AVG free version detects "IDP.Trojan.2428539A

Inactive
By Mitch Flander
Aug 12, 2012
  1. Please, I need some guidance here. AVG reports this virus as "misleading" and as rouge spyware and also calls it "rcpnetp". After reading your cautions about whether it's a good idea to reformat and reinstall or to clean, I wonder what course of action this infection warrants. AVG reports that its moving it to the vault, but it returns on each reboot and it doesn't show up in the vault. Malwarebytes Anti-malware doesn't report a threat at all. I'm just not sure how to continue. Any help would be appreciated.
    thanks....
  2. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Hello, and welcome to TechSpot.


    [​IMG] Please see here for the board rules and other FAQ.

    Please feel free to introduce yourself, after you follow the steps below to get started.

    Information
    • From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a malware removal helper.
    • Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
    • If you have already asked for help somewhere, please post the link to the topic you were helped.
    • We try our best to reply quickly, but for any reason we do not reply in two days, please reply to this topic with the word BUMP!
    • Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.
    Please review the 5-Step removal instructions and post the logs back here for my review.
  3. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    Hey DragonMaster,

    This is the reply with a paste of the requested logs. I believe it's requested that I give you my system specs and some info on how I use my PC. I thank you heartily in advance for any help at all. I think you saw in my original post that I was unsure based on what I was seeing if I should clean or reformat/reinstall. I'm hoping based on what YOU see that you can provide some insight into that. I sure hope to go with the "clean" option if it at all seems sensible. Thanks again....

    Laptop: Dell Lattitude E6500 running Windows 7 Professional
    Processor: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz 2.54 GHz

    Installed memory (RAM): 4.00 GB (3.49 GB usable)

    System type: 32-bit Operation System

    This is a laptop provided for me by my employer, but it's for personal use as well (online bill pay, gaming, etc).

    The following is a paste of the logs you requested:


    Malwarebytes Anti-Malware 1.62.0.1300
    www.malwarebytes.org

    Database version: v2012.08.12.05

    Windows 7 x86 NTFS
    Internet Explorer 8.0.7600.16385
    Mitch :: MITCH-PC [limited]

    8/12/2012 5:58:54 PM
    mbam-log-2012-08-12 (17-58-54).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 231827
    Time elapsed: 4 minute(s), 15 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)

    ******************************
    ************************************************************************

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2012-08-12 19:25:37
    Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 rev.
    Running: gq3mdkkb.exe; Driver: C:\Users\Mitch\AppData\Local\Temp\kgloypog.sys


    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs avgidsfilterx.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\fastfat \Fat avgidsfilterx.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
    AttachedDevice \Driver\tdx \Device\Ip nmdrv.sys
    AttachedDevice \Driver\tdx \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\Tcp nmdrv.sys
    AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\Udp nmdrv.sys
    AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\RawIp nmdrv.sys

    ---- EOF - GMER 1.0.15 ----


    *******************************************************************************************************
    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_20
    Run by Mitch at 22:10:13 on 2012-08-12
    Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3572.1988 [GMT -4:00]
    .
    AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
    SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Program Files\NetMotion Client\messerv.exe
    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\AVG\AVG2012\avgwdsvc.exe
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
    C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\system32\PnkBstrA.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\NetMotion Client\nomtray.exe
    C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
    C:\Program Files\AVG\AVG2012\avgtray.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\AVG\AVG2012\avgcfgex.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
    C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
    C:\Windows\system32\conhost.exe
    C:\Users\Mitch\AppData\Local\Temp\nsp3981.tmp\MBR.DAT
    C:\Windows\System32\svchost.exe -k swprv
    C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://foxnews.com/
    mURLSearchHooks: H - No File
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Do Not Track: {31332eef-cb9f-458f-afeb-d30e9a66b6ba} - c:\program files\avg\avg2012\avgdtiex.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: LLIEHlprObj Class: {f757fbbf-10e5-4dda-bbea-2357e54bea2b} - c:\program files\open text\livelink explorer\LLBHO3.dll
    TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
    mRun: [nomtray] c:\program files\netmotion client\nomtray.exe
    mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
    mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:\program files\avg\avg2012\avgdtiex.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL
    Trusted Zone: dwm-cipapps
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA} - hxxp://cmg.atlantawatershed.org:81/jre-6u3-windows-i586-p.exe
    DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://cmg.atlantawatershed.org:81/jre-6u20-windows-i586.exe
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {F5131C24-E56D-11CF-B78A-444553540000} - hxxp://dwm-cipapps/cipr/activex/ikcntrls.cab
    TCP: DhcpNameServer = 192.168.1.254
    TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F} : DhcpNameServer = 192.168.1.254
    TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\24F6E6573727F6F6D6D275962756C6563737 : DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\3557276635166716E6E61686 : DhcpNameServer = 172.16.4.1 209.221.63.10 8.8.4.4
    TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\35F6574786561637470234F6D607F657E646 : DhcpNameServer = 66.180.96.12 64.238.96.12
    TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\35F6574786561637470234F6D607F657E646D27657563747 : DhcpNameServer = 66.180.96.12 64.238.96.12
    TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\74F6E646F6C6965627 : DhcpNameServer = 192.168.20.1
    TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\D69647368637F51696273707163656 : DhcpNameServer = 68.87.68.166 68.87.74.166
    TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\E45402E4564777F627B6 : DhcpNameServer = 64.238.96.12 66.180.96.12
    TCP: Interfaces\{CCC3F12C-6E77-47E9-A35D-28B08E5562AD} : DhcpNameServer = 10.11.2.199 10.11.2.200 10.25.10.53 10.11.50.110
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\mitch\appdata\roaming\mozilla\firefox\profiles\0ng2lj8a.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.foxnews.com/
    FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q=
    FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
    FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
    FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll
    FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll
    FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
    FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
    FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
    FF - plugin: c:\users\mitch\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
    FF - plugin: c:\users\mitch\appdata\roaming\mozilla\firefox\profiles\0ng2lj8a.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\plugins\np-mswmp.dll
    FF - plugin: c:\users\mitch\appdata\roaming\mozilla\plugins\npicaN.dll
    FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_270.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 24896]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-1-31 31952]
    R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [2011-6-30 41912]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-2-22 235216]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-12-23 41040]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2012-3-19 301248]
    R1 fsclm;FIPS Encryption Driver;c:\windows\system32\drivers\Fsclm.sys [2010-2-6 97760]
    R1 NMDRV;NetMotion Client Driver;c:\program files\netmotion client\nmdrv.sys [2010-2-6 780888]
    R1 NMRoam;NetMotion Roaming Detection Daemon;c:\windows\system32\drivers\nmroam.sys [2010-2-6 27736]
    R1 NMutilnt;NetMotion Utility Driver;c:\windows\system32\drivers\nmutilnt.sys [2010-2-6 20568]
    R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 193288]
    R2 MESSERV;NetMotion Client;c:\program files\netmotion client\messerv.exe [2010-2-6 1395800]
    R2 mrtRate;mrtRate;c:\windows\system32\drivers\MrtRate.sys [2010-3-27 34712]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 139856]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [2011-12-23 24144]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 17232]
    R3 cvusbdrv;Dell ControlVault;c:\windows\system32\drivers\cvusbdrv.sys [2010-3-2 33832]
    R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y6232.sys [2011-9-14 223960]
    R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
    R3 nmvnic;NMVNIC Network Adapter;c:\windows\system32\drivers\nmvnic.sys [2010-2-6 55896]
    S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\avgidsagent.exe [2012-7-4 5160568]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-29 136176]
    S3 acpials;ALS Sensor Filter;c:\windows\system32\drivers\acpials.sys [2009-7-14 7680]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-5-3 250056]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    S3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\drivers\BrSerIb.sys [2009-7-13 265088]
    S3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\drivers\BrUsbSIb.sys [2009-7-13 11904]
    S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2008-7-25 42280]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-3-29 136176]
    S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-24 113120]
    S3 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-10-16 369256]
    S3 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2012-2-7 3027840]
    S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-7 1343400]
    S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2009-7-13 17920]
    S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2009-7-13 20480]
    S4 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
    SUnknown rpcnetp;rpcnetp; [x]
    .
    =============== Created Last 30 ================
    .
    2012-08-12 04:04:28 -------- d-sh--w- C:\$RECYCLE.BIN
    2012-08-12 03:51:16 -------- d-----w- C:\ComboFix
    2012-08-12 02:16:47 -------- d-----w- c:\users\mitch\appdata\local\temp
    2012-08-12 01:54:06 98816 ----a-w- c:\windows\sed.exe
    2012-08-12 01:54:06 518144 ----a-w- c:\windows\SWREG.exe
    2012-08-12 01:54:06 256000 ----a-w- c:\windows\PEV.exe
    2012-08-12 01:54:06 208896 ----a-w- c:\windows\MBR.exe
    2012-08-10 18:25:37 17920 ------w- c:\windows\system32\rpcnetp.dll
    .
    ==================== Find3M ====================
    .
    2012-08-03 13:09:20 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-08-03 13:09:20 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2012-07-03 17:46:44 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-06-03 02:14:36 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2012-06-03 02:14:36 348160 ----a-w- c:\windows\system32\msvcr71.dll
    2012-05-28 02:55:36 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2012-05-28 02:55:24 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
    2012-05-28 02:55:24 103736 ----a-w- c:\windows\system32\PnkBstrB.ex0
    2012-05-18 03:07:30 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
    2012-05-18 03:07:21 282296 ----a-w- c:\windows\system32\PnkBstrB.xtr
    .
    =================== ROOTKIT ====================
    .
    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 6.1.7600
    .
    CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
    device: opened successfully
    user: error reading MBR
    .
    Disk trace:
    called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStorV.sys halmacpi.dll
    c:\windows\system32\drivers\iaStorV.sys Intel Corporation Intel Matrix Storage Manager driver
    1 ntkrnlpa!IofCallDriver[0x82E7A448] -> \Device\Harddisk0\DR0[0x8767B030]
    3 CLASSPNP[0x8CFB059E] -> ntkrnlpa!IofCallDriver[0x82E7A448] -> \Device\Ide\IAAStorageDevice-1[0x86427028]
    kernel: MBR read successfully
    _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0; }
    user != kernel MBR !!!
    copy of MBR has been found in sector 61 !
    copy of MBR has been found in sector 62 !
    .
    ============= FINISH: 22:10:33.56 ===============

    ***********************************************************************************************************************
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume3
    Install Date: 3/22/2010 10:41:20 PM
    System Uptime: 8/12/2012 12:11:31 AM (22 hours ago)
    .
    Motherboard: Dell Inc. | |
    Processor: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz | Microprocessor | 2535/266mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 223 GiB total, 107.096 GiB free.
    D: is FIXED (NTFS) - 10 GiB total, 3.371 GiB free.
    E: is CDROM (CDFS)
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP929: 8/11/2012 10:43:22 PM - Windows Update
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    2007 Microsoft Office system
    Abacus Flight Deck 4
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader 9.5.1
    Adobe Shockwave Player 11.6
    Apple Software Update
    AVG 2012
    Battlefield: Bad Company™ 2
    Brother MFL-Pro Suite MFC-9840CDW
    Call of Duty(R) 2
    Call of Duty(R) 4 - Modern Warfare(TM)
    Call of Duty: Black Ops
    Call of Duty: Black Ops - Multiplayer
    Carbonite
    CCleaner
    Citrix Presentation Server Client - Web Only
    Citrix XenApp Web Plugin
    Dell Resource CD
    Desktop Restore
    Driving Speed 2.0
    Eagle Lander
    Eagle Lander 3D v212
    Free Audio CD Burner version 1.4.7
    Free Audio CD to MP3 Converter version 1.3.12.1228
    Free Audio Converter version 5.0.10.423
    Free Disc Burner version 3.0.6.920
    Free M4a to MP3 Converter 6.2
    Free YouTube Download version 3.0.815
    Free YouTube to MP3 Converter version 3.10.815
    FreeRIP v3.40
    Google Chrome
    Google Earth
    Google Update Helper
    Intel(R) Network Connections 14.1.111.0
    Java Auto Updater
    Java(TM) 6 Update 20
    Java(TM) 6 Update 3
    Joobers TV
    Livelink Explorer Professional 4.8.3
    Lock On: Modern Air Combat
    Malwarebytes Anti-Malware version 1.62.0.1300
    Microsoft Combat Flight Simulator 2
    Microsoft Flight Simulator 2004 A Century of Flight
    Microsoft Office 2007 Service Pack 3 (SP3)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office File Validation Add-In
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Professional Hybrid 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
    Microsoft WorldWide Telescope
    Moffsoft FreeCalc
    Moonbase Alpha
    Mozilla Firefox 14.0.1 (x86 en-US)
    Mozilla Maintenance Service
    My Lockbox 2.8.2
    NetMotion Mobility XE Client
    NVIDIA 3D Vision Driver 260.99
    NVIDIA Control Panel 260.99
    NVIDIA Graphics Driver 260.99
    NVIDIA Install Application
    NVIDIA nView Desktop Manager
    NVIDIA PhysX
    NVIDIA PhysX System Software 260.99
    NVIDIA Stereoscopic 3D Driver
    OGA Notifier 2.0.0048.0
    Orbiter 2010-P1
    PunkBuster Services
    Quicken 2002 Deluxe
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    RealPlayer
    RealUpgrade 1.1
    Red Baron II
    Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
    Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
    Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
    Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
    Sierra Utilities
    Steam
    Stellarium 0.11.0
    swMSM
    System Requirements Lab CYRI
    TeamViewer 7
    TmNationsForever
    Unifier File Transfer Application (remove only)
    Uninstall 1.0.0.1
    Unity Web Player
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687267) 32-Bit Edition
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Windows Media Player Firefox Plugin
    .
    ==== Event Viewer Messages From Past Week ========
    .
    8/8/2012 12:34:43 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070050: Security Update for Windows 7 (KB977165).
    8/7/2012 8:46:52 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume OS.
    8/12/2012 9:58:08 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    8/12/2012 5:56:40 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Windows\System32\config\COMPONENTS' was corrupted and it has been recovered. Some data might have been lost.
    8/12/2012 2:08:47 AM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\Volume{c86edfbd-363b-11df-bbb9-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{4F1E2135-DD6F-4C2E-88E8-A5046353E6F9}' was corrupted and it has been recovered. Some data might have been lost.
    8/12/2012 12:16:27 AM, Error: Service Control Manager [7034] - The rpcnetp service terminated unexpectedly. It has done this 1 time(s).
    8/12/2012 12:13:37 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    8/12/2012 12:03:41 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    8/11/2012 9:00:06 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer LASALLE-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6C9313BB-2269-4F98-BC23-ECE7264. The master browser is stopping or an election is being forced.
    8/11/2012 8:47:59 PM, Error: Service Control Manager [7000] - The rpcnetp service failed to start due to the following error: The system cannot find the file specified.
    8/11/2012 8:22:54 PM, Error: Service Control Manager [7023] - The Windows Update service terminated with the following error: %%-2147467243
    8/11/2012 10:44:27 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package (KB2538243).
    8/11/2012 10:05:33 PM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
    8/11/2012 1:32:16 PM, Error: Application Popup [877] - There was error [DATABASE OPEN FAILED] processing the driver database.
    8/10/2012 8:26:54 AM, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 10.23.98.72. The computer with the IP address 10.23.98.73 did not allow the name to be claimed by this computer.
    8/10/2012 12:03:08 PM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    8/10/2012 12:01:29 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    8/10/2012 12:01:28 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service CarboniteService with arguments "" in order to run the server: {36471C67-6A93-4434-92CC-4C614CD06666}
    8/10/2012 12:01:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    8/10/2012 12:01:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    8/10/2012 12:01:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    8/10/2012 12:01:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    8/10/2012 12:01:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgldx86 Avgmfx86 Avgtdix CSC DfsC discache fsclm NetBIOS NetBT NMDRV NMRoam NMutilnt nsiproxy Psched rdbss spldr tdx Wanarpv6 WfpLwf
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The NetMotion Client service depends on the NetMotion Client Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    .
    ==== End Of File ===========================
  4. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    It should be able to be cleaned up!

    Please download and run TDSSKiller to your desktop as outlined below:

    Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

    For Windows XP, double-click to start.
    For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.


    [​IMG]

    -------------------------

    Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

    [​IMG]

    ------------------------

    Click the Start Scan button.

    [​IMG]

    -----------------------

    If a suspicious object is detected, the default action will be Skip, click on Continue
    If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
    Skip and click on Continue


    [​IMG]

    ----------------------

    If malicious objects are found, they will show in the Scan results and offer three (3) options.

    Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.


    [​IMG]


    --------------------

    A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.
    Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

    -------------------

    Here's a summary of what to do if you would like to print it out:

    If a suspicious object is detected, the default action will be Skip, click on Continue
    If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
    Skip and click on Continue

    If malicious objects are found, they will show in the Scan results and offer three (3) options.

    Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  5. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    Hey DragonMaster. Seriously want to thank you again for your help. Ran the TDSSkiller. Returned 2 objects. Medium risk. No "cure" option. I rebooted to see if AVG would report the virus again. It did. Just FYI.... Sorry if I wasn't supposed to do that and I hope I didn't mess up the process. I won't jump the gun again, if that was a screw-up.

    I could paste the log file so I did the "upload file" option.

    Awaiting your next instructions!

    Mitch

    Attached Files:

  6. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Please download OTL to your Desktop. (If you already have it downloaded, then just follow the instructions below).
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in

      msconfig
      safebootminimal
      activex
      drivers32
      netsvcs
      CreateRestorePoint
      %AppData%\Roaming\Mozilla\Firefox\Profiles\*.default\extensions\ /s /md5
      %AppData%\Local\
      %systemroot%\system32\sysprep
      *.xpi /md5
      %systemroot%\Downloaded Program Files\
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
      hklm\software\clients\startmenuinternet|command /rs
      hklm\software\clients\startmenuinternet|command /64 /rs
      %systemroot%\system32\drivers\*.sys /lockedfiles
      %systemroot%\system32\drivers\*.sys /90
      %systemroot%\System32\config\*.sav
      %SYSTEMDRIVE%\*.exe /md5
      "%WinDir%\$NtUninstallKB*$." /30
      %systemdrive%\Program Files\Common Files\ComObjects\*.* /s
      %systemroot%\*. /mp /s
      %systemroot%\*. /rp /s
      %systemroot%\system32\*.dll /lockedfiles
      %systemroot%\Tasks\*.job /lockedfiles
      %systemroot%\Installer\ /s
      %systemroot%\system32\Cache\ /s
      %systemroot%\system32\config\systemprofile\Application Data /s
      %PROGRAMFILES%\*.
      %appdata%\*.*
      /md5start
      volsnap.sys
      services.exe
      userinit.exe
      afd.sys
      tcpip.sys
      netbt.sys
      ipsec.sys
      dnsrslvr.dll
      ipnathlp.dll
      netman.dll
      WMIsvc.dll
      srsvc.dll
      sr.sys
      wscsvc.dll
      wuauserv.dll
      qmgr.dll
      es.dll
      cryptsvc.dll
      svchost.exe
      rpcss.dll
      tdx.sys
      wininit.exe
      winlogon.exe
      atapi.sys
      explorer.exe
      /md5stop
    • Click the Run Scanbutton. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
      • Please copy (Edit->Select All, Edit->Copy) and paste (Edit->Paste) the contents of these files, one at a time
    Note: in the event that OTL fails to run, please use alternate download links to try again:

    http://oldtimer.geekstogo.com/OTL.com
    http://oldtimer.geekstogo.com/OTL.scr
  7. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    DragaonMaster,

    OTL logs as requested. Got the error indicating they were too large to paste. I uploaded them both as zip files. Thank you!

    Attached Files:

  8. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Please run OTL
  9. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    DragonMaster,

    OTL runfix ran fine. As soon as it rebooted I got the same AVG threat report (File name: C:\windows\system32\rpcnetp.exe Threat name: IDP.Trojan2428359A. Just FYI....

    Post of requested log:

    All processes killed
    ========== OTL ==========
    Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q=" removed from keyword.URL
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
    Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
    ADS C:\ProgramData\TEMP:0B4227B4 deleted successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]
  10. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    AVG keeps detecting LoJack for laptop, that's what this is:
    SUnknown rpcnetp;rpcnetp; [x]

    RPCNETP is a LoJack service. Let's do this scan anyway, and see what happens:

    ESET Online Scan

    Please run a free online scan with the ESET Online Scanner
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • When asked, allow the ActiveX control to install
    • Click Start
    • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
    • Click Scan (This scan can take several hours, so please be patient)
    • Once the scan is completed, you may close the window
    • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
    • Copy and paste that log as a reply to this topic
  11. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    DragonMaster,
    My research on rcpnetp showed that Lojack reference, too! I think Absolute software is the parent company, right? That had to have been on my pc for a LONG (I think), so I wonder why AVG is just now reporting it. I'm starting to wonder if we'll be able to get this laptop "right" again. I sure appreciate you trying, though. I know a few symptoms that started a week or so back have become major problems (flash player crashes, some websites won't load but then later do). Anyway, I ran ESET and it found 5 threats. I can't remember them all and didn't make note of them because I thought the log file WOULD. It did NOT. In fact, it only shows 2 lines! I'm posting that, but the threats it listed that I remember are:

    Win32\widgi(something)
    Win32\Installer.D and 3 more....very similar.. all in Win32. Sorry can't remember the rest.

    Here's the log:

    ESETSmartInstaller@High as CAB hook log:
    OnlineScanner.ocx - registred OK
     
  12. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    This should help finish up...

    Please run the F-Secure Online Scanner
    • Accept the License Agreement and check the box. Then click on Run Check.
    • [​IMG]
    • It will ask you to Run the Java plugin. Please confirm.
    • Once the download completes, the window for the scanner will launch.
    • Please confirm anymore prompts, and then select Full Scan.
    • The scan will take some time to finish, so please be patient.
    • When the scan completes, click the Automatic cleaning (recommended) button.
    • It will run its cleaning.
    • Click the Full report button and Copy & Paste the entire report (except the bold text at the foot of the page) in your next reply. Once that's done, click the Close button on the scan window.
  13. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    The F-secure scanner is taking a long time to load. The little wheel has been turning for at least 10 minutes. I never got asked to run the java plug-in, either. Is it hung up, do you think?
  14. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    DragonMaster,

    I left the F-secure trying to load and went to bed at midnight. When I checked this morning, the "wheel" was still spinning. It never loaded. Do you have anything else I can try? I appreciate it.

    Mitch
  15. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    This thing is really starting to wreak havoc with my PC. It's a work PC and I'm having trouble with applications now.
  16. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Sorry that happened. Was unexpected.

    ComboFix

    Please download ComboFix[​IMG] by sUBs
    From BleepingComputer.com

    Please save the file to your Desktop, but rename it first to svchost.exe

    Important information about ComboFix

    Before the download:
    • Please copy and paste these instructions to Notepad and save to your Desktop, or print them - for easier access.
    • It is important to rename ComboFix before the download.
    • Please do not rename ComboFix to other names, but only the one indicated.
    After the download:
    • Close any open browsers.
    • Very Important: Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Please visit here if you don't know how.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
    • If there is no Internet connection after running ComboFix, then restart your computer to restore back your connection.
    Running ComboFix:
    • Double click on svchost.exe & follow the prompts.
    • It will attempt to install the Recovery Console:
    • When ComboFix finishes, it will produce a report for you.
    • Please post the "C:\Combo-Fix.txt" in your next reply.
    Troubleshooting ComboFix

    Safe Mode:

    If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there.

    (To boot into Safe Mode, tap F8 after BIOS, and just before the Windows
    logo appears. A list of options will appear, select "Safe Mode.")

    Re-downloading:

    If this doesn't work either, try the same method (above method), but try to download it again, except name
    ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe.

    Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe.
  17. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    Whew... that was scary. First of all it didn't disconnect the PC from the internet when it started, so I yanked the cord myself to be sure. Then once it finished, I couldn't start a browser and got the message "this is a file marked for deletion"! Anyway, a reboot fixed that one. I'm anxiously waiting for your reply. Funny, AVG has not reported the threat since middle of the day yesterday, but the symptoms are still here and rpcnetp is still running.

    Here's the combofix log:

    ComboFix 12-08-17.03 - Mitch 08/17/2012 15:10:33.4.2 - x86
    Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3572.2195 [GMT -4:00]
    Running from: c:\users\SG3 13\Desktop\ComboFix.exe
    AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
    SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-07-17 to 2012-08-17 )))))))))))))))))))))))))))))))
    .
    .
    2012-08-17 19:19 . 2012-08-17 19:19 -------- d-----w- c:\users\TEMP\AppData\Local\temp
    2012-08-17 19:19 . 2012-08-17 19:19 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-08-17 19:19 . 2012-08-17 19:19 -------- d-----w- c:\users\admin 1\AppData\Local\temp
    2012-08-16 13:22 . 2012-08-17 12:49 58288 ----a-w- c:\windows\system32\rpcnet.dll
    2012-08-16 13:10 . 2012-08-16 13:10 -------- d-----w- c:\program files\ESET
    2012-08-16 12:56 . 2012-08-17 12:49 17920 ----a-w- c:\windows\system32\rpcnetp.exe
    2012-08-15 17:07 . 2012-08-16 12:56 17920 ----a-w- c:\windows\system32\rpcnetp.dll
    2012-08-15 16:25 . 2012-08-15 16:25 -------- d-----w- C:\_OTL
    2012-08-14 16:23 . 2012-08-14 16:27 -------- d-----w- c:\users\Mitch\AppData\Roaming\PeaZip
    2012-08-14 16:23 . 2012-08-14 16:23 -------- d-----w- c:\program files\PeaZip
    2012-08-14 15:51 . 2012-08-14 15:51 -------- d-----w- c:\program files\7-Zip
    2012-08-13 15:35 . 2012-08-13 15:35 -------- d-----w- c:\users\Mitch\AppData\Local\Electronic_Arts_Inc
    2012-08-13 15:35 . 2012-08-13 15:35 -------- d-----w- c:\programdata\Electronic Arts
    2012-08-12 02:16 . 2012-08-17 19:19 -------- d-----w- c:\users\Mitch\AppData\Local\temp
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-08-17 15:20 . 2011-04-11 19:11 411368 ----a-w- c:\windows\system32\deployJava1.dll
    2012-08-16 13:21 . 2010-03-23 03:01 13160 ----a-w- c:\windows\system32\Upgrd.exe
    2012-08-16 13:21 . 2010-03-23 03:01 58288 ------w- c:\windows\system32\rpcnet.exe
    2012-08-15 02:09 . 2012-05-03 12:37 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2012-08-15 02:09 . 2011-05-20 03:09 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-07-03 17:46 . 2011-05-05 21:24 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-06-03 02:14 . 2010-04-01 11:53 348160 ----a-w- c:\windows\system32\msvcr71.dll
    2012-06-03 02:14 . 2010-04-01 11:53 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2012-05-28 02:55 . 2010-03-25 01:58 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2012-05-28 02:55 . 2010-03-25 01:58 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
    2012-05-28 02:55 . 2010-03-25 01:58 103736 ----a-w- c:\windows\system32\PnkBstrB.ex0
    2012-07-19 13:47 . 2012-02-23 21:47 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
    @="{95A27763-F62A-4114-9072-E81D87DE3B68}"
    [HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
    2011-03-04 00:52 762000 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
    @="{E300CD91-100F-4E67-9AF3-1384A6124015}"
    [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
    2011-03-04 00:52 762000 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
    @="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
    [HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
    2011-03-04 00:52 762000 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "40488D29BDB5DFCFC38F8F60CCA5FCD9DB75D9F3._service_run"="c:\program files\Google\Chrome\Application\chrome.exe" [2012-08-14 1229848]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "nomtray"="c:\program files\NetMotion Client\nomtray.exe" [2010-02-06 559704]
    "Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-04 948880]
    "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk /p \??\c:\0autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
    .
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Billminder.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Billminder.lnk
    backup=c:\windows\pss\Billminder.lnk.CommonStartup
    backupExtension=.CommonStartup
    .
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Quicken Startup.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Quicken Startup.lnk
    backup=c:\windows\pss\Quicken Startup.lnk.CommonStartup
    backupExtension=.CommonStartup
    .
    [HKLM\~\startupfolder\C:^Users^Mitch^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CM Control Center.lnk]
    path=c:\users\Mitch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CM Control Center.lnk
    backup=c:\windows\pss\CM Control Center.lnk.Startup
    backupExtension=.Startup
    .
    [HKLM\~\startupfolder\C:^Users^Mitch^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Livelink Explorer Synchronizer.lnk]
    path=c:\users\Mitch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Livelink Explorer Synchronizer.lnk
    backup=c:\windows\pss\Livelink Explorer Synchronizer.lnk.Startup
    backupExtension=.Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\40488D29BDB5DFCFC38F8F60CCA5FCD9DB75D9F3._service_run]
    2012-08-14 04:31 1229848 ----a-w- c:\program files\Google\Chrome\Application\chrome.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2012-01-02 14:07 843712 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2012-01-04 02:51 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
    2009-05-26 20:46 1159168 ------w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
    2008-12-24 14:26 114688 ------w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
    2012-07-03 17:46 973488 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
    2012-07-03 17:46 973488 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mylbx]
    2012-03-21 18:22 2143552 ----a-w- c:\program files\My Lockbox\mylbx.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
    2010-10-16 17:42 279144 ----a-w- c:\windows\System32\nvhotkey.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrnStatusMX]
    2007-08-29 21:06 1077248 ----a-w- c:\program files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QAGENT]
    2001-08-01 01:59 94208 ----a-w- c:\program files\QUICKENW\qagent.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
    2011-09-26 14:03 1242448 ----a-w- c:\program files\Steam\Steam.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2010-02-18 15:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2012-06-03 02:14 296056 ----a-w- c:\program files\real\realplayer\Update\realsched.exe
    .
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [x]
    R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
    R3 acpials;ALS Sensor Filter;c:\windows\system32\DRIVERS\acpials.sys [x]
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
    R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
    R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
    R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
    R3 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
    R3 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
    R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [x]
    S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
    S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
    S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys [x]
    S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
    S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
    S1 fsclm;FIPS Encryption Driver;c:\windows\system32\drivers\fsclm.sys [x]
    S1 NMDRV;NetMotion Client Driver;c:\program files\NetMotion Client\nmdrv.sys [x]
    S1 NMRoam;NetMotion Roaming Detection Daemon;c:\windows\system32\DRIVERS\nmroam.sys [x]
    S1 NMutilnt;NetMotion Utility Driver;c:\windows\system32\drivers\nmutilnt.sys [x]
    S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
    S2 MESSERV;NetMotion Client;c:\program files\NetMotion Client\messerv.exe [x]
    S2 mrtRate;mrtRate; [x]
    S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
    S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
    S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
    S3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [x]
    S3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [x]
    S3 cvusbdrv;Dell ControlVault;c:\windows\system32\Drivers\cvusbdrv.sys [x]
    S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y6232.sys [x]
    S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
    S3 nmvnic;NMVNIC Network Adapter;c:\windows\system32\DRIVERS\nmvnic.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-08-17 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 02:09]
    .
    2012-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-30 00:35]
    .
    2012-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-30 00:35]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://foxnews.com/
    Trusted Zone: dwm-cipapps
    TCP: DhcpNameServer = 10.11.2.199 10.11.2.200 10.25.10.53 10.11.50.110
    FF - ProfilePath - c:\users\Mitch\AppData\Roaming\Mozilla\Firefox\Profiles\0ng2lj8a.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.foxnews.com/
    FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q=
    .
    .
    **************************************************************************
    .
    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 6.1.7600
    .
    CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
    device: opened successfully
    user: error reading MBR
    kernel: MBR read successfully
    user != kernel MBR !!!
    copy of MBR has been found in sector 61 !
    copy of MBR has been found in sector 62 !
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,43,27,3b,b5,fa,11,07,4f,98,b8,cb,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,43,27,3b,b5,fa,11,07,4f,98,b8,cb,\
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'Explorer.exe'(1464)
    c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
    c:\program files\Open Text\Livelink Explorer\LLNS3.dll
    c:\program files\Open Text\Livelink Explorer\llsmo.dll
    c:\program files\Open Text\Livelink Explorer\lldsbase.dll
    c:\program files\Open Text\Livelink Explorer\lllangbase.dll
    c:\program files\Open Text\Livelink Explorer\llkrnl.dll
    c:\program files\Open Text\Livelink Explorer\llds3.dll
    c:\program files\Open Text\Livelink Explorer\otxmlp3.dll
    c:\program files\Open Text\Livelink Explorer\lapibase.dll
    c:\program files\Open Text\Livelink Explorer\lapiattr.dll
    c:\program files\Open Text\Livelink Explorer\llctls3.dll
    c:\program files\Open Text\Livelink Explorer\lldsui.dll
    c:\program files\Open Text\Livelink Explorer\llopts.dll
    c:\program files\Open Text\Livelink Explorer\lllang_en_US.dll
    .
    Completion time: 2012-08-17 15:20:59
    ComboFix-quarantined-files.txt 2012-08-17 19:20
    ComboFix2.txt 2012-08-12 04:05
    ComboFix3.txt 2012-08-12 02:16
    .
    Pre-Run: 95,176,343,552 bytes free
    Post-Run: 95,272,714,240 bytes free
    .
    - - End Of File - - 658BC283045494731C9AC42A55624DE1
  18. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    One more thing here. I mentioned that RCPNET.EXE is not coming up as a threat anymore. I forgot but the reason is I added it to the exceptions in AVG. I figured that was ok since it just keeps popping up as a threat without any success removing it.
     
  19. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Okay. That's fine.

    Please download aswMBR from here

    • Save aswMBR.exe to your Desktop
    • Double click aswMBR.exe to run it
    • Click the Scan button to start the scan as illustrated below

    [​IMG]

    Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives

    • Once the scan finishes click Save log to save the log to your Desktop
      [​IMG]
    • Copy and paste the contents of aswMBR.txt back here for review
  20. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    Thanks again, DragonMaster. Am I supposed to do the "FixMBR" step on the scanner..or is that what you meant about not addressing rootkits yet?
    Here's the log:

    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-08-18 16:31:58
    -----------------------------
    16:31:58.230 OS Version: Windows 6.1.7600
    16:31:58.230 Number of processors: 2 586 0x170A
    16:31:58.230 ComputerName: MITCH-PC UserName: Mitch
    16:31:59.260 Initialize success
    16:33:49.188 AVAST engine defs: 12081800
    16:34:11.027 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
    16:34:11.027 Disk 0 Vendor: Size: 0MB BusType: 0
    16:34:11.043 Disk 0 MBR read successfully
    16:34:11.043 Disk 0 MBR scan
    16:34:11.059 Disk 0 Windows 7 default MBR code
    16:34:11.059 Disk 0 MBR hidden
    16:34:11.059 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 258 MB offset 63
    16:34:11.074 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 530432
    16:34:11.090 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 227975 MB offset 21501952
    16:34:11.121 Disk 0 scanning C:\Windows\system32\drivers
    16:34:21.821 Service scanning
    16:34:45.907 Modules scanning
    16:34:59.538 Disk 0 trace - called modules:
    16:34:59.553 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStorV.sys halmacpi.dll
    16:34:59.569 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8767b030]
    16:34:59.569 3 CLASSPNP.SYS[8cfb059e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86429028]
    16:35:11.643 AVAST engine scan C:\Windows
    16:35:27.540 AVAST engine scan C:\Windows\system32
    16:38:52.502 AVAST engine scan C:\Windows\system32\drivers
    16:39:08.278 AVAST engine scan C:\Users\Mitch
    17:00:13.100 AVAST engine scan C:\ProgramData
    17:10:12.330 Scan finished successfully
    17:12:14.157 Disk 0 MBR has been saved successfully to "C:\Users\SG3 13\Desktop\tech help\MBR.dat"
    17:12:14.167 The log file has been saved successfully to "C:\Users\SG3 13\Desktop\tech help\aswMBR.txt"
  21. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Yeah, don't hit that. If there are no more issues, then we shall clean up!

    Clean up System Restore

    Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

    To manually create a new Restore Point
    • Go to Control Panel and select System and Maintenance
    • Select System
    • On the left select Advance System Settings and accept the warning if you get one
    • Select System Protection Tab
    • Select Create at the bottom
    • Type in a name I.e. Clean
    • Select Create
    Now we can purge the infected ones
    • Go back to the System and Maintenance page
    • Select Performance Information and Tools
    • On the left select Open Disk Cleanup
    • Select Files from all users and accept the warning if you get one
    • In the drop down box select your main drive I.e. C
    • For a few moments the system will make some calculations:
      [​IMG]
    • Select the More Options tab
      [​IMG]
    • In the System Restore and Shadow Backups select Clean up
      [​IMG]
    • Select Delete on the pop up
    • Select OK
    • Select Delete

    Run OTC to remove our tools

    To remove all of the tools we used and the files and folders they created, please do the following:
    Please download OTC.exe by OldTimer:
    • Save it to your Desktop.
    • Double click OTC.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.
    Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

    Purge old temporary files

    Download CCleaner Slim and save it to your Desktop - Alternate download link

    When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
    Follow the prompts to install the program.

    * Double-click the CCleaner shortcut on the desktop to start the program.
    * Click on the Options block on the left, then choose Cookies.
    * Under Cookies to Delete, highlight any cookies you would like to retain permanently
    * Click the right arrow > to move them to the Cookies to Keep window.
    * Go into Options > Advanced & uncheck Only delete files in Windows Temp folders older than 48 hours
    * Click Cleaner on the left then Run Cleaner on the right to run the program.
    * Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

    Caution: Only use the Registry feature if you are very familiar with the registry.
    Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

    Security Check

    Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
    • Save it to your Desktop.
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    Tell me in your next reply, if you have completed these tasks:
    • Cleaned System Restore
    • Ran OTC
    • Ran CCleaner
    • Ran Security Check
    Also, let me know how your computer is running, and don't forget to post the contents of the Security Check log.
  22. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    Hey..

    I did the first step, but a section of the second step is not showing up. See my highlights in your instructions section that I pasted in red below:

    Now we can purge the infected ones
    • Go back to the System and Maintenance page
    • Select Performance Information and Tools
    • On the left select Open Disk Cleanup
    • Select Files from all users and accept the warning if you get one <---this step doesn't show up. Goes straight to the next bullet point.
    • In the drop down box select your main drive I.e. C
    • For a few moments the system will make some calculations:

    I'll await your comments before going any further. thanks!
  23. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    DragonMaster,
    You can disregard the above reply. I chose "cleanup system files" and I was able to finally get the choices to get to the goal of deleting all but the most recent restore point.

    I went all the way through the steps and before I ran ccleaner, I still get the IDP.Trojan warning from AVG (rcpnetp). I found some steps online and wanted to run this by you. Please check the paste below and see if this method makes sense to you. Otherwise I get this threat on every bootup unless I put in the the "allowed" section in AVG. Bottom line, should I ignore this threat?? Here's the steps:

    1) Click START then Run or just Windows key and "R" then Notepad.
    2) Type anything you want like Hello there and save the file on the desktop as example : test.txt
    3) Copy test.txt to the C:\Windows\System32 filder on Winxp case.
    4) Click START go to RUN then type CMD hit enter.
    5) From the command line type "CD \Windows\System32" without the quotes and hit enter.
    6) Now just type this four commands.
    7.1 "copy test.txt rpcnet.exe" its going to ask you if you want to replace the file say yes.
    7.2 "copy test.txt rpcnet.dll" enter replace yes.
    7.3 "copy test.txt rpcnetp.exe" enter replace yes.
    7.4 "copy test.txt rpcnetp.dll" enter replace yes. All this commands without the quotes.
    8) Now this other four commands.
    8.1 "attrib rpcnet.exe +r" then hit enter.
    8.2 "attrib rpcnet.dll +r" hit enter.
    8.3 "attrib rpcnetp.exe +r" hit enter.
    8.4 "attrib rpcnetp.dll +r" hit enter. Again all the commands above without quotes.
    9)Now the files can't be overwritten by the BIOS and you have empty files when windows starts and tries to run them nothing will happen as they are not real DLL or exe files and you will get rid of the LOJACK.

    ..And here's the last paste (from security check):

    Results of screen317's Security Check version 0.99.46
    Windows 7 x86 (UAC is enabled)
    Out of date service pack!!
    Internet Explorer 8 Out of date!
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    AVG Anti-Virus Free Edition 2012
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    Malwarebytes Anti-Malware version 1.62.0.1300
    CCleaner
    Java(TM) 6 Update 20
    Java(TM) 6 Update 3
    Java version out of Date!
    Adobe Flash Player 10 Flash Player out of Date!
    Adobe Flash Player 11.3.300.271
    Adobe Reader 9 Adobe Reader out of Date!
    Mozilla Firefox (14.0.1)
    Google Chrome 21.0.1180.77
    Google Chrome 21.0.1180.79
    ````````Process Check: objlist.exe by Laurent````````
    AVG avgwdsvc.exe
    AVG avgtray.exe
    AVG avgrsx.exe
    AVG avgnsx.exe
    AVG avgemc.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 2%
    ````````````````````End of Log``````````````````````


    Computer seems to be running ok at present, but I'm just worried about the rpcnetp thing....
    thanks...
  24. Mitch Flander

    Mitch Flander Newcomer, in training Topic Starter Posts: 23

    Strike that last comment about "running ok". I'm gettng messages during browsing "a script is causing probs (or something like that)", getting full screen pop-ups that won't let you close without "leave this page" messages or "stay on this page", etc. It tries to deceive and redirect you.
    I tried to play a game to check the performance. It ran ok for about 5 mins then the frame rate when WAY down. I was finally able to get out of it and notice CPU usage was at 100%. I finally just shut down because it wasn't getting any better. I have no idea what's up at this point. Definitely not a clean PC.or so it seems.
  25. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Well, post a new GMER log, and also do the following (I might find interest in this):

    Please download Listparts
    Run the tool,
    check the "list BCD" box
    click "Scan" and post the log (Result.txt) it makes.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.