TechSpot

Broni: Please review these post-cleanup, Spymaxx logs!

By drwizgeek
Sep 30, 2010
  1. Hello Broni:

    I cleaned up this infection on this HP Pavilion ZE2000 a few months ago. But, you did such an excellent job directing our last cleanup (techspot.com/vb/topic152066.html) that I decided to apply your "UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions" (techspot.com/vb/topic58138.html) to this laptop again.

    Here are the logs for Malwarebytes Anti-Malware, GMER (will be posted later tonight), and DDS, plus the zipped Attach.txt file, as instructed:

    Apparently I forgot to post these logs before leaving town. Rest assured that this laptop was just sitting on my desk and nothing has changed on it since then. I would appreciate it if you could review these logs so that we could remove all the leftover items and "free loaders" (I see quite a few issues, e.g. shopperreports.com). I thank you all in advance.

    Best regards,
    Wiz
    _______________________
    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4636

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 7.0.5730.13

    9/17/2010 12:50:57 AM
    mbam-log-2010-09-17 (00-50-57).txt

    Scan type: Full scan (C:\|)
    Objects scanned: 254594
    Time elapsed: 1 hour(s), 34 minute(s), 57 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
    ________________________

    DDS (Ver_10-03-17.01) - NTFSx86
    Run by troubleshooter at 20:00:52.89 on Sat 09/18/2010
    Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_21
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.382.184 [GMT -7:00]

    AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    svchost.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\vsnpstd2.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\HPQ\SHARED\HPQWMI.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\troubleshooter\fall10\troubleshooting\security_sw_aug_10\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
    uInternet Connection Wizard,ShellNext = hxxp://www.shopperreports.com/Installation/Browsing/Uninstall.aspx?partner=ShopperReports&group=SR&UID=&bar_ver=2.0.26&CID=BD924F070000000000000014A51343C00B21AC31&IID=890900BC3EE54E4D8584B98326A40A5B675F4DD3&BANNER_ID=7012000003&REQUESTOR_ID=431303&COUNTRY=US&SG=&USER_CREATE_DATE=05/07/2008%2006:58:29&Affiliate_Id=1000007012&ie_user_agent=Mozilla%2f4%2e0%20%28compatible%3b%20MSIE%207%2e0%3b%20Windows%20NT%205%2e1%3b%20%2eNET%20CLR%201%2e1%2e4322%3b%20SpamBlockerUtility%204%2e8%2e4%29
    mWinlogon: SFCDisable=4 (0x4)
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3"
    mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [SNPSTD2] c:\windows\vsnpstd2.exe
    mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
    mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
    mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
    mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
    mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
    mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
    mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
    mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min /ns
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
    IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226710311859
    DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    Notify: AtiExtEvent - Ati2evxx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    Hosts: 127.0.0.1 www.spywareinfo.com

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\troubl~1\applic~1\mozilla\firefox\profiles\euyovg51.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
    c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
    c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

    ============= SERVICES / DRIVERS ===============

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-9-5 64288]
    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-8-28 11608]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-8-28 135336]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-8-28 267432]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-8-28 60936]
    R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2004-12-15 231424]
    S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-6-21 1355928]

    =============== Created Last 30 ================

    2010-09-14 04:52:47 0 d-----w- c:\windows\system32\NtmsData
    2010-09-06 08:00:44 0 d-----w- c:\windows\system32\Adobe
    2010-09-06 03:14:30 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
    2010-09-06 03:00:41 0 d-----w- c:\program files\CCleaner
    2010-09-05 22:44:29 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-09-05 22:44:28 423656 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-05 21:02:27 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2010-09-05 21:02:11 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-09-05 20:49:38 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}
    2010-09-05 20:47:23 0 d-----w- c:\program files\Lavasoft
    2010-09-05 20:16:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-09-05 20:16:15 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-09-05 20:16:14 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-08-31 04:31:07 0 d-----w- c:\docume~1\troubl~1\applic~1\Avira
    2010-08-28 23:33:54 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2010-08-28 23:33:46 0 d-----w- c:\program files\Avira
    2010-08-28 23:33:46 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
    2010-08-22 23:39:15 1089601 ------w- c:\windows\system32\dllcache\ntprint.cat
    2010-08-22 18:25:39 0 d-----w- C:\9b7c9b801108a1a6247ab5c9
    2010-08-22 18:24:07 0 d-----w- c:\windows\SxsCaPendDel

    ==================== Find3M ====================


    ============= FINISH: 20:02:20.65 ===============
    ___________________
    GMER log will be posted later tonight; I don't have it with me at this workstation.
     

    Attached Files:

  2. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Thank you for kudos :)

    Please, never zip any logs.

    I'll be waiting for your GMER scan....
     
  3. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    Hello Broni:

    Thanks for your prompt response. DDS instructions were to zip and attach its "attach.txt" file instead of posting it. Here is the GMER log:

    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit scan 2010-09-17 23:05:06
    Windows 5.1.2600 Service Pack 2
    Running: n5smmqiu.exe; Driver: C:\DOCUME~1\TROUBL~1\LOCALS~1\Temp\kflyqaow.sys


    ---- System - GMER 1.0.15 ----

    SSDT F7D39FC6 ZwCreateKey
    SSDT F7D39FBC ZwCreateThread
    SSDT F7D39FCB ZwDeleteKey
    SSDT F7D39FD5 ZwDeleteValueKey
    SSDT F7D39FDA ZwLoadKey
    SSDT F7D39FA8 ZwOpenProcess
    SSDT F7D39FAD ZwOpenThread
    SSDT F7D39FE4 ZwReplaceKey
    SSDT F7D39FDF ZwRestoreKey
    SSDT F7D39FD0 ZwSetValueKey

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)

    ---- EOF - GMER 1.0.15 ----

    I look forward to receiving your advice for a complete cleanup of this laptop with its limited resources. Thank you again!
     
  4. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    ======================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  5. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    MBRcheck and Combofix Reports, Part 1

    Hello Broni:

    Thank you very much for your prompt action. Combofix deleted several files and two folders. Here are the MBRcheck and Combofix Reports. We don't need anything from AOL, or any toolbars or updating/IM service from google, yahoo...

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Home Edition
    Windows Information: Service Pack 2 (build 2600)
    Logical Drives Mask: 0x0000000c

    Kernel Drivers (total 134):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806CE000 \WINDOWS\system32\hal.dll
    0xF7AFC000 \WINDOWS\system32\KDCOM.DLL
    0xF7A0C000 \WINDOWS\system32\BOOTVID.dll
    0xF74CD000 ACPI.sys
    0xF7AFE000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF74BC000 pci.sys
    0xF75FC000 isapnp.sys
    0xF760C000 ohci1394.sys
    0xF761C000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
    0xF7A10000 compbatt.sys
    0xF7A14000 \WINDOWS\system32\DRIVERS\BATTC.SYS
    0xF7BC4000 pciide.sys
    0xF787C000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF7B00000 intelide.sys
    0xF7B02000 viaide.sys
    0xF7B04000 aliide.sys
    0xF749E000 pcmcia.sys
    0xF762C000 MountMgr.sys
    0xF747F000 ftdisk.sys
    0xF7A18000 ACPIEC.sys
    0xF7BC5000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
    0xF7884000 PartMgr.sys
    0xF763C000 VolSnap.sys
    0xF7467000 atapi.sys
    0xF764C000 disk.sys
    0xF765C000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF7447000 fltMgr.sys
    0xF7435000 sr.sys
    0xF766C000 Lbd.sys
    0xF767C000 PxHelp20.sys
    0xF741E000 KSecDD.sys
    0xF7391000 Ntfs.sys
    0xF7364000 NDIS.sys
    0xF768C000 serial.sys
    0xF7349000 Mup.sys
    0xF7AB4000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0xF6A30000 \SystemRoot\system32\DRIVERS\AmdK8.sys
    0xF62B1000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
    0xF629D000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xF7924000 \SystemRoot\system32\DRIVERS\usbohci.sys
    0xF627A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF792C000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF6A20000 \SystemRoot\system32\DRIVERS\imapi.sys
    0xF76BC000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xF76CC000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xF6257000 \SystemRoot\system32\DRIVERS\ks.sys
    0xF7934000 \SystemRoot\SYSTEM32\DRIVERS\GEARAspiWDM.sys
    0xF76DC000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xF793C000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF6222000 \SystemRoot\system32\DRIVERS\SynTP.sys
    0xF7B1E000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF7944000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF6208000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
    0xF60B4000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
    0xF605E000 \SystemRoot\system32\drivers\camc6hal.sys
    0xF76EC000 \SystemRoot\system32\drivers\camc6aud.sys
    0xF603A000 \SystemRoot\system32\drivers\portcls.sys
    0xF76FC000 \SystemRoot\system32\drivers\drmk.sys
    0xF6001000 \SystemRoot\system32\DRIVERS\HSFHWATI.sys
    0xF5F04000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
    0xF5E54000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
    0xF794C000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF7AE0000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
    0xF7BC7000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF770C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF7AE4000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF5E3D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF771C000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF772C000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF7954000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF5E2C000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF773C000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF795C000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF7964000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF774C000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF7B24000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF5DF8000 \SystemRoot\system32\DRIVERS\update.sys
    0xF7AF4000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF775C000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF778C000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7B36000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF7C44000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7B38000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF7984000 \SystemRoot\System32\drivers\vga.sys
    0xF7B3A000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7B3C000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF798C000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF7994000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF7AB0000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xED792000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xED73A000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xED712000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xF63DB000 \SystemRoot\System32\drivers\ws2ifsl.sys
    0xED6F0000 \SystemRoot\System32\drivers\afd.sys
    0xF77BC000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xF799C000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
    0xED62E000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    0xF79A4000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    0xED603000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xED594000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF77DC000 \SystemRoot\System32\Drivers\Fips.SYS
    0xED573000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF77EC000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xF7B3E000 \??\C:\WINDOWS\system32\drivers\EABFiltr.sys
    0xF7C75000 \SystemRoot\System32\Drivers\BANTExt.sys
    0xED529000 \SystemRoot\system32\DRIVERS\avipbb.sys
    0xF7B4A000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
    0xF785C000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xED511000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF7B58000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xEDD48000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF78AC000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF7D52000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\ati2dvag.dll
    0xBF04E000 \SystemRoot\System32\ati2cqag.dll
    0xBF080000 \SystemRoot\System32\atikvmag.dll
    0xBF0B2000 \SystemRoot\System32\ati3duag.dll
    0xBF2E3000 \SystemRoot\System32\ativvaxx.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xB867B000 \SystemRoot\system32\DRIVERS\avgntflt.sys
    0xB866B000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xB8497000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xF7B74000 \SystemRoot\System32\Drivers\ASCTRM.SYS
    0xB8328000 \SystemRoot\system32\DRIVERS\srv.sys
    0xB83EB000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    0xB81FB000 \SystemRoot\system32\drivers\wdmaud.sys
    0xB853B000 \SystemRoot\system32\drivers\sysaudio.sys
    0xB7AE0000 \SystemRoot\System32\Drivers\HTTP.sys
    0xB78FD000 \SystemRoot\system32\drivers\kmixer.sys
    0xB7AC8000 \SystemRoot\system32\DRIVERS\asyncmac.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 39):
    0 System Idle Process
    4 System
    708 C:\WINDOWS\system32\smss.exe
    756 csrss.exe
    780 C:\WINDOWS\system32\winlogon.exe
    824 C:\WINDOWS\system32\services.exe
    844 C:\WINDOWS\system32\lsass.exe
    1004 C:\WINDOWS\system32\ati2evxx.exe
    1024 C:\WINDOWS\system32\svchost.exe
    1124 svchost.exe
    1164 C:\WINDOWS\system32\svchost.exe
    1232 svchost.exe
    1352 svchost.exe
    1612 C:\WINDOWS\system32\spoolsv.exe
    1656 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1700 svchost.exe
    1836 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    1872 C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    1892 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    1952 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    2012 C:\WINDOWS\system32\HPZipm12.exe
    2044 C:\WINDOWS\system32\svchost.exe
    420 C:\WINDOWS\system32\ati2evxx.exe
    532 C:\WINDOWS\explorer.exe
    1796 wmiprvse.exe
    208 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    356 C:\WINDOWS\vsnpstd2.exe
    416 C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
    412 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
    452 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    628 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    260 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    1752 C:\WINDOWS\system32\ctfmon.exe
    2328 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    2688 C:\WINDOWS\system32\wuauclt.exe
    2804 C:\Program Files\HPQ\Shared\hpqwmi.exe
    2896 alg.exe
    2120 C:\WINDOWS\system32\wuauclt.exe
    2308 C:\troubleshooter\fall10\troubleshooting\security_sw_aug_10\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: TOSHIBAMK6025GAS, Rev: KA201A

    Size Device Name MBR Status
    --------------------------------------------
    55 GB \\.\PhysicalDrive0 Unknown MBR code
    SHA1: BBF289AC40BA09F2CC1797655D4799D2AB148CB5


    Found non-standard or infected MBR.
    Enter 'Y' and hit ENTER for more options, or 'N' to exit:

    Done!
    _________________________

    Continued...
     
  6. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    MBRcheck and Combofix Reports, Part 2

    ComboFix 10-10-01.01 - troubleshooter 10/01/2010 20:59:31.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.382.174 [GMT -7:00]
    Running from: c:\documents and settings\troubleshooter\Desktop\ComboFix.exe
    AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\Common Files\Companion Wizard
    c:\program files\RcvSystem
    c:\windows\ihghkj.ini
    c:\windows\klopru.ini
    c:\windows\mainms.vpi
    c:\windows\megavid.cdt
    c:\windows\muotr.so
    c:\windows\system32\stera.log
    c:\windows\system32\tmp.reg
    c:\windows\vutttv.ini
    c:\windows\wacehk.ini

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_FOPN
    -------\Legacy_MSSECURITY1.209.4


    ((((((((((((((((((((((((( Files Created from 2010-09-02 to 2010-10-02 )))))))))))))))))))))))))))))))
    .

    2010-09-14 04:52 . 2010-09-14 04:54 -------- d-----w- c:\windows\system32\NtmsData
    2010-09-06 08:00 . 2010-09-06 08:00 -------- d-----w- c:\windows\system32\Adobe
    2010-09-06 03:14 . 2008-02-27 21:49 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
    2010-09-06 03:02 . 2010-09-06 03:02 388096 ----a-r- c:\documents and settings\troubleshooter\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2010-09-06 03:00 . 2010-09-06 03:00 -------- d-----w- c:\program files\CCleaner
    2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\program files\Common Files\Apple
    2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Apple
    2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\program files\Apple Software Update
    2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
    2010-09-05 22:44 . 2010-09-05 22:44 503808 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcp71.dll
    2010-09-05 22:44 . 2010-09-05 22:44 499712 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\jmc.dll
    2010-09-05 22:44 . 2010-09-05 22:44 61440 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-sse.dll
    2010-09-05 22:44 . 2010-09-05 22:44 348160 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcr71.dll
    2010-09-05 22:44 . 2010-09-05 22:44 12800 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-d3d.dll
    2010-09-05 22:44 . 2010-09-05 22:43 423656 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-05 21:02 . 2010-09-05 21:02 -------- dc----w- c:\windows\system32\DRVSTORE
    2010-09-05 21:02 . 2010-06-21 17:44 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2010-09-05 21:02 . 2010-09-05 21:02 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-09-05 20:50 . 2010-09-05 20:50 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Sunbelt Software
    2010-09-05 20:49 . 2010-06-21 17:52 2978768 -c--a-w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe
    2010-09-05 20:49 . 2010-09-05 20:50 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}
    2010-09-05 20:47 . 2010-09-05 20:47 -------- d-----w- c:\program files\Lavasoft
    2010-09-05 20:38 . 2010-09-20 01:53 63488 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
    2010-09-05 20:38 . 2010-09-05 20:38 52224 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
    2010-09-05 20:38 . 2010-09-20 01:53 117760 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2010-09-05 20:16 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-09-05 20:16 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-09-05 20:16 . 2010-09-05 20:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-20 01:57 . 2008-11-11 03:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-09-20 01:56 . 2008-11-11 03:26 -------- d-----w- c:\program files\SpywareBlaster
    2010-09-06 07:54 . 2005-10-13 23:28 -------- d-----w- c:\program files\Common Files\Adobe
    2010-09-06 02:03 . 2008-11-25 07:05 1 ----a-w- c:\documents and settings\troubleshooter\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
    2010-09-05 23:44 . 2006-05-24 00:14 -------- d-----w- c:\program files\QuickTime
    2010-09-05 23:43 . 2005-04-29 13:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
    2010-09-05 23:23 . 2005-04-29 12:19 -------- d--h--w- c:\program files\InstallShield Installation Information
    2010-09-05 23:00 . 2005-04-29 12:33 -------- d-----w- c:\program files\Java
    2010-09-05 20:37 . 2008-11-11 03:28 -------- d-----w- c:\program files\SUPERAntiSpyware
    2010-09-05 20:36 . 2008-11-11 03:28 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com
    2010-08-31 04:31 . 2010-08-31 04:31 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Avira
    2010-08-29 02:37 . 2008-11-11 03:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-08-29 00:18 . 2008-11-11 03:13 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\program files\Avira
    2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
    2010-08-20 15:48 . 2010-08-20 15:48 -------- d-----w- c:\program files\7-Zip
    2010-08-10 06:26 . 2010-08-10 06:26 -------- d-----w- c:\program files\Panasonic
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
    "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-31 286720]
    "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
    "hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 794624]
    "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]
    "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
    "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
    "SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

    c:\documents and settings\Hamid Mirzad\Start Menu\Programs\Startup\
    wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-6-23 15360]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0?????

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    2006-05-10 00:24 50760 ----a-w- c:\program files\Common Files\AOL\1128995550\ee\aolsoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2006-02-19 10:41 49152 ----a-w- c:\program files\Hp\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    2006-02-17 16:59 124520 ----a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-08-10 12:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    2008-01-24 21:39 26112 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aim6.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aolsoftware.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\AOLServiceHost.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/5/2010 2:02 PM 64288]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/28/2010 4:33 PM 135336]
    R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 8:18 AM 231424]
    S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [6/21/2010 10:44 AM 1355928]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
    uInternet Connection Wizard,ShellNext = hxxp://www.shopperreports.com/Installation/Browsing/Uninstall.aspx?partner=ShopperReports&group=SR&UID=&bar_ver=2.0.26&CID=BD924F070000000000000014A51343C00B21AC31&IID=890900BC3EE54E4D8584B98326A40A5B675F4DD3&BANNER_ID=7012000003&REQUESTOR_ID=431303&COUNTRY=US&SG=&USER_CREATE_DATE=05/07/2008%2006:58&Affiliate_Id=1000007012&ie_user_agent=Mozilla%2f4%2e0%20%28compatible%3b%20MSIE%207%2e0%3b%20Windows%20NT%205%2e1%3b%20%2eNET%20CLR%201%2e1%2e4322%3b%20SpamBlockerUtility%204%2e8%2e4%29
    IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
    IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
    IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
    IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
    FF - ProfilePath - c:\documents and settings\troubleshooter\Application Data\Mozilla\Firefox\Profiles\euyovg51.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .
    - - - - ORPHANS REMOVED - - - -

    Notify-WgaLogon - (no file)



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-10-01 21:16
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????7?6?5?7??????? ???B?????????????hLC? ??????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(784)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'explorer.exe'(2976)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\Ati2evxx.exe
    c:\program files\Avira\AntiVir Desktop\avguard.exe
    c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    c:\program files\Avira\AntiVir Desktop\avshadow.exe
    c:\windows\system32\Ati2evxx.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\windows\system32\HPZipm12.exe
    c:\program files\HPQ\SHARED\HPQWMI.exe
    .
    **************************************************************************
    .
    Completion time: 2010-10-01 21:24:39 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-10-02 04:24

    Pre-Run: 28,695,224,320 bytes free
    Post-Run: 28,628,676,608 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    - - End Of File - - F0C50485B4E68E2CCCD75CEF17683FE9
    ____________________
    Please let me know if you need any other information. Thank you again!

    Best regards,
    Wiz:wave:
     
  7. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    You're welcome :)

    Your MBR seems to be infected.

    Please download NTBR by noahdfear and save it to your Desktop.
    File size: 2.44 MB (2,565,432 bytes)

    • Place a blank CD in your CD drive.
    • Double click on NTBR_CD.exe file and a folder of the same name will appear.
    • Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
    • Follow the prompts to burn the CD.
    • Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)
    • If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.
    • Insert the newly created CD into your infected PC and reboot your computer.
    • Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
    • Read the warning and then continue as prompted.
    • You first need to select your keyboard layout - press Enter for English.
    • Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
    • On the following screen enter 5 to select Install Standard MBR code.
    • Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
    • When asked to confirm please do so.
    • Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
    • Eject the disc and then press ctrl+alt+del to reboot the PC.
    Once rebooted, run MBRCheck again and post its log.
     
  8. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    MBR seems clean now; Thanks!

    Hello Broni:

    Thank you very much for your thorough instructions. The good news is that I finally managed to successfully complete this task. The bad news is that we may have a DVD/CD drive problem. Here are the challenges that I faced:

    1. BurnItCD.cmd first failed to complete the CD burn at the default 16X speed, which probably is the maximum CD speed of the drive. I used a trial-and-error process to finally burn a second CD at 4X speed with some manual pressure at strategic spots on the DVD/CD drive to get it to work! The first CD may have been corrupted, though.

    2. My first attempt to boot from this second CD was also a failure! It first resulted in a very scratchy Windows startup screen of the old over-the-air, B&W TV variety! I had to restart the laptop and tweak the drive again to make it work. After that everything went according to the plan.

    I had noticed some frame skipping and scratchy audio when I played a couple of DVDs over the past month. Thus, my plan is to clean up the DVD drive lens, dust the drive, and upgrade its driver. But the problem could also be the drive's sitting or its moor. Have you run into similar problems with other DVD/CD drives? Is there a more viable solution for it?

    3. Another good news is that the following MBRcheck log looks clean and indicates a valid Windows XP MBR now. Please advise how to proceed from here. Thank you again.

    Best wishes,
    Wiz:wave:


    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Home Edition
    Windows Information: Service Pack 2 (build 2600)
    Logical Drives Mask: 0x0000000c

    Kernel Drivers (total 133):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806CE000 \WINDOWS\system32\hal.dll
    0xF7AFC000 \WINDOWS\system32\KDCOM.DLL
    0xF7A0C000 \WINDOWS\system32\BOOTVID.dll
    0xF74CD000 ACPI.sys
    0xF7AFE000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF74BC000 pci.sys
    0xF75FC000 isapnp.sys
    0xF760C000 ohci1394.sys
    0xF761C000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
    0xF7A10000 compbatt.sys
    0xF7A14000 \WINDOWS\system32\DRIVERS\BATTC.SYS
    0xF7BC4000 pciide.sys
    0xF787C000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF7B00000 intelide.sys
    0xF7B02000 viaide.sys
    0xF7B04000 aliide.sys
    0xF749E000 pcmcia.sys
    0xF762C000 MountMgr.sys
    0xF747F000 ftdisk.sys
    0xF7A18000 ACPIEC.sys
    0xF7BC5000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
    0xF7884000 PartMgr.sys
    0xF763C000 VolSnap.sys
    0xF7467000 atapi.sys
    0xF764C000 disk.sys
    0xF765C000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF7447000 fltMgr.sys
    0xF7435000 sr.sys
    0xF766C000 Lbd.sys
    0xF767C000 PxHelp20.sys
    0xF741E000 KSecDD.sys
    0xF7391000 Ntfs.sys
    0xF7364000 NDIS.sys
    0xF768C000 serial.sys
    0xF7349000 Mup.sys
    0xF7AB4000 \SystemRoot\system32\DRIVERS\CmBatt.sys
    0xF6AD3000 \SystemRoot\system32\DRIVERS\AmdK8.sys
    0xF6348000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
    0xF6334000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xF7934000 \SystemRoot\system32\DRIVERS\usbohci.sys
    0xF6311000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xF793C000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xF6AC3000 \SystemRoot\system32\DRIVERS\imapi.sys
    0xF6AB3000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xF6AA3000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xF62EE000 \SystemRoot\system32\DRIVERS\ks.sys
    0xF7944000 \SystemRoot\SYSTEM32\DRIVERS\GEARAspiWDM.sys
    0xF6A93000 \SystemRoot\system32\DRIVERS\i8042prt.sys
    0xF794C000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF62B9000 \SystemRoot\system32\DRIVERS\SynTP.sys
    0xF7B28000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF7954000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF629F000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
    0xF614B000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
    0xF60F5000 \SystemRoot\system32\drivers\camc6hal.sys
    0xF6A83000 \SystemRoot\system32\drivers\camc6aud.sys
    0xF60D1000 \SystemRoot\system32\drivers\portcls.sys
    0xF6A73000 \SystemRoot\system32\drivers\drmk.sys
    0xF6098000 \SystemRoot\system32\DRIVERS\HSFHWATI.sys
    0xF5F9B000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
    0xF5EEB000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
    0xF795C000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF7AE4000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
    0xF7C15000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF76BC000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF7AE8000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xF5ED4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF76CC000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF76DC000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF7964000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xF5EC3000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF76EC000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF796C000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF7974000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xF76FC000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF7B2A000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xF5E8F000 \SystemRoot\system32\DRIVERS\update.sys
    0xF7AF8000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF770C000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF773C000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF7B30000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xF7C8F000 \SystemRoot\System32\Drivers\Null.SYS
    0xF7B32000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF7994000 \SystemRoot\System32\drivers\vga.sys
    0xF7B34000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF7B36000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF799C000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF79A4000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF7AA0000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xEDDA8000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xEDD50000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xEDD28000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xF7AA4000 \SystemRoot\System32\drivers\ws2ifsl.sys
    0xEDD06000 \SystemRoot\System32\drivers\afd.sys
    0xF776C000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xF79AC000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
    0xEDC44000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    0xF79B4000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    0xEDC19000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xEDBAA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF778C000 \SystemRoot\System32\Drivers\Fips.SYS
    0xEDB89000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF779C000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xF7B3C000 \??\C:\WINDOWS\system32\drivers\EABFiltr.sys
    0xF7CB2000 \SystemRoot\System32\Drivers\BANTExt.sys
    0xEDB1F000 \SystemRoot\system32\DRIVERS\avipbb.sys
    0xF7B42000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
    0xF77FC000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xEDB07000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF7B46000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xEDDFB000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF79EC000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xF7C19000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\ati2dvag.dll
    0xBF04E000 \SystemRoot\System32\ati2cqag.dll
    0xBF080000 \SystemRoot\System32\atikvmag.dll
    0xBF0B2000 \SystemRoot\System32\ati3duag.dll
    0xBF2E3000 \SystemRoot\System32\ativvaxx.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xB8653000 \SystemRoot\system32\DRIVERS\avgntflt.sys
    0xB864B000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xB846F000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xF7BB2000 \SystemRoot\System32\Drivers\ASCTRM.SYS
    0xB836A000 \SystemRoot\system32\drivers\wdmaud.sys
    0xB840F000 \SystemRoot\system32\drivers\sysaudio.sys
    0xB803D000 \SystemRoot\system32\DRIVERS\srv.sys
    0xB82C6000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    0xB7AAC000 \SystemRoot\System32\Drivers\HTTP.sys
    0xB7969000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 39):
    0 System Idle Process
    4 System
    704 C:\WINDOWS\system32\smss.exe
    752 csrss.exe
    776 C:\WINDOWS\system32\winlogon.exe
    820 C:\WINDOWS\system32\services.exe
    832 C:\WINDOWS\system32\lsass.exe
    1000 C:\WINDOWS\system32\ati2evxx.exe
    1020 C:\WINDOWS\system32\svchost.exe
    1116 svchost.exe
    1156 C:\WINDOWS\system32\svchost.exe
    1224 svchost.exe
    1340 svchost.exe
    1612 C:\WINDOWS\system32\spoolsv.exe
    1656 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1700 svchost.exe
    1756 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    1868 C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    1932 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    2036 C:\WINDOWS\system32\ati2evxx.exe
    208 C:\WINDOWS\explorer.exe
    364 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    492 C:\WINDOWS\system32\HPZipm12.exe
    524 C:\WINDOWS\system32\svchost.exe
    1956 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    1900 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    1984 C:\WINDOWS\vsnpstd2.exe
    2016 C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
    124 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
    1944 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    464 wmiprvse.exe
    304 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    580 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    1284 C:\WINDOWS\system32\ctfmon.exe
    1456 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    2648 C:\WINDOWS\system32\wuauclt.exe
    3328 C:\Program Files\HPQ\Shared\hpqwmi.exe
    3400 alg.exe
    2608 C:\troubleshooter\fall10\troubleshooting\security_sw_aug_10\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: TOSHIBAMK6025GAS, Rev: KA201A

    Size Device Name MBR Status
    --------------------------------------------
    55 GB \\.\PhysicalDrive0 Windows XP MBR code detected
    SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


    Done!
     
  9. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Good :)

    The bad news is, that lens cleaners are rather waste of money ($8-$10).
    The good news is, you can get new DVD burner shipped for $20+
    Optical drives don't need any extra drivers. They're plug-and-play devices.

    I want you to re-run Combofix and post fresh log.
     
  10. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    Combofix Log

    Hello Broni:

    Thanks for your prompt response. I was thinking of IPA and cotton swob for cleaning the DVD lens. I could buy a drive online!

    Running ComboFix generated this MS error message a few times:

    "MS (r) Console Based Script Host has encountered a problem..."

    I clicked on "Don't Send" report every time. Here is the log, which still lists lots of bells and whistles that should not be running at all times. shopperreports.com is still there. Please advise how to get rid of them all. Thank you again.

    Best wishes,
    Wiz:wave:

    ComboFix 10-10-02.02 - troubleshooter 10/03/2010 8:03.2.1 - x86
    Running from: c:\documents and settings\troubleshooter\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((( Files Created from 2010-09-03 to 2010-10-03 )))))))))))))))))))))))))))))))
    .

    2010-10-03 03:40 . 2010-10-03 03:40 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Sonic
    2010-10-03 03:39 . 2010-10-03 03:39 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Leadertech
    2010-09-14 04:52 . 2010-09-14 04:54 -------- d-----w- c:\windows\system32\NtmsData
    2010-09-06 08:00 . 2010-09-06 08:00 -------- d-----w- c:\windows\system32\Adobe
    2010-09-06 03:14 . 2008-02-27 21:49 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
    2010-09-06 03:02 . 2010-09-06 03:02 388096 ----a-r- c:\documents and settings\troubleshooter\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2010-09-06 03:00 . 2010-09-06 03:00 -------- d-----w- c:\program files\CCleaner
    2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\program files\Common Files\Apple
    2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Apple
    2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\program files\Apple Software Update
    2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
    2010-09-05 22:44 . 2010-09-05 22:44 503808 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcp71.dll
    2010-09-05 22:44 . 2010-09-05 22:44 499712 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\jmc.dll
    2010-09-05 22:44 . 2010-09-05 22:44 61440 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-sse.dll
    2010-09-05 22:44 . 2010-09-05 22:44 348160 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcr71.dll
    2010-09-05 22:44 . 2010-09-05 22:44 12800 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-d3d.dll
    2010-09-05 22:44 . 2010-09-05 22:43 423656 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-05 21:02 . 2010-09-05 21:02 -------- dc----w- c:\windows\system32\DRVSTORE
    2010-09-05 21:02 . 2010-06-21 17:44 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2010-09-05 21:02 . 2010-09-05 21:02 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-09-05 20:50 . 2010-09-05 20:50 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Sunbelt Software
    2010-09-05 20:49 . 2010-06-21 17:52 2978768 -c--a-w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe
    2010-09-05 20:49 . 2010-09-05 20:50 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}
    2010-09-05 20:47 . 2010-09-05 20:47 -------- d-----w- c:\program files\Lavasoft
    2010-09-05 20:38 . 2010-09-20 01:53 63488 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
    2010-09-05 20:38 . 2010-09-05 20:38 52224 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
    2010-09-05 20:38 . 2010-09-20 01:53 117760 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2010-09-05 20:16 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-09-05 20:16 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-09-05 20:16 . 2010-09-05 20:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-10-03 05:34 . 2008-11-25 07:05 1 ----a-w- c:\documents and settings\troubleshooter\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
    2010-09-20 01:57 . 2008-11-11 03:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-09-20 01:56 . 2008-11-11 03:26 -------- d-----w- c:\program files\SpywareBlaster
    2010-09-06 07:54 . 2005-10-13 23:28 -------- d-----w- c:\program files\Common Files\Adobe
    2010-09-05 23:44 . 2006-05-24 00:14 -------- d-----w- c:\program files\QuickTime
    2010-09-05 23:43 . 2005-04-29 13:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
    2010-09-05 23:23 . 2005-04-29 12:19 -------- d--h--w- c:\program files\InstallShield Installation Information
    2010-09-05 23:00 . 2005-04-29 12:33 -------- d-----w- c:\program files\Java
    2010-09-05 20:37 . 2008-11-11 03:28 -------- d-----w- c:\program files\SUPERAntiSpyware
    2010-09-05 20:36 . 2008-11-11 03:28 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com
    2010-08-31 04:31 . 2010-08-31 04:31 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Avira
    2010-08-29 02:37 . 2008-11-11 03:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-08-29 00:18 . 2008-11-11 03:13 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\program files\Avira
    2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
    2010-08-20 15:48 . 2010-08-20 15:48 -------- d-----w- c:\program files\7-Zip
    2010-08-10 06:26 . 2010-08-10 06:26 -------- d-----w- c:\program files\Panasonic
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
    "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-31 286720]
    "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
    "hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 794624]
    "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]
    "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
    "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
    "SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

    c:\documents and settings\Hamid Mirzad\Start Menu\Programs\Startup\
    wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-6-23 15360]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
    [BU]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0?????

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    2006-05-10 00:24 50760 ----a-w- c:\program files\Common Files\AOL\1128995550\ee\aolsoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2006-02-19 10:41 49152 ----a-w- c:\program files\Hp\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    2006-02-17 16:59 124520 ----a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-08-10 12:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    2008-01-24 21:39 26112 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aim6.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aolsoftware.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\AOLServiceHost.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/5/2010 2:02 PM 64288]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/28/2010 4:33 PM 135336]
    R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 8:18 AM 231424]
    S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [6/21/2010 10:44 AM 1355928]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
    uInternet Connection Wizard,ShellNext = hxxp://www.shopperreports.com/Installation/Browsing/Uninstall.aspx?partner=ShopperReports&group=SR&UID=&bar_ver=2.0.26&CID=BD924F070000000000000014A51343C00B21AC31&IID=890900BC3EE54E4D8584B98326A40A5B675F4DD3&BANNER_ID=7012000003&REQUESTOR_ID=431303&COUNTRY=US&SG=&USER_CREATE_DATE=05/07/2008%2006:58&Affiliate_Id=1000007012&ie_user_agent=Mozilla%2f4%2e0%20%28compatible%3b%20MSIE%207%2e0%3b%20Windows%20NT%205%2e1%3b%20%2eNET%20CLR%201%2e1%2e4322%3b%20SpamBlockerUtility%204%2e8%2e4%29
    IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
    IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
    IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
    IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
    TCP: {8694A8C7-0C71-487C-B8E0-F94637295661} = 69.19.190.116 69.19.190.120
    FF - ProfilePath - c:\documents and settings\troubleshooter\Application Data\Mozilla\Firefox\Profiles\euyovg51.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-10-03 08:14
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????7?6?5?7??????? ???B?????????????hLC? ??????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(784)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'explorer.exe'(3564)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2010-10-03 08:20:24
    ComboFix-quarantined-files.txt 2010-10-03 15:20
    ComboFix2.txt 2010-10-02 04:24

    Pre-Run: 28,590,624,768 bytes free
    Post-Run: 28,580,257,792 bytes free

    - - End Of File - - 163D2F9FF4C502046C6F3866F4F8C846
     
  11. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=-
    "FirewallOverride"=-
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"=dword:00000001
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  12. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    Another Combofix Log

    Hello Broni:

    Thanks for your prompt response. Running ComboFix did not generate any MS error messages this time; thanks!

    Here is the new log, which still lists lots of s/w that need not be running at all times. shopperreports.com is still there. Please advise how best to clean them all. Thank you again.

    Best wishes,
    Wiz


    ComboFix 10-10-02.02 - troubleshooter 10/03/2010 10:44:55.3.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.382.187 [GMT -7:00]
    Running from: c:\documents and settings\troubleshooter\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\troubleshooter\Desktop\CFScript.txt
    AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
    .

    ((((((((((((((((((((((((( Files Created from 2010-09-03 to 2010-10-03 )))))))))))))))))))))))))))))))
    .

    2010-10-03 03:40 . 2010-10-03 03:40 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Sonic
    2010-10-03 03:39 . 2010-10-03 03:39 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Leadertech
    2010-09-14 04:52 . 2010-09-14 04:54 -------- d-----w- c:\windows\system32\NtmsData
    2010-09-06 08:00 . 2010-09-06 08:00 -------- d-----w- c:\windows\system32\Adobe
    2010-09-06 03:14 . 2008-02-27 21:49 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
    2010-09-06 03:02 . 2010-09-06 03:02 388096 ----a-r- c:\documents and settings\troubleshooter\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2010-09-06 03:00 . 2010-09-06 03:00 -------- d-----w- c:\program files\CCleaner
    2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\program files\Common Files\Apple
    2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Apple
    2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\program files\Apple Software Update
    2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
    2010-09-05 22:44 . 2010-09-05 22:44 503808 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcp71.dll
    2010-09-05 22:44 . 2010-09-05 22:44 499712 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\jmc.dll
    2010-09-05 22:44 . 2010-09-05 22:44 61440 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-sse.dll
    2010-09-05 22:44 . 2010-09-05 22:44 348160 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcr71.dll
    2010-09-05 22:44 . 2010-09-05 22:44 12800 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-d3d.dll
    2010-09-05 22:44 . 2010-09-05 22:43 423656 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-05 21:02 . 2010-09-05 21:02 -------- dc----w- c:\windows\system32\DRVSTORE
    2010-09-05 21:02 . 2010-06-21 17:44 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2010-09-05 21:02 . 2010-09-05 21:02 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-09-05 20:50 . 2010-09-05 20:50 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Sunbelt Software
    2010-09-05 20:49 . 2010-06-21 17:52 2978768 -c--a-w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe
    2010-09-05 20:49 . 2010-09-05 20:50 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}
    2010-09-05 20:47 . 2010-09-05 20:47 -------- d-----w- c:\program files\Lavasoft
    2010-09-05 20:38 . 2010-09-20 01:53 63488 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
    2010-09-05 20:38 . 2010-09-05 20:38 52224 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
    2010-09-05 20:38 . 2010-09-20 01:53 117760 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2010-09-05 20:16 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-09-05 20:16 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-09-05 20:16 . 2010-09-05 20:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-10-03 05:34 . 2008-11-25 07:05 1 ----a-w- c:\documents and settings\troubleshooter\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
    2010-09-20 01:57 . 2008-11-11 03:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-09-20 01:56 . 2008-11-11 03:26 -------- d-----w- c:\program files\SpywareBlaster
    2010-09-06 07:54 . 2005-10-13 23:28 -------- d-----w- c:\program files\Common Files\Adobe
    2010-09-05 23:44 . 2006-05-24 00:14 -------- d-----w- c:\program files\QuickTime
    2010-09-05 23:43 . 2005-04-29 13:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
    2010-09-05 23:23 . 2005-04-29 12:19 -------- d--h--w- c:\program files\InstallShield Installation Information
    2010-09-05 23:00 . 2005-04-29 12:33 -------- d-----w- c:\program files\Java
    2010-09-05 20:37 . 2008-11-11 03:28 -------- d-----w- c:\program files\SUPERAntiSpyware
    2010-09-05 20:36 . 2008-11-11 03:28 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com
    2010-08-31 04:31 . 2010-08-31 04:31 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Avira
    2010-08-29 02:37 . 2008-11-11 03:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-08-29 00:18 . 2008-11-11 03:13 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\program files\Avira
    2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
    2010-08-20 15:48 . 2010-08-20 15:48 -------- d-----w- c:\program files\7-Zip
    2010-08-10 06:26 . 2010-08-10 06:26 -------- d-----w- c:\program files\Panasonic
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
    "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-31 286720]
    "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
    "hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 794624]
    "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]
    "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
    "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
    "SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

    c:\documents and settings\Hamid Mirzad\Start Menu\Programs\Startup\
    wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-6-23 15360]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
    [BU]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0?????

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    2006-05-10 00:24 50760 ----a-w- c:\program files\Common Files\AOL\1128995550\ee\aolsoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2006-02-19 10:41 49152 ----a-w- c:\program files\Hp\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    2006-02-17 16:59 124520 ----a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-08-10 12:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    2008-01-24 21:39 26112 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aim6.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aolsoftware.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\AOLServiceHost.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/5/2010 2:02 PM 64288]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
    R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 8:18 AM 231424]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
    uInternet Connection Wizard,ShellNext = hxxp://www.shopperreports.com/Installation/Browsing/Uninstall.aspx?partner=ShopperReports&group=SR&UID=&bar_ver=2.0.26&CID=BD924F070000000000000014A51343C00B21AC31&IID=890900BC3EE54E4D8584B98326A40A5B675F4DD3&BANNER_ID=7012000003&REQUESTOR_ID=431303&COUNTRY=US&SG=&USER_CREATE_DATE=05/07/2008%2006:58&Affiliate_Id=1000007012&ie_user_agent=Mozilla%2f4%2e0%20%28compatible%3b%20MSIE%207%2e0%3b%20Windows%20NT%205%2e1%3b%20%2eNET%20CLR%201%2e1%2e4322%3b%20SpamBlockerUtility%204%2e8%2e4%29
    IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
    IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
    IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
    IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
    TCP: {8694A8C7-0C71-487C-B8E0-F94637295661} = 69.19.190.116 69.19.190.120
    FF - ProfilePath - c:\documents and settings\troubleshooter\Application Data\Mozilla\Firefox\Profiles\euyovg51.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-10-03 10:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????7?6?5?7??????? ???B?????????????hLC? ??????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(788)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'explorer.exe'(4012)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2010-10-03 11:02:40
    ComboFix-quarantined-files.txt 2010-10-03 18:02
    ComboFix2.txt 2010-10-02 04:24

    Pre-Run: 28,587,716,608 bytes free
    Post-Run: 28,572,790,784 bytes free

    - - End Of File - - 228D4CB6528D3A98B3234413A02557F4
     
  13. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Looks good :)

    How is computer doing?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  14. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    OTL.txt and OTL EXtras Logs

    Hello Broni:

    Thanks for your prompt response. It is running better. OTL.txt and OTL EXtras Log were each way over 20,000-word limit. Thus, I had to attach them; sorry!

    They still list many missing items and lots of s/w that need not be running at all. For example, no printers are attached to this laptop. Thus, no HP s/w is needed. No AOL, Intuit updater, shopperreports.com... is needed, either. Please advise how best to clean them all. Thank you again.

    Best wishes,
    Wiz
     

    Attached Files:

  15. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    While I'm looking at your OTL logs....

    Download, and install Quick Startup: http://www.glarysoft.com/qs.html
    Go File>Export, save report, and paste it into your next post.
     
  16. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    You don't have much RAM. Your computer would greatly benefit from adding another 512MB of RAM.
    For now, you uninstall Spybot, which is definitely hogging your low-RAM system.

    ==========================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
      O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -Mozilla\5.0 ( File not found
      O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
      O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
      O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
      [2008/11/09 10:47:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
      @Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
      
      
      :Services
      
      :Reg
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ======================================================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  17. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    OTL.exe, SecurityCheck.exe, & QuickStartup.exe Reports

    Hello Broni:

    Laptop now boots in two minutes! Here are the reports in the execution order. I decided to post them for your review while I complete the ESET Online Scan since it may take some time! Thank you again!

    Regards,
    Wiz
    ___________________OTL.exe Report Starts Here____________

    All processes killed
    ========== OTL ==========
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Shockwave Updater deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
    Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\ deleted successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell\AOL9Plus folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell\AOL9 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\AxMetaStream_Win folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: bb60877f2dd807555cb5ae96

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Dorna
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Guest
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Hamid Mirzad
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: troubleshooter
    ->Temp folder emptied: 1726 bytes
    ->Temporary Internet Files folder emptied: 2675728 bytes
    ->Java cache emptied: 2023 bytes
    ->FireFox cache emptied: 61654103 bytes
    ->Flash cache emptied: 1733 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 61.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: bb60877f2dd807555cb5ae96

    User: Default User

    User: Dorna
    ->Flash cache emptied: 0 bytes

    User: Guest
    ->Flash cache emptied: 0 bytes

    User: Hamid Mirzad
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    User: troubleshooter
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.14.1 log created on 10032010_143807

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...

    ___________________SecurityCheck.exe Report Starts Here____________

    Results of screen317's Security Check version 0.99.5
    Windows XP Service Pack 2
    Out of date service pack!!
    Internet Explorer 7 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    Avira AntiVir Personal - Free Antivirus
    Avira successfully updated!
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Ad-Aware
    Malwarebytes' Anti-Malware
    CCleaner
    Java(TM) 6 Update 21
    Adobe Flash Player 10.1.82.76
    Adobe Reader 9.3.3
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Ad-Aware AAWService.exe is disabled!
    Ad-Aware AAWTray.exe is disabled!
    Avira Antivir avgnt.exe
    Avira Antivir avguard.exe
    ````````````````````````````````
    DNS Vulnerability Check:

    GREAT! (Not vulnerable to DNS cache poisoning)

    ``````````End of Log````````````

    ___________________quickstartup.exe Report Starts Here____________

    Startup List report created on 10/3/2010 by Startup Manager


    Name: SynTPLpr
    Path: C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: SynTPEnh
    Path: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: SNPSTD2
    Path: C:\WINDOWS\vsnpstd2.exe
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: LSBWatcher
    Path: c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: hpWirelessAssistant
    Path: C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: eabconfg.cpl
    Path: C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: ATIPTA
    Path: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: ISUSPM Startup
    Path: C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: Cpqset
    Path: C:\Program Files\HPQ\Default Settings\cpqset.exe
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: ISUSScheduler
    Path: "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: SynTPStart
    Path: C:\Program Files\Synaptics\SynTP\SynTPStart.exe
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: avgnt
    Path: "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min /ns
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: SunJavaUpdateSched
    Path: "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: QuickTime Task
    Path: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: Adobe Reader Speed Launcher
    Path: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: Adobe ARM
    Path: "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: SpybotSD TeaTimer
    Path: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------

    Name: ctfmon.exe
    Path: C:\WINDOWS\system32\ctfmon.exe
    Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    Status: Enabled
    ------------------------------------------------------------------------------------------
    Total 18 Items
     
  18. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Very good :)

    We have to remember to install SP3, when Eset comes up clean.

    Re-run QuickStartup and UN-check following unneeded startups:

    LSBWatcher - up to you - HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling, do not prevent from starting.
    eabconfg.cpl - up to you - Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys
    ATIPTA - up to you - Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings
    ISUSPM Startup
    Cpqset
    ISUSScheduler
    SunJavaUpdateSched
    Adobe ARM
     
  19. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    ESET Scan Results

    Hello Broni:

    ESET Online Scan did take a long time! The following ESET Scan results indicate several infections. Most are "false positives" of a couple of cleanup s/w, such as ComboFix, and their quarantined infections. Others are probably serious and need cleanup. Sorry for the bad news!

    I agree with you on the startup s/w but will wait for your advice on ESET scan results. ATIPTA may need special attention, however, because about a month ago I noticed that the display setting options have changed. They now allow many other resolutions way beyond the 1024*768, native resolution. Device Manager lists a default monitor in addition to the actual display monitor. I am not sure if this is also new or correct. Thank you again!

    Regards,
    Wiz

    ESET Scan results

    C:\Documents and Settings\All Users\Application Data\AOL Downloads\SUD4131\setup.exe probably a variant of Win32/Agent.HZHBURL trojan
    C:\Qoobox\Quarantine\C\WINDOWS\ihghkj.ini.vir Win32/Adware.Virtumonde.NEO application
    C:\Qoobox\Quarantine\C\WINDOWS\klopru.ini.vir Win32/Adware.Virtumonde.NEO application
    C:\Qoobox\Quarantine\C\WINDOWS\vutttv.ini.vir Win32/Adware.Virtumonde.NEO application
    C:\Qoobox\Quarantine\C\WINDOWS\wacehk.ini.vir Win32/Adware.Virtumonde.NEO application
    C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP330\A0180830.exe probably a variant of Win32/Spy.Agent.FBJQNLM trojan
    C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP330\A0180831.exe probably a variant of Win32/Agent.CBNUPOQ trojan
    C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP336\A0181308.ini Win32/Adware.Virtumonde.NEO application
    C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP336\A0181309.ini Win32/Adware.Virtumonde.NEO application
    C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP336\A0181311.ini Win32/Adware.Virtumonde.NEO application
    C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP336\A0181312.ini Win32/Adware.Virtumonde.NEO application
    C:\troubleshooter\wagner_cleanup_software\ComboFix.exe probably a variant of Win32/Agent.CBNUPOQ trojan
    C:\troubleshooter\wagner_cleanup_software\SDFix.exe probably a variant of Win32/Spy.Agent.FBJQNLM trojan
     
  20. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Eset actually didn't find much.
    Most files are in Combofix quarantine folder (safe), which will be removed soon and in system restore points, which we'll reset in an moment.

    ========================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      
      :Services
      
      :Reg
      
      :Files
      C:\Documents and Settings\All Users\Application Data\AOL Downloads\SUD4131\setup.exe
      C:\troubleshooter\wagner_cleanup_software\ComboFix.exe 
      C:\troubleshooter\wagner_cleanup_software\SDFix.exe
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =======================================================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how is your computer doing.
     
  21. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    ESET Scan Results--Part 2

    Hello Broni:

    I just noticed that the other infections are the old ones burried in a few restore points. All we need to do is to get rid of the old restore points! Sorry for missing them; but it has been a long day! Thank you again.

    Regards,
    Wiz:wave:
     
  22. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    This is what I just said.
    If you follow my previous instructions, restore points will be reset.
     
  23. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    OTL logs

    Hello Broni:

    Of course, I had not seen your reply to my original "ESET Scan Results" before posting "ESET Scan Results--Part 2"! Here are the two OTL logs, as instructed. I will complete the rest of the tasks, starting Monday night, and post any results or issues then.

    Any thoughts on the display-monitor-settings puzzle? Thank you again for such a great job, Broni!

    Best wishes,
    Wiz:wave:

    __________________First OTL Run___________________

    All processes killed
    ========== OTL ==========
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    C:\Documents and Settings\All Users\Application Data\AOL Downloads\SUD4131\setup.exe moved successfully.
    C:\troubleshooter\wagner_cleanup_software\ComboFix.exe moved successfully.
    C:\troubleshooter\wagner_cleanup_software\SDFix.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: bb60877f2dd807555cb5ae96

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Dorna
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Guest
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Hamid Mirzad
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: troubleshooter
    ->Temp folder emptied: 1726 bytes
    ->Temporary Internet Files folder emptied: 1183800 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 1.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: bb60877f2dd807555cb5ae96

    User: Default User

    User: Dorna
    ->Flash cache emptied: 0 bytes

    User: Guest
    ->Flash cache emptied: 0 bytes

    User: Hamid Mirzad
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    User: troubleshooter
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.14.1 log created on 10032010_222147

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...

    __________________Second OTL Run___________________

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: bb60877f2dd807555cb5ae96

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Dorna
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Guest
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Hamid Mirzad
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: troubleshooter
    ->Temp folder emptied: 1726 bytes
    ->Temporary Internet Files folder emptied: 6849859 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 7.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: bb60877f2dd807555cb5ae96

    User: Default User

    User: Dorna
    ->Flash cache emptied: 0 bytes

    User: Guest
    ->Flash cache emptied: 0 bytes

    User: Hamid Mirzad
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    User: troubleshooter
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.14.1 log created on 10032010_215832

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
     
  24. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Remind me, what was the issue?
     
  25. drwizgeek

    drwizgeek TS Rookie Topic Starter Posts: 86

    Display-monitor-settings Puzzle and RAM Upgrade

    Hello Broni:

    Thanks; here is what I said in my Post #19:

    "I agree with you on the startup s/w but will wait for your advice on ESET scan results. ATIPTA may need special attention, however, because about a month ago I noticed that the display setting options have changed. They now allow many other resolutions way beyond the 1024*768, native resolution. Device Manager lists a default monitor in addition to the actual display monitor. I am not sure if this is also new or correct."

    I looked for RAM sticks. The two slots currently have 256MB each. Thus, I have to replace both of them with a pair of 512MB sticks at $24 each, Corsair or Crucial brand. I found a generic one for $15 each. But, they are not in stock. 1GB sticks are too expensive. Do you recommend any RAM sticks or vendors? DVD player is doing better with a bit of cleaning. Thank you again!

    Regards,
    Wiz
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...