:\users\mario\Desktop\ComboFix.exe SP: Windows Defender enabled (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-2695667671-3800818802-3671548774-1001 c:\$recycle.bin\S-1-5-21-2695667671-3800818802-3671548774-500 c:\$recycle.bin\S-1-5-21-4032420410-2436607233-278619374-500 c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk c:\users\mario\AppData\Local\Microsoft\Windows\Temporary Internet Files\80c39984-be4f-20f4-5457-afc6fcec2400 c:\users\mario\AppData\Local\Microsoft\Windows\Temporary Internet Files\ae33e1ea-a038-df24-ae14-0ad9b26b644b c:\users\mario\AppData\Local\Microsoft\Windows\Temporary Internet Files\FB6F.tmp c:\users\mario\AppData\Roaming\02000000caba23ec724C.manifest c:\users\mario\AppData\Roaming\02000000caba23ec724O.manifest c:\users\mario\AppData\Roaming\02000000caba23ec724P.manifest c:\users\mario\AppData\Roaming\02000000caba23ec724S.manifest c:\users\mario\AppData\Roaming\SystemProc c:\windows\system32\14447fb4-cae3-9a7e-b5ea-0aa15a09dcbe.exe c:\windows\system32\KBL.LOG . ((((((((((((((((((((((((( Files Created from 2010-01-07 to 2010-02-07 ))))))))))))))))))))))))))))))) . 2010-02-07 22:08 . 2010-02-07 22:08 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-02-05 23:41 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSvix86.sys 2010-02-05 23:41 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSXpx86.sys 2010-02-05 23:41 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\Scxpx86.dll 2010-02-05 23:41 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSxpx86.dll 2010-02-05 23:41 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSviA64.sys 2010-02-05 20:21 . 2010-01-14 19:12 181120 ------w- c:\windows\system32\MpSigStub.exe 2010-02-05 19:54 . 2010-02-05 19:54 -------- d-----w- c:\program files\Trend Micro 2010-02-05 10:59 . 2010-02-05 10:59 84912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\naveng.sys 2010-02-05 10:59 . 2010-02-05 10:59 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\eeCtrl.sys 2010-02-05 10:59 . 2010-02-05 10:59 2747440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\cceraser.dll 2010-02-05 10:59 . 2010-02-05 10:59 259440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\ecmsvr32.dll 2010-02-05 10:59 . 2010-02-05 10:59 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\naveng32.dll 2010-02-05 10:59 . 2010-02-05 10:59 1647984 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\navex32a.dll 2010-02-05 10:59 . 2010-02-05 10:59 1324720 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\navex15.sys 2010-02-05 10:59 . 2010-02-05 10:59 102448 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100205.002\eraser.sys 2010-02-05 05:14 . 2010-02-05 05:14 -------- d-----w- C:\$AVG 2010-02-05 05:13 . 2010-02-05 05:13 -------- d-----w- c:\program files\AVG 2010-02-05 05:13 . 2010-02-05 20:10 -------- d-----w- c:\programdata\avg9 2010-02-05 03:01 . 2010-02-05 03:01 -------- d-----w- c:\program files\iPod 2010-02-05 03:01 . 2010-02-05 03:02 -------- d-----w- c:\program files\iTunes 2010-02-05 02:58 . 2010-02-05 02:58 -------- d-----w- c:\program files\QuickTime 2010-02-05 02:55 . 2010-02-05 02:55 72488 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe 2010-02-05 02:46 . 2010-02-05 02:46 -------- d-----w- c:\programdata\Office Genuine Advantage 2010-02-05 00:46 . 2010-02-05 00:46 -------- d-----r- c:\program files\Norton Support 2010-02-05 00:45 . 2010-02-05 00:45 -------- d-----w- c:\users\mario\AppData\Local\Symantec 2010-02-04 22:54 . 2010-02-04 22:54 -------- d-----w- c:\users\mario\AppData\Roaming\Malwarebytes 2010-02-04 22:54 . 2010-02-06 03:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-02-04 22:54 . 2010-02-04 22:54 -------- d-----w- c:\programdata\Malwarebytes 2010-02-04 21:54 . 2010-02-04 21:54 -------- d-----w- c:\programdata\WindowsSearch 2010-02-02 09:15 . 2010-02-04 23:54 -------- d-----w- c:\users\mario\AppData\Local\ijdffl 2010-01-20 05:55 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\Scxpx86.dll 2010-01-20 05:55 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSvix86.sys 2010-01-20 05:55 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSXpx86.sys 2010-01-20 05:55 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSxpx86.dll 2010-01-20 05:55 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100119.001\IDSviA64.sys 2010-01-18 09:08 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\Scxpx86.dll 2010-01-18 09:08 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSvix86.sys 2010-01-18 09:08 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSXpx86.sys 2010-01-18 09:08 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSxpx86.dll 2010-01-18 09:08 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100116.002\IDSviA64.sys 2010-01-13 05:40 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll 2010-01-13 05:40 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-06 04:02 . 2008-06-14 15:59 1076 ----a-w- c:\windows\bthservsdp.dat 2010-02-05 03:50 . 2009-06-15 05:43 -------- d-----w- c:\users\mario\AppData\Roaming\LimeWire 2010-02-05 03:40 . 2009-11-16 22:55 -------- d-----w- c:\users\mario\AppData\Roaming\HpUpdate 2010-02-05 03:17 . 2009-11-14 14:51 -------- d-----w- c:\program files\Microsoft 2010-02-05 03:01 . 2008-07-23 05:12 -------- d-----w- c:\program files\Common Files\Apple 2010-02-05 01:18 . 2010-01-03 11:02 122880 ------w- c:\windows\system32\comsvcs32.dll 2010-02-05 00:24 . 2008-07-22 08:25 7620 ----a-w- c:\users\mario\AppData\Local\d3d9caps.dat 2010-02-04 22:31 . 2009-03-20 06:44 27839 ----a-w- c:\programdata\nvModes.dat 2010-01-29 00:30 . 2009-11-22 08:09 -------- d-----w- c:\program files\Google 2010-01-20 09:12 . 2010-01-20 09:12 1372 ----a-w- c:\users\mario\AppData\Roaming\NU5agc4.vbs 2010-01-20 09:12 . 2010-01-20 09:12 1372 ----a-w- c:\users\mario\AppData\Roaming\H0gjVwzrvQy1v5Z.vbs 2010-01-20 06:31 . 2008-07-23 05:15 -------- d-----w- c:\users\mario\AppData\Roaming\Apple Computer 2010-01-20 05:44 . 2008-04-25 02:04 -------- d-----w- c:\program files\Common Files\Adobe 2010-01-20 05:31 . 2010-01-20 05:31 1372 ----a-w- c:\users\mario\AppData\Roaming\CJk2Lfd.vbs 2010-01-20 05:31 . 2010-01-20 05:31 1372 ----a-w- c:\users\mario\AppData\Roaming\NbQVnxV.vbs 2010-01-20 05:20 . 2009-11-14 19:11 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-19 21:47 . 2010-01-19 21:47 1372 ----a-w- c:\users\mario\AppData\Roaming\I7xeKdb.vbs 2010-01-19 21:47 . 2010-01-19 21:47 1372 ----a-w- c:\users\mario\AppData\Roaming\ZG53kmsq7VR1J.vbs 2010-01-18 10:57 . 2010-01-18 10:57 1372 ----a-w- c:\users\mario\AppData\Roaming\7LcPK8jUxMyJK.vbs 2010-01-18 10:57 . 2010-01-18 10:57 1372 ----a-w- c:\users\mario\AppData\Roaming\XOzJXoWGr9yZKnw.vbs 2010-01-18 09:05 . 2010-01-18 09:05 1372 ----a-w- c:\users\mario\AppData\Roaming\xdUME.vbs 2010-01-18 09:05 . 2010-01-18 09:05 1372 ----a-w- c:\users\mario\AppData\Roaming\uqiM7i6.vbs 2010-01-16 04:28 . 2010-01-16 04:28 1372 ----a-w- c:\users\mario\AppData\Roaming\o67zODBTDIP3T.vbs 2010-01-16 04:28 . 2010-01-16 04:28 1372 ----a-w- c:\users\mario\AppData\Roaming\2pRfQ.vbs 2010-01-14 22:42 . 2010-01-14 22:42 1372 ----a-w- c:\users\mario\AppData\Roaming\O8EkshgpBtAW6.vbs 2010-01-14 22:42 . 2010-01-14 22:42 1372 ----a-w- c:\users\mario\AppData\Roaming\dvlXanW5hRHbrMY.vbs 2010-01-14 09:25 . 2010-01-14 09:25 1372 ----a-w- c:\users\mario\AppData\Roaming\hl4ehCR.vbs 2010-01-14 09:24 . 2010-01-14 09:24 1372 ----a-w- c:\users\mario\AppData\Roaming\8M64v.vbs 2010-01-13 10:13 . 2008-04-25 01:58 -------- d-----w- c:\programdata\Microsoft Help 2010-01-13 10:13 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-01-13 05:34 . 2010-01-13 05:34 1372 ----a-w- c:\users\mario\AppData\Roaming\8hebDNf4ZBplT.vbs 2010-01-09 20:24 . 2010-01-09 20:24 1372 ----a-w- c:\users\mario\AppData\Roaming\P3K3K.vbs 2010-01-09 20:23 . 2010-01-09 20:23 1372 ----a-w- c:\users\mario\AppData\Roaming\04AVJ.vbs 2010-01-09 08:34 . 2010-01-09 08:34 1372 ----a-w- c:\users\mario\AppData\Roaming\kJRfHpc.vbs 2010-01-09 08:33 . 2010-01-09 08:33 1372 ----a-w- c:\users\mario\AppData\Roaming\ygQhUdb65Snyv.vbs 2010-01-03 11:02 . 2010-01-03 11:02 1372 ----a-w- c:\users\mario\AppData\Roaming\dZvHt8v.vbs 2010-01-02 06:38 . 2010-02-05 02:35 916480 ----a-w- c:\windows\system32\wininet.dll 2010-01-02 06:32 . 2010-02-05 02:35 71680 ----a-w- c:\windows\system32\iesetup.dll 2010-01-02 06:32 . 2010-02-05 02:35 109056 ----a-w- c:\windows\system32\iesysprep.dll 2010-01-02 04:57 . 2010-02-05 02:35 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-11-25 07:29 . 2009-11-25 07:29 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb3780.tmp.exe 2009-11-22 08:10 . 2009-11-22 08:10 471664 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb3982.tmp.exe 2009-11-17 08:14 . 2008-07-21 07:49 104728 ----a-w- c:\users\mario\AppData\Local\GDIPFONTCACHEV1.DAT 2009-11-16 23:08 . 2009-11-16 23:05 77351 ----a-w- c:\windows\hpqins05.dat 2009-11-16 21:55 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat 2009-11-14 19:46 . 2009-11-14 19:46 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe 2009-11-14 03:17 . 2009-11-14 01:06 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2009-11-14 03:15 . 2009-11-14 03:18 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-11-14 03:15 . 2009-11-14 03:18 107368 ----a-r- c:\windows\system32\GEARAspi.dll 2009-11-14 00:47 . 2009-11-14 00:47 1290592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll 2009-11-14 00:47 . 2009-11-14 00:47 136840 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll 2009-11-14 00:47 . 2009-11-14 00:47 796016 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll 2009-11-10 09:43 . 2009-07-30 21:13 1126 ----a-w- c:\users\mario\AppData\Roaming\wklnhst.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-24 455968] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-22 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800] "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-12-20 468264] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032] "OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 218408] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560] "WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496] "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360] LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2008-8-14 63696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys] @="FSFilter Activity Monitor" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2009-07-27 00:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):45,4f,5a,29,9d,65,ca,01 R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\N360\0308000.029\SymEFA.sys [2/4/2010 6:55 PM 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\N360\0308000.029\BHDrvx86.sys [2/4/2010 6:55 PM 259632] R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\N360\0308000.029\cchpx86.sys [2/4/2010 6:55 PM 482432] R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100204.001\IDSvix86.sys [2/5/2010 3:41 PM 343088] R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [2/4/2010 6:55 PM 117640] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/13/2009 1:00 AM 102448] R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\N360\0308000.029\symndisv.sys [2/4/2010 6:55 PM 48688] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [1/20/2008 6:23 PM 21504] S3 SWNC8U56;Sierra Wireless MUX NDIS Driver (UMTS56);c:\windows\System32\drivers\swnc8u56.sys [8/8/2008 8:46 PM 101248] S3 SWUMX56;Sierra Wireless USB MUX Driver (UMTS56);c:\windows\System32\drivers\swumx56.sys [8/8/2008 8:46 PM 73856] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2007-08-24 00:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder 2008-12-28 c:\windows\Tasks\HPCeeScheduleFormario.job - c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2008-04-25 18:58] 2026-11-09 c:\windows\Tasks\User_Feed_Synchronization-{86F74A44-742A-4105-B3D6-9610C84AC8ED}.job - c:\windows\system32\msfeedssync.exe [2010-02-05 04:56] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop uInternet Settings,ProxyOverride = .local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm . - - - - ORPHANS REMOVED - - - - HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe MSConfigStartUp-15102514 - c:\programdata\15102514\15102514.exe MSConfigStartUp-60227623 - c:\programdata\60227623\60227623.exe AddRemove-14447fb4-cae3-9a7e-b5ea-0aa15a09dcbe - c:\windows\system32\14447fb4-cae3-9a7e-b5ea-0aa15a09dcbe.exe *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-07 14:08 Windows 6.0.6002 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\N360] "ImagePath"="\"c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.8.0.41\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2010-02-07 14:12:10 ComboFix-quarantined-files.txt 2010-02-07 22:12 Pre-Run: 145,695,100,928 bytes free Post-Run: 146,136,281,088 bytes free - - End Of File - - 5126D318D8F6F3129213D33D95810631

02-07-2010, 02:56 PM	#5 (permalink)
So_X_PLicit Registered User Join Date: Feb 2010 Posts: 12 OS: Windows Vista	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. file submitted http://www.virustotal.com/analisis/6...625-1265583053 http://www.virustotal.com/analisis/2...916-1265583264

02-07-2010, 04:55 PM	#6 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 42,349 OS: 2000 Pro; XP Pro; XP Home	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. Hi - Can you also upload these files c:\windows\system32\comsvcs32.dll c:\users\mario\AppData\Roaming\04AVJ.vbs to this site http://www.bleepingcomputer.com/subm...php?channel=28 Do you have know what's created all those randomly named .vbs files 1372bytes in size? Seem like firewall/networking rules to me, but any info you can provide would be helpful. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

02-07-2010, 05:44 PM	#7 (permalink)
So_X_PLicit Registered User Join Date: Feb 2010 Posts: 12 OS: Windows Vista	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. Files have been uploaded. I dont know what created these files because this is my cousins computer. He was complaining that "Antivirus Soft" was in his system and wouldnt let him do anything, and before that, when he would open the internet, multiple tabs and pop-ups for school ads would appear. He gave me his pc to be looked at and after a system restore, this was the next problem, ran malwarebytes before resorting to asking for help. Malware did delete some stuff, dont remember wgat, but this problem continued so then thats when i came to you guys

02-07-2010, 07:26 PM	#10 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 42,349 OS: 2000 Pro; XP Pro; XP Home	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. Looks good. Next steps... Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Download the latest version of Java Runtime Environment (JRE) 18 and save it to your desktop. Scroll down to where it says JDK 6 Update 18 (JDK or JRE) Click the Download JRE button to the right Select the Windows platform from the dropdown menu. Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u18 with JavaFX 1 License Agreement". Click on Continue.The page will refresh. Click on the link to download Windows Offline Installation and save the file to your desktop. Close any programs you may have running - especially your web browser.. Go to Start > Control Panel, click on Uninstall a Program and remove all older versions of Java. Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name. Java(TM) 6 Update 2 Click the Uninstall button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jjre-6u18-windows-i586.exe to install the newest version. After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button. Next, click on the Delete Files button There are two options in the window to clear the cache - Leave BOTH Checked Applications and Applets Trace and Log Files Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Temporary Files Window Click OK to leave the Java Control Panel. --------------------------------------------------------------------------------------------- Please download Malwarebytes' Anti-Malware to your desktop. Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to the following: Update Malwarebytes' Anti-Malware Launch Malwarebytes' Anti-Malware Then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select Perform quick scan, then click Scan. When the scan is complete, click OK, then Show Results to view the results. Be sure that everything is checked, and click Remove Selected. When completed, a log will open in Notepad. Save it to your desktop. Malwarebytes' Anti-Malware may require a reboot to complete removals. After a reboot, if required, post that saved log in your next reply. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

02-07-2010, 08:09 PM	#11 (permalink)
So_X_PLicit Registered User Join Date: Feb 2010 Posts: 12 OS: Windows Vista	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. No malicious software detected Malwarebytes' Anti-Malware 1.44 Database version: 3704 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18882 2/7/2010 8:08:11 PM mbam-log-2010-02-07 (20-08-11).txt Scan type: Quick Scan Objects scanned: 107939 Time elapsed: 7 minute(s), 9 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

02-07-2010, 08:18 PM	#12 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 42,349 OS: 2000 Pro; XP Pro; XP Home	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. Great! One final check, to help ensure nothing is lurking. Go here to run an online scannner from ESET. Note: You will need to use Internet explorer for this scan Turn off the real time scanner of any existing antivirus program while performing the online scan Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the activex control to install Click Start Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked. Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked. Click Scan Wait for the scan to finish Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt Copy and paste that log as a reply to this topic and also let me know how things are now. Also post new logs from DDS. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

02-08-2010, 06:46 AM	#14 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 42,349 OS: 2000 Pro; XP Pro; XP Home	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. Great. We should be done here. Some final housekeeping instructions, and protection information for you. Your logs appear clean.You should be good to go. We still have a few items to address. Adobe Reader 8.2.0 is outdated, and therefore subject to exploit. You can download the most recent version of Adobe Reader here http://get.adobe.com/reader/ Secunia Online Software Inspector, link below, will show you if there are other outdated and insecure applications on the machine. Please use it. ====================== Disconnect from the internet and disable your AntiVirus temporarily. Press the Windows key + R -> in the Run box which opens -> copy/paste in the following single line command & click OK ComboFix /Uninstall This will uninstall ComboFix. It will also implement some cleanup procedures. Re-enable your AntiVirus now. Reconnect to the internet at your leisure. Delete any remaining tools we've used (DDS and GMER) and logs from them. Empty your Recycle Bin. After malware removal, it's a good idea to flush out existing, possibly infected System Restore points, and set a new clean point with which to go forward. Clear & Reset System Restore's Cache Press the Windows key + R Type or copy/paste control sysdm.cpl,,4 & press Enter Click on Continue Under Automatic Restore points Uncheck (untick) all the boxes under Create restore points automatically on the selected disks section. Click Turn System Restore Off. Click Apply Turn System Restore back on now. Check (tick) all the boxes under Create restore points automatically on the selected disks section. Click OK. ============================================ Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs: Microsoft Windows Update - To update Windows, click on Start > Windows Update (or Start > All Programs > Windows Update if you are using the new Vista Start Menu). If the Windows Update is not found there, go to this link - http://update.microsoft.com/ . This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. SpywareBlaster to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites - green to go, yellow for caution and red to stop, helping you avoid the dangerous sites. WOT has an addon available for both Firefox and IE. Winpatrol Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here. You can get a free copy of Winpatrol or use the Plus version for more features. You can read Winpatrol's FAQ if you run into problems. MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out. Do not install more than one AntiVirus program because they will conflict with each other. Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN) http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT. ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry. NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster. In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles How did I get infected in the first place? PC Safety and Security--What Do I Need? If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

02-08-2010, 09:56 AM	#15 (permalink)
So_X_PLicit Registered User Join Date: Feb 2010 Posts: 12 OS: Windows Vista	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. All instructions have been completed and i've read the tips. If ever i need help again, i know where to come, but hopefully i wont have to right? lol. Thanks for all your help, i greatly appreciate it.. You take care now.

02-08-2010, 11:03 AM	#16 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 42,349 OS: 2000 Pro; XP Pro; XP Home	Re: Comsvcs32.dll virus..2nd attempt..Correct logs. Cheers, exactly so. I'm happy to have helped. We hope through our educational links and protection information any visit to this section of the forum is a one-time event. Surf Safely, and Think Prevention! Since this issue is resolved, this topic will be archived. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009