TechSpot

Bamital-AQ Infection affecting explorer

By Jaeyung
Jul 2, 2011
  1. Greetings,

    My laptop is having problems showing desktop screen. When the computer loads, it brings me to a completely blue screen without icons or a taskbar. I scanned the hard drive using Avast Antivirus and found 3 Bamital cases on the following:

    c:\windows\explorer.exe
    c:\windows\wininint.exe
    c:\windows\explorer.exe

    Here are the log reports as follows:

    Using Malwarebytes
    Malwarebytes' Anti-Malware 1.51.0.1200
    www.malwarebytes.org

    Database version: 7005

    Windows 6.1.7600
    Internet Explorer 8.0.7600.16385

    7/2/2011 5:21:58 PM
    mbam-log-2011-07-02 (17-21-58).txt

    Scan type: Quick scan
    Objects scanned: 171118
    Time elapsed: 8 minute(s), 37 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 2

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\Windows\System32\itleeugwhujzzvwm.exe (Adware.Adrotator) -> Quarantined and deleted successfully.
    c:\Users\Public\documents\Server\admin.txt (Malware.Trace) -> Quarantined and deleted successfully.

    Using GMER
    GMER 1.0.15.15640 - http://www.gmer.net
    Rootkit scan 2011-07-02 21:48:36
    Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500BEVE-00WZT0 rev.01.01A01
    Running: huw9xztk.exe; Driver: C:\Users\BossMan\AppData\Local\Temp\kwdiykow.sys


    ---- System - GMER 1.0.15 ----

    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwAddBootEntry [0x8838F130]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwAlpcSendWaitReceivePort [0x8839131C]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwCreateEvent [0x88390CE2]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwCreateEventPair [0x88390D3A]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwCreateIoCompletion [0x88390E50]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwCreateMutant [0x88390C38]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwCreateSection [0x88390D8A]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwCreateSemaphore [0x88390C8C]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwCreateTimer [0x88390DFE]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwDeleteBootEntry [0x8838F154]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwLoadDriver [0x8838EF5C]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwModifyBootEntry [0x8838F178]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwOpenEvent [0x88390D12]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwOpenEventPair [0x88390D62]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwOpenIoCompletion [0x88390E7A]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwOpenMutant [0x88390C64]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwOpenSection [0x88390DCA]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwOpenSemaphore [0x88390CBA]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwOpenTimer [0x88390E28]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwQueryObject [0x8838FB48]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwReplyWaitReceivePort [0x883916F6]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwReplyWaitReceivePortEx [0x883912F0]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwSetBootEntryOrder [0x8838F19C]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwSetBootOptions [0x8838F1C0]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwSetSystemInformation [0x8838EFB6]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwShutdownSystem [0x8838F0C6]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/ALWIL Software) ZwSystemDebugControl [0x8838F0D8]

    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0x8EE39B9C]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

    ---- Kernel code sections - GMER 1.0.15 ----

    .text ntoskrnl.exe!ZwSaveKeyEx + 13B1 82C3D8E9 1 Byte [06]
    .text ntoskrnl.exe!KiDispatchInterrupt + 5A2 82C5D3D2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
    .text ntoskrnl.exe!KeRemoveQueueEx + 138B 82C64658 4 Bytes [30, F1, 38, 88]
    .text ntoskrnl.exe!KeRemoveQueueEx + 1403 82C646D0 4 Bytes [1C, 13, 39, 88]
    .text ntoskrnl.exe!KeRemoveQueueEx + 1467 82C64734 8 Bytes [E2, 0C, 39, 88, 3A, 0D, 39, ...] {LOOP 0xe; CMP [EAX-0x77c6f2c6], ECX}
    .text ntoskrnl.exe!KeRemoveQueueEx + 1473 82C64740 4 Bytes [50, 0E, 39, 88]
    .text ntoskrnl.exe!KeRemoveQueueEx + 148F 82C6475C 4 Bytes [38, 0C, 39, 88]
    .text ...
    ? System32\Drivers\spgo.sys The system cannot find the path specified. !
    .text USBPORT.SYS!DllUnload 8F061CA0 5 Bytes JMP 8583B1D8
    PAGE spsys.sys!?SPRevision@@3PADA + 4F90 9E618000 290 Bytes [8B, FF, 55, 8B, EC, 33, C0, ...]
    PAGE spsys.sys!?SPRevision@@3PADA + 50B3 9E618123 629 Bytes [35, 61, 9E, FE, 05, 34, 35, ...]
    PAGE spsys.sys!?SPRevision@@3PADA + 5329 9E618399 101 Bytes [6A, 28, 59, A5, 5E, C6, 03, ...]
    PAGE spsys.sys!?SPRevision@@3PADA + 538F 9E6183FF 148 Bytes [18, 5D, C2, 14, 00, 8B, FF, ...]
    PAGE spsys.sys!?SPRevision@@3PADA + 543B 9E6184AB 2228 Bytes [8B, FF, 55, 8B, EC, FF, 75, ...]
    PAGE ...

    ---- Kernel IAT/EAT - GMER 1.0.15 ----

    IAT \SystemRoot\system32\DRIVERS\pci.sys[ntoskrnl.exe!IoDetachDevice] [87A5AECE] \SystemRoot\System32\Drivers\spgo.sys
    IAT \SystemRoot\system32\DRIVERS\pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [87A5AF22] \SystemRoot\System32\Drivers\spgo.sys
    IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [87A2D90E] \SystemRoot\System32\Drivers\spgo.sys
    IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [87A2DF9C] \SystemRoot\System32\Drivers\spgo.sys
    IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortUlong] [87A2D3E6] \SystemRoot\System32\Drivers\spgo.sys
    IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [87A2E178] \SystemRoot\System32\Drivers\spgo.sys
    IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [87A2D1D4] \SystemRoot\System32\Drivers\spgo.sys
    IAT \SystemRoot\system32\DRIVERS\ataport.SYS[ntoskrnl.exe!KeInsertQueueDpc] 846875B8

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x52 0xC7 0x8F 0x2B ...
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ...
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x2A 0x7C 0x19 0x45 ...
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xC8 0x81 0xC6 0x1A ...
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg41
    Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg41@ujdew 0xA9 0x9B 0x03 0x8B ...
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x52 0xC7 0x8F 0x2B ...
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ...
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x2A 0x7C 0x19 0x45 ...
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xC8 0x81 0xC6 0x1A ...
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg41 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg41@ujdew 0xA9 0x9B 0x03 0x8B ...
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3D2AA401-6F3E-4D11-89DC-5958E053DE3D}
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D2AA401-6F3E-4D11-89DC-5958E053DE3D}
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D2AA401-6F3E-4D11-89DC-5958E053DE3D}@Path \Microsoft\Windows Defender\MP Scheduled Scan
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D2AA401-6F3E-4D11-89DC-5958E053DE3D}@Triggers 0x15 0x00 0x00 0x00 ...
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D2AA401-6F3E-4D11-89DC-5958E053DE3D}@DynamicInfo 0x03 0x00 0x00 0x00 ...
    Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows Defender\MP Scheduled Scan@Id {3D2AA401-6F3E-4D11-89DC-5958E053DE3D}
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CC94C560-BC0C-3B3F-30BA-F5C7760C0683}
    Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CC94C560-BC0C-3B3F-30BA-F5C7760C0683}@nabjnkjbnceddmaepmpgfoonalnm 0x6A 0x61 0x6F 0x6B ...

    ---- EOF - GMER 1.0.15 ----

    Using DDS
    .
    DDS (Ver_2011-06-23.01) - NTFSx86
    Internet Explorer: 8.0.7600.16385
    Run by BossMan at 21:54:26 on 2011-07-02
    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1023.112 [GMT -4:00]
    .
    AV: avast! Internet Security *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
    SP: avast! Internet Security *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    FW: avast! Internet Security *Enabled* {FB460EB6-4C6D-E564-6BF5-EEEF2B44B473}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\wltrysvc.exe
    C:\Windows\System32\bcmwltry.exe
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\Program Files\Alwil Software\Avast5\afwServ.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\taskhost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
    C:\Windows\system32\lxbacoms.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    C:\Program Files\Visual Web Ripper\WebRipperService.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    C:\Windows\system32\taskmgr.exe
    C:\Users\BossMan\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\BossMan\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\BossMan\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\rundll32.exe
    C:\Users\BossMan\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.bing.com/?pc=Z001&form=ZGAPHP
    uInternet Settings,ProxyOverride = *.local;127.0.0.1
    uInternet Settings,ProxyServer = 127.0.0.1:8777
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
    BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
    BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL
    TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
    TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
    EB: iOpus iMacros: {0483894e-2422-45e0-8384-021aff1af3cd} - c:\program files\imacros\imacros.dll
    EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
    uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\AxAutoMntSrv.exe" -automount
    uRun: [Logitech Vid] "c:\program files\logitech\vid hd\Vid.exe" -bootmode
    uRun: [Google Update] "c:\users\bossman\appdata\local\google\update\GoogleUpdate.exe" /c
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [nwiz] nwiz.exe /installquiet
    mRun: [UIUCU] c:\users\bossman\appdata\local\temp\UIUCU.EXE -CLEAN_UP -S
    mRun: [Broadcom Wireless Manager UI] c:\windows\system32\bcmntray
    mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
    mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
    mRun: [<NO NAME>]
    mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
    mRun: [AutoKMS] c:\windows\AutoKMS.exe
    mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105
    IE: {0483894E-2422-45E0-8384-021AFF1AF3CD} - {0483894E-2422-45E0-8384-021AFF1AF3CD} - c:\program files\imacros\imacros.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: DhcpNameServer = 192.168.10.1
    TCP: Interfaces\{99A43DDF-6205-448D-93A4-362936B19B29} : DhcpNameServer = 192.168.10.1
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [2010-9-30 12112]
    R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [2010-9-30 188168]
    R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [2010-9-30 99280]
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2010-9-30 312912]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-9-30 165456]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-9-30 17744]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-9-30 50256]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-30 40384]
    R2 avast! Firewall;avast! Firewall;c:\program files\alwil software\avast5\afwServ.exe [2010-9-30 119200]
    R2 lxba_device;lxba_device;c:\windows\system32\lxbacoms.exe -service --> c:\windows\system32\lxbacoms.exe -service [?]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-7-2 366640]
    R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2009-12-23 370688]
    R2 VisualWebRipper;Visual Web Ripper;c:\program files\visual web ripper\WebRipperService.exe [2009-10-29 13824]
    R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-30 40384]
    R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-30 40384]
    R3 EMCR;EMCR;c:\windows\system32\drivers\EMCR7SK.sys [2004-9-10 104960]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-7-2 22712]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-7-2 39984]
    S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-1-21 30963576]
    S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
    S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-10-1 1343400]
    S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-3-31 47128]
    S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]
    S4 SQLAgent$MSSMLBIZ;SQL Server Agent (MSSMLBIZ);c:\program files\microsoft sql server\mssql10.mssmlbiz\mssql\binn\SQLAGENT.EXE [2009-3-30 366936]
    .
    =============== Created Last 30 ================
    .
    2011-07-02 21:11:25 -------- d-----w- c:\users\bossman\appdata\roaming\Malwarebytes
    2011-07-02 21:11:12 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-07-02 21:11:11 -------- d-----w- c:\programdata\Malwarebytes
    2011-07-02 21:11:08 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-07-02 21:11:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-07-01 13:49:05 -------- d-----w- c:\program files\Visiosonic
    2011-07-01 06:09:34 -------- d-----w- c:\program files\Emission
    2011-07-01 06:07:40 -------- d-----w- c:\users\bossman\appdata\local\PCDJ Dex
    2011-07-01 06:04:35 -------- d-----w- c:\program files\PCDJ DEX
    2011-07-01 05:45:10 389120 ----a-w- c:\windows\system32\actskn43.ocx
    2011-07-01 05:45:10 166600 ----a-w- c:\windows\system32\MSMASK32.OCX
    2011-06-25 07:49:38 7074640 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{36442c5d-732c-4c88-97f7-8b454ee82ab4}\mpengine.dll
    .
    ==================== Find3M ====================
    .
    2011-05-24 23:14:10 222080 ------w- c:\windows\system32\MpSigStub.exe
    .
    ============= FINISH: 21:55:51.67 ===============

    And Attach.TXT
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-23.01)
    .
    Microsoft Windows 7 Ultimate
    Boot Device: \Device\HarddiskVolume1
    Install Date: 9/30/2010 12:33:06 PM
    System Uptime: 7/2/2011 9:10:03 PM (0 hours ago)
    .
    Motherboard: Hewlett-Packard | | 0880
    Processor: Intel(R) Pentium(R) 4 CPU 3.20GHz | WMT478/NWD | 3192/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 184 GiB total, 125.79 GiB free.
    D: is CDROM ()
    F: is CDROM ()
    G: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP112: 5/6/2011 6:38:08 AM - Windows Update
    RP113: 5/13/2011 11:38:12 AM - Windows Update
    RP114: 5/18/2011 2:38:24 AM - Windows Update
    RP115: 6/10/2011 10:36:41 PM - Scheduled Checkpoint
    RP116: 6/13/2011 12:18:33 PM - Windows Update
    RP117: 6/14/2011 12:04:49 PM - Windows Update
    RP118: 6/17/2011 8:24:13 AM - Windows Update
    RP119: 6/21/2011 4:14:30 PM - Windows Update
    RP120: 6/25/2011 3:49:04 AM - Windows Update
    RP122: 7/1/2011 1:53:51 AM - Windows Defender Checkpoint
    .
    ==== Installed Programs ======================
    .
    Add or Remove Adobe Creative Suite 3 Master Collection
    Adobe Acrobat 8 Professional
    Adobe After Effects CS3
    Adobe After Effects CS3 Presets
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe BridgeTalk Plugin CS3
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Color - Photoshop Specific
    Adobe Color Common Settings
    Adobe Color EU Extra Settings
    Adobe Color JA Extra Settings
    Adobe Color NA Recommended Settings
    Adobe Contribute CS3
    Adobe Creative Suite 3 Master Collection
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe Digital Editions
    Adobe Dreamweaver CS3
    Adobe Encore CS3
    Adobe Encore CS3 Codecs
    Adobe ExtendScript Toolkit 2
    Adobe Extension Manager CS3
    Adobe Fireworks CS3
    Adobe Flash CS3
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Flash Video Encoder
    Adobe Fonts All
    Adobe Help Viewer CS3
    Adobe Illustrator CS3
    Adobe InDesign CS3
    Adobe InDesign CS3 Icon Handler
    Adobe Linguistics CS3
    Adobe MotionPicture Color Files
    Adobe PDF Library Files
    Adobe Photoshop CS3
    Adobe Premiere Pro CS3
    Adobe Premiere Pro CS3 Functional Content
    Adobe Premiere Pro CS3 Third Party Content
    Adobe Setup
    Adobe SING CS3
    Adobe Soundbooth CS3
    Adobe Soundbooth CS3 Codecs
    Adobe Stock Photos CS3
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe Version Cue CS3 Server
    Adobe Video Profiles
    Adobe WAS CS3
    Adobe WinSoft Linguistics Plugin
    Adobe XMP DVA Panels CS3
    Adobe XMP Panels CS3
    AHV content for Acrobat and Flash
    Aimersoft Video Converter Ultimate(Build 4.1.0.2)
    Amazon Kindle For PC
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Artisteer 2
    AutoPlay Media Studio 8
    avast! Internet Security
    Bonjour
    Broadcom 802.11 Wireless LAN Adapter
    Broadcom Wireless Utility
    Business Contact Manager for Microsoft Outlook 2010
    CameraHelperMsi
    Conexant 56K ACLink Modem
    Conexant AC-Link Audio
    Definition update for Microsoft Office 2010 (KB982726)
    erLT
    Extensis Suitcase Fusion 2
    FileZilla Client 3.3.4.1
    Google Chrome
    Higher Score on the SAT/PSAT
    iMacros V6.90
    ImTOO Video Converter Ultimate 6
    iTunes
    Lexmark X5100 Series
    Logitech Vid HD
    Logitech Webcam Software
    LWS Facebook
    LWS Gallery
    LWS Help_main
    LWS Launcher
    LWS Motion Detection
    LWS Pictures And Video
    LWS Video Mask Maker
    LWS VideoEffects
    LWS Webcam Software
    LWS WLM Plugin
    LWS YouTube Plugin
    Magic ISO Maker v5.5 (build 0265)
    Malwarebytes' Anti-Malware version 1.51.0.1200
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft Chart Controls for Microsoft .NET Framework 3.5
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Groove MUI (English) 2010
    Microsoft Office InfoPath MUI (English) 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional Plus 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Primary Interoperability Assemblies 2005
    Microsoft Silverlight
    Microsoft SQL Server 2008
    Microsoft SQL Server 2008 Browser
    Microsoft SQL Server 2008 Common Files
    Microsoft SQL Server 2008 Database Engine Services
    Microsoft SQL Server 2008 Database Engine Shared
    Microsoft SQL Server 2008 Native Client
    Microsoft SQL Server 2008 RsFx Driver
    Microsoft SQL Server 2008 Setup Support Files
    Microsoft SQL Server VSS Writer
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft® Office Language Pack 2010 – English (Business Contact Manager for Microsoft Outlook 2010)
    Miro
    Mobipocket Reader 6.2
    MSVCRT Redists
    NVIDIA Display Driver
    PCDJ DEX (remove only)
    PCDJ FX VRM
    PCDJ KJ
    PDF Settings
    Printer's Plan
    QuickTime
    REALTEK Gigabit and Fast Ethernet NIC Driver
    Search Toolbar
    Service Pack 1 for SQL Server 2008 (KB968369)
    Songbird 1.8.0 (Build 1800)
    Sql Server Customer Experience Improvement Program
    TransMac version 9.1
    Vegas Pro 10.0
    Visual Web Ripper
    VLC media player 1.1.5
    WinMend Folder Hidden 1.4.1
    WinRAR archiver
    .
    ==== Event Viewer Messages From Past Week ========
    .
    7/2/2011 5:07:40 AM, Error: Service Control Manager [7023] - The Server service terminated with the following error: The data is invalid.
    7/2/2011 5:07:39 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: A system shutdown is in progress.
    7/2/2011 4:39:09 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    7/2/2011 4:09:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    7/2/2011 4:09:53 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    7/2/2011 4:09:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    7/2/2011 4:09:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    7/2/2011 4:09:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    7/2/2011 4:09:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD aswFW aswRdr aswSnx aswSP aswTdi CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr sptd tdx Wanarpv6 WfpLwf
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    7/2/2011 4:09:32 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    7/2/2011 4:09:16 PM, Error: sptd [4] - Driver detected an internal error in its data structures for .
    7/2/2011 4:08:21 PM, Error: Service Control Manager [7024] - The Superfetch service terminated with service-specific error The operation completed successfully..
    7/2/2011 12:07:41 AM, Error: Service Control Manager [7023] - The Server service terminated with the following error: The service has not been started.
    7/2/2011 12:07:38 AM, Error: Service Control Manager [7000] - The Diagnostic System Host service failed to start due to the following error: A system shutdown is in progress.
    7/2/2011 1:16:22 AM, Error: Service Control Manager [7038] - The lmhosts service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: The request is not supported. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
    7/2/2011 1:16:22 AM, Error: Service Control Manager [7000] - The TCP/IP NetBIOS Helper service failed to start due to the following error: The service did not start due to a logon failure.
    7/1/2011 7:26:20 PM, Error: Service Control Manager [7023] - The iPod Service service terminated with the following error: %%-2147417831
    6/30/2011 5:39:36 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.
    6/30/2011 3:21:32 PM, Error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
    6/29/2011 8:16:28 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
    6/29/2011 11:11:58 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
    6/27/2011 8:58:36 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR2.
    6/27/2011 1:30:06 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR4.
    6/26/2011 2:03:52 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
    6/25/2011 12:34:43 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR3.
    .
    ==== End Of File ===========================

    Any advice on a recommended course of action is greatly appreciated.

    Many Thanks
     
  2. Broni

    Broni Malware Annihilator Posts: 52,903   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ====================================================================

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    Click the "Scan" button to start scan:
    [​IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [​IMG]

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    ===================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  3. Jaeyung

    Jaeyung TS Rookie Topic Starter

    aswMBR log

    Thank you so much for replying to the post.

    Below is a copy of log after aswMBR processed.


    aswMBR version 0.9.7.675 Copyright(c) 2011 AVAST Software
    Run date: 2011-07-03 16:02:19
    -----------------------------
    16:02:19.437 OS Version: Windows 6.1.7600
    16:02:19.437 Number of processors: 2 586 0x209
    16:02:19.437 ComputerName: BOSSMAN-LAPTOP UserName: BossMan
    16:02:24.421 Initialize success
    16:02:24.906 AVAST engine defs: 11070300
    16:02:27.953 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
    16:02:27.953 Disk 0 Vendor: WDC_WD2500BEVE-00WZT0 01.01A01 Size: 238475MB BusType: 3
    16:02:29.968 Disk 0 MBR read successfully
    16:02:29.968 Disk 0 MBR scan
    16:02:30.015 Disk 0 Windows 7 default MBR code
    16:02:32.015 Disk 0 scanning sectors +385994752
    16:02:32.062 Disk 0 scanning C:\Windows\system32\drivers
    16:02:40.812 Service scanning
    16:02:42.906 Disk 0 trace - called modules:
    16:02:42.953 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS intelide.sys PCIIDEX.SYS atapi.sys
    16:02:42.968 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84818030]
    16:02:42.968 3 CLASSPNP.SYS[876d659e] -> nt!IofCallDriver -> [0x847338e8]
    16:02:42.968 5 ACPI.sys[86f643b2] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84723610]
    16:02:43.718 AVAST engine scan C:\Windows
    16:03:45.640 File: C:\Windows\explorer.exe **INFECTED** Win32:Bamital-AQ
    16:11:24.687 File: C:\Windows\System32\wininit.exe **INFECTED** Win32:Bamital-AQ
    16:39:50.218 AVAST engine scan C:\Users\BossMan
    16:52:24.328 AVAST engine scan C:\ProgramData
    16:56:04.203 Scan finished successfully
    16:59:06.781 Disk 0 MBR has been saved successfully to "C:\Users\BossMan\Desktop\MBR.dat"
    16:59:06.796 The log file has been saved successfully to "C:\Users\BossMan\Desktop\aswMBR.txt"

    I also ran Combofix, but couldn't find the log. There is a file called "catchme.txt".

    it contains:
    File "C:\ComboFix\MT_explorer.exe.tmp" added successfully

    I didn't run RKill at this time. Please let me know if I need to download and run RKill. Also, let me know if I should be looking for the actual log file for combofix in a different location.

    At this time, the computer rebooted and the desktop appears. I will await your response before moving forward.

    Thank you so much.
     
  4. Broni

    Broni Malware Annihilator Posts: 52,903   +344

    If produced, the log should be located in C:\combofix.txt.
    If not there, re-run Combofix.
     
  5. Jaeyung

    Jaeyung TS Rookie Topic Starter

    Combofix scan log

    Good morning,

    here is the combofix log:


    ComboFix 11-07-03.01 - BossMan 07/03/2011 18:23:01.1.2 - x86
    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1023.373 [GMT -4:00]
    Running from: C:\Users\BossMan\Desktop\ComboFix.exe
    AV: avast! Internet Security *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
    FW: avast! Internet Security *Enabled* {FB460EB6-4C6D-E564-6BF5-EEEF2B44B473}
    SP: avast! Internet Security *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\Program Files\Search Toolbar
    C:\Program Files\Search Toolbar\icon.ico
    C:\Program Files\Search Toolbar\SearchToolbar.dll
    C:\Program Files\Search Toolbar\SearchToolbarUninstall.exe
    C:\Program Files\Search Toolbar\SearchToolbarUpdater.exe

    Infected copy of C:\Windows\explorer.exe was found and disinfected
    Restored copy from - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

    Infected copy of C:\Windows\System32\wininit.exe was found and disinfected
    Restored copy from - C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

    Infected copy of C:\Windows\explorer.exe was found and disinfected
    Restored copy from - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

    ((((((((((((((((((((((((( Files Created from 2011-06-03 to 2011-07-03 )))))))))))))))))))))))))))))))


    2011-07-03 23:08:34 . 2011-07-03 23:12:08 -------- d-----w- C:\Users\BossMan\AppData\Local\temp
    2011-07-03 23:08:34 . 2011-07-03 23:08:34 -------- d-----w- C:\Users\Default\AppData\Local\temp
    2011-07-03 22:10:29 . 2011-07-03 22:10:47 -------- d-----w- C:\32788R22FWJFW
    2011-07-03 11:38:29 . 2011-06-07 15:55:46 7074640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E2F3B781-54FB-4724-A489-1ECAFDC2ED07}\mpengine.dll
    2011-07-02 21:11:25 . 2011-07-02 21:11:25 -------- d-----w- C:\Users\BossMan\AppData\Roaming\Malwarebytes
    2011-07-02 21:11:12 . 2011-05-29 13:11:30 39984 ----a-w- C:\Windows\system32\drivers\mbamswissarmy.sys
    2011-07-02 21:11:11 . 2011-07-02 21:11:11 -------- d-----w- C:\ProgramData\Malwarebytes
    2011-07-02 21:11:08 . 2011-05-29 13:11:20 22712 ----a-w- C:\Windows\system32\drivers\mbam.sys
    2011-07-02 21:11:07 . 2011-07-02 21:11:15 -------- d-----w- C:\Program Files\Malwarebytes' Anti-Malware
    2011-07-01 13:49:05 . 2011-07-01 13:49:05 -------- d-----w- C:\Program Files\Visiosonic
    2011-07-01 06:09:34 . 2011-07-01 06:09:34 -------- d-----w- C:\Program Files\Emission
    2011-07-01 06:07:40 . 2011-07-01 06:08:15 -------- d-----w- C:\Users\BossMan\AppData\Local\PCDJ Dex
    2011-07-01 06:04:35 . 2011-07-01 06:07:10 -------- d-----w- C:\Program Files\PCDJ DEX
    2011-07-01 05:45:10 . 2003-05-15 00:07:16 389120 ----a-w- C:\Windows\system32\actskn43.ocx
    2011-07-01 05:45:10 . 2000-05-22 03:00:00 166600 ----a-w- C:\Windows\system32\MSMASK32.OCX
    .


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2011-05-24 23:14:10 . 2010-09-30 14:06:13 222080 ------w- C:\Windows\system32\MpSigStub.exe


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
    @="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
    [HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
    2010-06-28 20:59:35 153184 ----a-w- C:\Program Files\Alwil Software\Avast5\snxPlugins.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2009-11-15 09:42:00 33120]
    "Logitech Vid"="C:\Program Files\Logitech\Vid HD\Vid.exe" [2010-10-29 20:06:08 5915480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Broadcom Wireless Manager UI"="C:\Windows\system32\bcmntray" [X]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2004-03-12 18:57:00 3067904]
    "nwiz"="nwiz.exe" [2004-03-12 18:57:00 753664]
    "avast5"="C:\Program Files\Alwil Software\Avast5\avastUI.exe" [2010-06-28 20:57:18 2837864]
    "BCSSync"="C:\Program Files\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 21:22:24 91520]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2010-09-08 15:17:42 421888]
    "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-11 02:46:20 624248]
    "AutoKMS"="C:\Windows\AutoKMS.exe" [2010-11-08 22:01:29 615936]
    "LWS"="C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 23:35:22 165208]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2010-11-11 05:40:24 421160]
    "Malwarebytes' Anti-Malware"="C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 13:11:28 449584]
    "Malwarebytes' Anti-Malware (reboot)"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 13:11:22 1047656]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 17:16:28 130384]
    R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\system32\drivers\mbamswissarmy.sys [2011-05-29 13:11:30 39984]
    R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 21:51:12 30963576]
    R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 00:37:50 4640000]
    R3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe [2010-10-01 19:46:12 1343400]
    R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-03-31 04:55:56 47128]
    R4 RsFx0103;RsFx0103 Driver;C:\Windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 07:09:28 239336]
    R4 SQLAgent$MSSMLBIZ;SQL Server Agent (MSSMLBIZ);C:\Program Files\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 07:23:24 366936]
    S0 aswNdis;avast! Firewall NDIS Filter Service;C:\Windows\system32\DRIVERS\aswNdis.sys [2010-06-28 20:10:45 12112]
    S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
    S0 sptd;sptd;C:\Windows\System32\Drivers\sptd.sys [2010-09-30 14:56:43 697328]
    S1 aswFW;avast! TDI Firewall driver; [x]
    S1 aswSnx;aswSnx; [x]
    S1 aswSP;aswSP; [x]
    S2 aswFsBlk;aswFsBlk; [x]
    S2 aswMonFlt;aswMonFlt;C:\Windows\system32\drivers\aswMonFlt.sys [2010-06-28 20:32:56 50256]
    S2 avast! Firewall;avast! Firewall;C:\Program Files\Alwil Software\Avast5\afwServ.exe [2010-06-28 20:57:02 119200]
    S2 lxba_device;lxba_device;C:\Windows\system32\lxbacoms.exe [2007-04-24 23:24:14 537520]
    S2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 13:11:28 366640]
    S2 VisualWebRipper;Visual Web Ripper;C:\Program Files\Visual Web Ripper\WebRipperService.exe [2009-10-29 15:16:32 13824]
    S3 EMCR;EMCR;C:\Windows\system32\DRIVERS\EMCR7SK.sys [2004-09-10 13:44:28 104960]
    S3 MBAMProtector;MBAMProtector;C:\Windows\system32\drivers\mbam.sys [2011-05-29 13:11:20 22712]


    Contents of the 'Scheduled Tasks' folder

    2011-06-30 C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004909610-591445500-1520345124-1000Core.job
    - C:\Users\BossMan\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-31 13:13:43 . 2011-03-31 13:13:42]

    2011-07-03 C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004909610-591445500-1520345124-1000UA.job
    - C:\Users\BossMan\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-31 13:13:43 . 2011-03-31 13:13:42]


    ------- Supplementary Scan -------

    uStart Page = hxxp://www.bing.com/?pc=Z001&form=ZGAPHP
    uInternet Settings,ProxyOverride = *.local;127.0.0.1
    uInternet Settings,ProxyServer = 127.0.0.1:8777
    IE: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
    TCP: DhcpNameServer = 192.168.10.1

    - - - - ORPHANS REMOVED - - - -

    AddRemove-Search Toolbar - C:\Program Files\Search Toolbar\SearchToolbarUninstall.exe

    Please let me know if I need to perform other scans. The computer is booting up with the desktop and taskbar present.

    Thanks again.
     
  6. Broni

    Broni Malware Annihilator Posts: 52,903   +344

    Very well.

    Combofix log looks pretty good (the very low part of the log is missing, so make sure in the future you post whole logs).

    I want you to re-run Avast scan and see, if it still complains about Bamital.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...