TechSpot

Browser Redirect Malware Issue

Solved
By BlackBabylon
Dec 22, 2010
  1. Hello TechSpot,
    I'm at a family members for the holidays and there having an issue with there web browser/ Google redirecting them to malicious sites. From what Ive see in other thread's, this is a widespread problem.

    Ive went through the 8-step process and here are my logs:

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5378

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 6.0.2900.5512

    12/22/2010 1:59:57 PM
    mbam-log-2010-12-22 (13-59-57).txt

    Scan type: Quick scan
    Objects scanned: 125112
    Time elapsed: 5 minute(s), 15 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 3
    Registry Values Infected: 1
    Registry Data Items Infected: 2
    Folders Infected: 6
    Files Infected: 16

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Privacy Tools (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\AvScan (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Trojan.Agent) -> Value: Shell -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    c:\documents and settings\LonnyM\application data\PC\faq (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\local settings\application data\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\local settings\application data\DoubleD\juicyaccess toolbar (Adware.DoubleD) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\local settings\application data\DoubleD\juicyaccess toolbar\4.1.0.17730 (Adware.DoubleD) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\local settings\application data\DoubleD\juicyaccess toolbar\4.1.0.17730\bin (Adware.DoubleD) -> Quarantined and deleted successfully.

    Files Infected:
    c:\documents and settings\LonnyM\application data\dsfsds.bat (Malware.Trace) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\settings.ini (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\uninstall.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\sdfsfs.bat (Malware.Trace) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\srsf.bat (Malware.Trace) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\guide.html (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg1.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg10.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg2.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg3.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg4.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg5.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg6.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg7.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg8.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.
    c:\documents and settings\LonnyM\application data\PC\faq\images\gimg9.jpg (Rogue.ControlCenter) -> Quarantined and deleted successfully.

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2010-12-22 14:17:09
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 Maxtor_2F040L0 rev.VAM51JJ0
    Running: 4umf5hup.exe; Driver: C:\DOCUME~1\LonnyM\LOCALS~1\Temp\fxtdapog.sys



    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sectors 80292992 (+254): rootkit-like behavior;

    ---- Devices - GMER 1.0.15 ----

    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T1L0-17 8A20AAEA
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8A20AAEA
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8A20AAEA
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-f 8A20AAEA
    Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
    Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

    AttachedDevice fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskMaxtor_2F040L0__________________________VAM51JJ0#3146483433534538202020202020202020202020#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

    ---- EOF - GMER 1.0.15 ----



    DDS (Ver_10-12-12.02) - NTFSx86
    Run by LonnyM at 14:20:40.93 on Wed 12/22/2010
    Internet Explorer: 6.0.2900.5512
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1064 [GMT -5:00]

    AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\Promon.exe
    C:\Program Files\BroadJump\Client Foundation\CFD.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
    C:\Program Files\Lexmark 2400 Series\ezprint.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    c:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe
    C:\WINDOWS\system32\mgabg.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\lxcrcoms.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Documents and Settings\LonnyM\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
    mRun: [Promon.exe] Promon.exe
    mRun: [SprintModemUpdate] javaw.exe -cp "c:\program files\motive\firmwareupdater\lib\SprintModemUpdate.jar" com.motive.firmwareUpdater.client.SprintModemUpdate
    mRun: [BJCFD] c:\program files\broadjump\client foundation\CFD.exe
    mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
    mRun: [lxcrmon.exe] "c:\program files\lexmark 2400 series\lxcrmon.exe"
    mRun: [EzPrint] "c:\program files\lexmark 2400 series\ezprint.exe"
    mRun: [FaxCenterServer] "c:\program files\lexmark fax solutions\fm3032.exe" /s
    mRun: [LXCRCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCRtime.dll,_RunDLLEntry@16
    mRun: [REGSHAVE] c:\program files\regshave\REGSHAVE.EXE /AUTORUN
    mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
    mRun: [Matrox PowerDesk SE] "c:\program files\matrox graphics inc\powerdesk se\Matrox.PowerDesk SE.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewer\QuickDCF.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Notify: avgrsstarter - avgrsstx.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\lonnym\applic~1\mozilla\firefox\profiles\lbatd972.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
    FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava11.dll
    FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava12.dll
    FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava13.dll
    FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava14.dll
    FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJava32.dll
    FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPJPI142_05.dll
    FF - plugin: c:\program files\java\j2re1.4.2_05\bin\NPOJI610.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-9-21 335240]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-9-21 27784]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-9-21 108552]
    R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-9-21 908056]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-9-21 297752]
    R2 Matrox Centering Service;Matrox Centering Service;c:\program files\matrox graphics inc\powerdesk\services\Matrox.PowerDesk.Services.exe [2009-2-6 1263872]
    R2 Matrox.Pdesk.ServicesHost;Matrox.Pdesk.ServicesHost;c:\program files\matrox graphics inc\powerdesk se\Matrox.Pdesk.ServicesHost.exe [2009-2-6 344832]

    =============== Created Last 30 ================

    2010-12-22 18:48:32 -------- d-----w- c:\docume~1\lonnym\applic~1\Malwarebytes
    2010-12-22 18:48:26 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-22 18:48:25 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-12-22 18:48:21 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-22 18:48:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-12-22 15:55:47 -------- d-----w- c:\program files\VideoLAN
    2010-12-21 21:03:58 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
    2010-12-21 21:03:58 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX
    2010-12-21 16:43:19 -------- d-----w- c:\program files\common files\DivX Shared
    2010-12-21 01:49:22 -------- d-----w- c:\docume~1\lonnym\applic~1\Local
    2010-12-21 01:41:58 -------- d-----w- c:\program files\DivX
    2010-12-21 01:41:17 -------- d-----w- c:\docume~1\alluse~1\applic~1\DivX
    2010-12-20 13:52:49 -------- d-----w- c:\docume~1\lonnym\locals~1\applic~1\Opera
    2010-12-20 04:44:38 -------- d-----w- c:\docume~1\lonnym\applic~1\Panda Security
    2010-12-20 04:32:26 -------- d-----w- c:\docume~1\alluse~1\applic~1\Panda Security

    ==================== Find3M ====================


    =================== ROOTKIT ====================

    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 5.1.2600 Disk: Maxtor_2F040L0 rev.VAM51JJ0 -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3

    device: opened successfully
    user: MBR read successfully

    Disk trace:
    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A20AEC5]<<
    _asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x8a202872; SUB DWORD [EBP-0x4], 0x8a20212e; PUSH EDI; CALL 0xffffffffffffdf33; }
    1 nt!IofCallDriver[0x804E37C5] -> \Device\Harddisk0\DR0[0x8A204AB8]
    3 CLASSPNP[0xF7647FD7] -> nt!IofCallDriver[0x804E37C5] -> \Device\00000051[0x8A29DF18]
    5 ACPI[0xF750E620] -> nt!IofCallDriver[0x804E37C5] -> [0x8A29A940]
    [0x8A1CCD98] -> IRP_MJ_CREATE -> 0x8A20AEC5
    kernel: MBR read successfully
    _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
    detected disk devices:
    \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskMaxtor_2F040L0__________________________VAM51JJ0#3146483433534538202020202020202020202020#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
    detected hooks:
    \Driver\atapi DriverStartIo -> 0x8A20AAEA
    user & kernel MBR OK
    sectors 80293246 (+255): user != kernel
    Warning: possible TDL3 rootkit infection !

    ============= FINISH: 14:22:13.54 ===============




    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-12.02)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 6/29/2009 10:38:55 PM
    System Uptime: 12/22/2010 2:01:12 PM (0 hours ago)

    Motherboard: Intel Corporation | | D845WN
    Processor: Intel(R) Pentium(R) 4 CPU 1600MHz | J2E1 | 1594/100mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 38 GiB total, 22.986 GiB free.
    D: is CDROM ()
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
    Description: Microsoft PS/2 Port Mouse (IntelliPoint)
    Device ID: ACPI\PNP0F03\4&163C0F35&0
    Manufacturer: Microsoft
    Name: Microsoft PS/2 Port Mouse (IntelliPoint)
    PNP Device ID: ACPI\PNP0F03\4&163C0F35&0
    Service: i8042prt

    Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
    Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
    Device ID: ACPI\PNP0303\4&163C0F35&0
    Manufacturer: (Standard keyboards)
    Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
    PNP Device ID: ACPI\PNP0303\4&163C0F35&0
    Service: i8042prt

    ==== System Restore Points ===================

    RP138: 9/28/2010 9:32:03 PM - System Checkpoint
    RP139: 10/7/2010 8:35:01 PM - Avg8 Update
    RP140: 10/9/2010 9:45:37 AM - System Checkpoint
    RP141: 10/10/2010 2:56:04 PM - System Checkpoint
    RP142: 10/17/2010 5:24:17 PM - System Checkpoint
    RP143: 10/26/2010 8:09:58 PM - Avg8 Update
    RP144: 10/26/2010 8:11:14 PM - Avg8 Update
    RP145: 12/5/2010 9:42:07 AM - System Checkpoint
    RP146: 12/11/2010 12:14:21 PM - System Checkpoint
    RP147: 12/14/2010 9:47:22 PM - System Checkpoint
    RP148: 12/17/2010 12:11:34 AM - System Checkpoint
    RP149: 12/18/2010 1:57:04 AM - System Checkpoint
    RP150: 12/19/2010 12:04:47 PM - System Checkpoint
    RP151: 12/20/2010 12:12:30 PM - System Checkpoint
    RP152: 12/21/2010 12:25:14 PM - System Checkpoint

    ==== Installed Programs ======================

    ABBYY FineReader 6.0 Sprint
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.1
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AVG Free 8.5
    Bonjour
    BroadJump Client Foundation
    CCleaner (remove only)
    DivX Web Player
    FinePixViewer Ver.3.2
    FUJIFILM USB Driver
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB970653-v3)
    ImageMixer VCD for FinePix
    Intel(R) Network Connections Drivers
    iTunes
    Java 2 Runtime Environment, SE v1.4.2_05
    Lexmark 2400 Series
    Lexmark Fax Solutions
    Lexmark Toolbar
    Malwarebytes' Anti-Malware
    Matrox Graphics Software (remove only)
    Matrox PowerDesk-SE
    Microsoft Application Error Reporting
    Microsoft IntelliPoint 6.3
    Microsoft IntelliType Pro 6.3
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Visual C++ 2005 Redistributable
    MicroStaff WINASPI
    Mozilla Firefox (3.5.16)
    MSN
    MSXML 4.0 SP2 (KB954430)
    Opera 11.00
    QuickTime
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371-v2)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972260)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973869)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB973815)
    VC80CRTRedist - 8.0.50727.762
    VLC media player 1.1.5
    WebFldrs XP
    Windows Genuine Advantage Validation Tool (KB892130)

    ==== Event Viewer Messages From Past Week ========

    12/22/2010 2:15:59 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
    12/22/2010 2:02:20 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
    12/22/2010 1:36:21 PM, error: Service Control Manager [7034] - The lxcr_device service terminated unexpectedly. It has done this 1 time(s).
    12/22/2010 1:36:21 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
    12/22/2010 1:36:21 PM, error: Service Control Manager [7034] - The AVG Free8 E-mail Scanner service terminated unexpectedly. It has done this 1 time(s).
    12/22/2010 1:36:20 PM, error: Service Control Manager [7034] - The MGABGEXE service terminated unexpectedly. It has done this 1 time(s).
    12/22/2010 1:36:20 PM, error: Service Control Manager [7034] - The Matrox.Pdesk.ServicesHost service terminated unexpectedly. It has done this 1 time(s).
    12/22/2010 1:36:20 PM, error: Service Control Manager [7034] - The Matrox Centering Service service terminated unexpectedly. It has done this 1 time(s).
    12/22/2010 1:36:20 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
    12/22/2010 1:36:20 PM, error: Service Control Manager [7031] - The AVG Free8 WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    12/22/2010 1:36:20 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    12/22/2010 1:13:28 PM, error: Service Control Manager [7034] - The Panda Cloud Antivirus Service service terminated unexpectedly. It has done this 1 time(s).
    12/21/2010 7:46:32 PM, error: Dhcp [1002] - The IP address lease 70.119.59.138 for the Network Card with network address 000347CAAAA8 has been denied by the DHCP server 192.168.0.10 (The DHCP Server sent a DHCPNACK message).
    12/17/2010 4:45:00 PM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{D8986604-8B57-4778-B41E-1C9309DA4E8B} because another computer on the network has the same name. The server could not start.
    12/17/2010 4:31:16 PM, error: Dhcp [1002] - The IP address lease 68.207.121.165 for the Network Card with network address 000347CAAAA8 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    12/16/2010 11:34:17 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt
    12/16/2010 11:33:35 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    12/16/2010 11:33:35 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.

    ==== End Of File ===========================
     
  2. Broni

    Broni Malware Annihilator Posts: 47,704   +268

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===================================================================

    We have a rootkit here...

    Download TDSSKiller and save it to your desktop.
    • Extract (unzip) its contents to your desktop.
    • Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
     
  3. BlackBabylon

    BlackBabylon TS Rookie Topic Starter

    Ran TDSSKiller, found 1 infected file. Continued with the cure process, rebooted.
    Here is the log file:

    2010/12/22 15:35:51.0890 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46
    2010/12/22 15:35:51.0890 ================================================================================
    2010/12/22 15:35:51.0890 SystemInfo:
    2010/12/22 15:35:51.0890
    2010/12/22 15:35:51.0890 OS Version: 5.1.2600 ServicePack: 3.0
    2010/12/22 15:35:51.0890 Product type: Workstation
    2010/12/22 15:35:51.0890 ComputerName: LONNY
    2010/12/22 15:35:51.0890 UserName: LonnyM
    2010/12/22 15:35:51.0890 Windows directory: C:\WINDOWS
    2010/12/22 15:35:51.0890 System windows directory: C:\WINDOWS
    2010/12/22 15:35:51.0890 Processor architecture: Intel x86
    2010/12/22 15:35:51.0890 Number of processors: 1
    2010/12/22 15:35:51.0890 Page size: 0x1000
    2010/12/22 15:35:51.0890 Boot type: Normal boot
    2010/12/22 15:35:51.0890 ================================================================================
    2010/12/22 15:35:52.0546 Initialize success
    2010/12/22 15:36:07.0296 ================================================================================
    2010/12/22 15:36:07.0296 Scan started
    2010/12/22 15:36:07.0296 Mode: Manual;
    2010/12/22 15:36:07.0296 ================================================================================
    2010/12/22 15:36:15.0000 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys
    2010/12/22 15:36:15.0265 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    2010/12/22 15:36:15.0484 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
    2010/12/22 15:36:15.0750 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    2010/12/22 15:36:15.0906 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
    2010/12/22 15:36:16.0078 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
    2010/12/22 15:36:16.0906 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    2010/12/22 15:36:17.0078 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    2010/12/22 15:36:17.0453 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    2010/12/22 15:36:17.0656 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    2010/12/22 15:36:17.0890 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys
    2010/12/22 15:36:18.0125 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys
    2010/12/22 15:36:18.0250 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys
    2010/12/22 15:36:18.0406 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    2010/12/22 15:36:18.0671 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    2010/12/22 15:36:19.0140 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    2010/12/22 15:36:19.0593 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    2010/12/22 15:36:19.0984 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    2010/12/22 15:36:20.0531 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    2010/12/22 15:36:21.0171 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
    2010/12/22 15:36:21.0562 dmio (d8df502ded3fff583f6483ffa521aadd) C:\WINDOWS\system32\drivers\dmio.sys
    2010/12/22 15:36:21.0562 Suspicious file (Forged): C:\WINDOWS\system32\drivers\dmio.sys. Real md5: d8df502ded3fff583f6483ffa521aadd, Fake md5: 7c824cf7bbde77d95c08005717a95f6f
    2010/12/22 15:36:21.0593 dmio - detected Rootkit.Win32.TDSS.tdl3 (0)
    2010/12/22 15:36:21.0734 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    2010/12/22 15:36:21.0921 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    2010/12/22 15:36:22.0250 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    2010/12/22 15:36:22.0375 E100B (ac9cf17ee2ae003c98eb4f5336c38058) C:\WINDOWS\system32\DRIVERS\e100b325.sys
    2010/12/22 15:36:22.0625 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    2010/12/22 15:36:22.0734 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    2010/12/22 15:36:22.0843 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
    2010/12/22 15:36:22.0953 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    2010/12/22 15:36:23.0156 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
    2010/12/22 15:36:23.0406 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    2010/12/22 15:36:23.0625 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    2010/12/22 15:36:23.0859 G400 (36feb2ddce5f84128c2a8dbc60538dad) C:\WINDOWS\system32\DRIVERS\G400m.sys
    2010/12/22 15:36:24.0078 G400DH (2dd3d27e36ebf6804c40b843ff10872f) C:\WINDOWS\system32\DRIVERS\g400dhm.sys
    2010/12/22 15:36:24.0312 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
    2010/12/22 15:36:24.0515 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    2010/12/22 15:36:24.0734 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    2010/12/22 15:36:25.0000 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
    2010/12/22 15:36:25.0375 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    2010/12/22 15:36:26.0000 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    2010/12/22 15:36:26.0390 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
    2010/12/22 15:36:26.0531 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
    2010/12/22 15:36:26.0671 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    2010/12/22 15:36:26.0828 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    2010/12/22 15:36:26.0953 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    2010/12/22 15:36:27.0125 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    2010/12/22 15:36:27.0265 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    2010/12/22 15:36:27.0453 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    2010/12/22 15:36:27.0578 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    2010/12/22 15:36:27.0687 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
    2010/12/22 15:36:27.0828 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    2010/12/22 15:36:27.0953 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    2010/12/22 15:36:28.0390 MASPINT (a2ae666cee860babe7fa6f1662b71737) C:\WINDOWS\system32\drivers\MASPINT.sys
    2010/12/22 15:36:28.0609 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    2010/12/22 15:36:28.0765 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
    2010/12/22 15:36:28.0937 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    2010/12/22 15:36:29.0062 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    2010/12/22 15:36:29.0609 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    2010/12/22 15:36:29.0921 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    2010/12/22 15:36:30.0062 MRxSmb (60ae98742484e7ab80c3c1450e708148) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    2010/12/22 15:36:30.0265 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    2010/12/22 15:36:30.0406 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    2010/12/22 15:36:30.0500 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    2010/12/22 15:36:30.0593 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    2010/12/22 15:36:30.0750 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    2010/12/22 15:36:30.0859 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
    2010/12/22 15:36:30.0968 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    2010/12/22 15:36:31.0109 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    2010/12/22 15:36:31.0187 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    2010/12/22 15:36:31.0250 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    2010/12/22 15:36:31.0359 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
    2010/12/22 15:36:31.0437 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    2010/12/22 15:36:31.0531 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    2010/12/22 15:36:31.0703 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    2010/12/22 15:36:32.0218 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    2010/12/22 15:36:32.0578 NuidFltr (cf7e041663119e09d2e118521ada9300) C:\WINDOWS\system32\DRIVERS\NuidFltr.sys
    2010/12/22 15:36:32.0812 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    2010/12/22 15:36:33.0140 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    2010/12/22 15:36:33.0484 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    2010/12/22 15:36:33.0921 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
    2010/12/22 15:36:34.0593 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    2010/12/22 15:36:34.0953 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    2010/12/22 15:36:35.0328 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
    2010/12/22 15:36:35.0953 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
    2010/12/22 15:36:36.0718 Point32 (cf7c1868b90c90a265fc3f60ce46265b) C:\WINDOWS\system32\DRIVERS\point32.sys
    2010/12/22 15:36:36.0921 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    2010/12/22 15:36:37.0062 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
    2010/12/22 15:36:37.0203 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    2010/12/22 15:36:37.0312 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    2010/12/22 15:36:37.0843 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    2010/12/22 15:36:37.0984 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    2010/12/22 15:36:38.0125 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    2010/12/22 15:36:38.0265 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    2010/12/22 15:36:38.0437 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    2010/12/22 15:36:38.0640 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    2010/12/22 15:36:38.0859 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    2010/12/22 15:36:39.0078 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
    2010/12/22 15:36:39.0234 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
    2010/12/22 15:36:39.0562 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    2010/12/22 15:36:39.0718 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
    2010/12/22 15:36:39.0828 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
    2010/12/22 15:36:39.0968 sermouse (1f16931c722c69e4a7866244796c66a0) C:\WINDOWS\system32\DRIVERS\sermouse.sys
    2010/12/22 15:36:40.0140 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    2010/12/22 15:36:40.0390 smwdm (21c6c6aeb3dd2836b0e21c599d8cd437) C:\WINDOWS\system32\drivers\smwdm.sys
    2010/12/22 15:36:40.0734 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    2010/12/22 15:36:40.0921 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
    2010/12/22 15:36:41.0125 Srv (3bb03f2ba89d2be417206c373d2af17c) C:\WINDOWS\system32\DRIVERS\srv.sys
    2010/12/22 15:36:41.0328 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    2010/12/22 15:36:41.0468 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    2010/12/22 15:36:41.0921 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    2010/12/22 15:36:42.0171 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    2010/12/22 15:36:42.0421 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    2010/12/22 15:36:42.0578 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    2010/12/22 15:36:42.0750 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    2010/12/22 15:36:43.0109 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    2010/12/22 15:36:43.0359 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    2010/12/22 15:36:43.0593 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\WINDOWS\system32\Drivers\usbaapl.sys
    2010/12/22 15:36:43.0765 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    2010/12/22 15:36:43.0937 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    2010/12/22 15:36:44.0109 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    2010/12/22 15:36:44.0296 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    2010/12/22 15:36:44.0406 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    2010/12/22 15:36:44.0578 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    2010/12/22 15:36:44.0703 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    2010/12/22 15:36:44.0937 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
    2010/12/22 15:36:45.0125 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    2010/12/22 15:36:45.0281 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
    2010/12/22 15:36:45.0609 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    2010/12/22 15:36:46.0234 ================================================================================
    2010/12/22 15:36:46.0234 Scan finished
    2010/12/22 15:36:46.0234 ================================================================================
    2010/12/22 15:36:46.0296 Detected object count: 1
    2010/12/22 15:37:03.0453 dmio (d8df502ded3fff583f6483ffa521aadd) C:\WINDOWS\system32\drivers\dmio.sys
    2010/12/22 15:37:03.0468 Suspicious file (Forged): C:\WINDOWS\system32\drivers\dmio.sys. Real md5: d8df502ded3fff583f6483ffa521aadd, Fake md5: 7c824cf7bbde77d95c08005717a95f6f
    2010/12/22 15:37:05.0796 Backup copy found, using it..
    2010/12/22 15:37:05.0812 C:\WINDOWS\system32\drivers\dmio.sys - will be cured after reboot
    2010/12/22 15:37:05.0812 Rootkit.Win32.TDSS.tdl3(dmio) - User select action: Cure
    2010/12/22 15:37:23.0187 Deinitialize success
     
  4. Broni

    Broni Malware Annihilator Posts: 47,704   +268

    Good job :)

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    ====================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.pif
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  5. BlackBabylon

    BlackBabylon TS Rookie Topic Starter

    Ive run into a little trouble with AVG and Combofix. I downloaded appremover as advised, ran the exe. and removed AVG. When i run Combofix, i receive a message saying AVG is still on the computer and Combofix will not run. I ran appremover, in both modes and AVG does not show up on the list.
     
  6. Broni

    Broni Malware Annihilator Posts: 47,704   +268

    Did you try Safe Mode?
     
  7. BlackBabylon

    BlackBabylon TS Rookie Topic Starter

    Safe mode was the solution.
    The computer currently has no anti-virus software, Should i wait till the end of this to install one?

    Here are the logs from MBRCheck and Combofix:

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000001d

    Kernel Drivers (total 122):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806EE000 \WINDOWS\system32\hal.dll
    0xF7987000 \WINDOWS\system32\KDCOM.DLL
    0xF7897000 \WINDOWS\system32\BOOTVID.dll
    0xF75C4000 klmdb.sys
    0xF7596000 ACPI.sys
    0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xF7585000 pci.sys
    0xF75F7000 isapnp.sys
    0xF798B000 intelide.sys
    0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xF7607000 MountMgr.sys
    0xF74C6000 ftdisk.sys
    0xF798D000 dmload.sys
    0xF74A0000 tskBE.tmp
    0xF770F000 PartMgr.sys
    0xF7617000 VolSnap.sys
    0xF7488000 atapi.sys
    0xF7627000 disk.sys
    0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xF7468000 fltMgr.sys
    0xF7456000 sr.sys
    0xF743F000 KSecDD.sys
    0xF7B52000 Ntfs.sys
    0xF7412000 NDIS.sys
    0xF787D000 Mup.sys
    0xF7647000 agp440.sys
    0xBAF98000 \SystemRoot\system32\DRIVERS\processr.sys
    0xBA40E000 \SystemRoot\system32\DRIVERS\g400dhm.sys
    0xBA3FA000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xBA3D3000 \SystemRoot\system32\DRIVERS\e100b325.sys
    0xBAF88000 \SystemRoot\system32\DRIVERS\serial.sys
    0xF776F000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF777F000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xF7787000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xF778F000 \SystemRoot\system32\DRIVERS\fdc.sys
    0xF792F000 \SystemRoot\system32\DRIVERS\serenum.sys
    0xBA3BF000 \SystemRoot\system32\DRIVERS\parport.sys
    0xBAF68000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xBAF58000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xBA39C000 \SystemRoot\system32\DRIVERS\ks.sys
    0xF7797000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    0xBAF48000 \SystemRoot\system32\DRIVERS\imapi.sys
    0xF779F000 \SystemRoot\system32\DRIVERS\usbuhci.sys
    0xBA378000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xBA312000 \SystemRoot\system32\drivers\smwdm.sys
    0xF7A6B000 \SystemRoot\system32\drivers\SENSUPGD.SYS
    0xBA2EE000 \SystemRoot\system32\drivers\portcls.sys
    0xBAF38000 \SystemRoot\system32\drivers\drmk.sys
    0xF7A6F000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xF7677000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xF793B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xBA277000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xF7687000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xF7697000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xF77A7000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xBA1C6000 \SystemRoot\system32\DRIVERS\psched.sys
    0xF76A7000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xF77B7000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xF77BF000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xBA0FD000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xF76B7000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xF799F000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xBA09F000 \SystemRoot\system32\DRIVERS\update.sys
    0xBAFF4000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xF76C7000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF77CF000 \SystemRoot\system32\DRIVERS\flpydisk.sys
    0xF76E7000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xF79BB000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xF79BD000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xBA154000 \SystemRoot\System32\Drivers\Null.SYS
    0xF79BF000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF77DF000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    0xF77E7000 \SystemRoot\System32\drivers\vga.sys
    0xF79C1000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF79C3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF77EF000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF77F7000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF791B000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xB7FF4000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xB7F9B000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xB7F82000 \SystemRoot\System32\Drivers\avgtdix.sys
    0xB7F5A000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xB7F38000 \SystemRoot\System32\drivers\afd.sys
    0xF76F7000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xB7F0D000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xB7E75000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xF7575000 \SystemRoot\System32\Drivers\Fips.SYS
    0xB7E4F000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xF7565000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xF77FF000 \SystemRoot\System32\Drivers\avgmfx86.sys
    0xB7DFE000 \SystemRoot\System32\Drivers\avgldx86.sys
    0xF7807000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0xBA1AE000 \SystemRoot\system32\DRIVERS\usbscan.sys
    0xF780F000 \SystemRoot\system32\DRIVERS\usbprint.sys
    0xBA1AA000 \SystemRoot\system32\DRIVERS\hidusb.sys
    0xF7555000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    0xBA1A2000 \SystemRoot\system32\DRIVERS\kbdhid.sys
    0xF7817000 \SystemRoot\system32\DRIVERS\NuidFltr.sys
    0xF7545000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
    0xB7D83000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
    0xBA19E000 \SystemRoot\system32\DRIVERS\mouhid.sys
    0xF781F000 \SystemRoot\system32\DRIVERS\point32.sys
    0xF7525000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xB7CCB000 \SystemRoot\System32\Drivers\dump_atapi.sys
    0xF79F9000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xF7913000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF772F000 \SystemRoot\System32\watchdog.sys
    0xBF9C3000 \SystemRoot\System32\drivers\dxg.sys
    0xBA152000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF9D5000 \SystemRoot\System32\G400DHD.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xB596B000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xB55EE000 \SystemRoot\system32\drivers\wdmaud.sys
    0xB57D3000 \SystemRoot\system32\drivers\sysaudio.sys
    0xB5573000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xF79C9000 \SystemRoot\System32\Drivers\ParVdm.SYS
    0xF79D5000 \SystemRoot\System32\Drivers\MASPINT.SYS
    0xB5195000 \SystemRoot\system32\DRIVERS\srv.sys
    0xB4B76000 \SystemRoot\System32\Drivers\HTTP.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 42):
    0 System Idle Process
    4 System
    560 C:\WINDOWS\system32\smss.exe
    624 csrss.exe
    648 C:\WINDOWS\system32\winlogon.exe
    692 C:\WINDOWS\system32\services.exe
    704 C:\WINDOWS\system32\lsass.exe
    876 C:\WINDOWS\system32\svchost.exe
    944 svchost.exe
    1040 C:\WINDOWS\system32\svchost.exe
    1096 svchost.exe
    1260 svchost.exe
    1568 C:\WINDOWS\explorer.exe
    1596 C:\WINDOWS\system32\spoolsv.exe
    1912 svchost.exe
    1992 C:\WINDOWS\system32\promon.exe
    2032 C:\Program Files\BroadJump\Client Foundation\CFD.exe
    2040 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    128 C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
    168 C:\Program Files\Lexmark 2400 Series\ezprint.exe
    288 C:\PROGRA~1\AVG\AVG8\avgtray.exe
    332 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    376 C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe
    400 C:\Program Files\iTunes\iTunesHelper.exe
    416 C:\Program Files\FinePixViewer\QuickDCF.exe
    444 C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    348 C:\Program Files\Bonjour\mDNSResponder.exe
    900 C:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe
    1120 C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe
    1184 C:\WINDOWS\system32\mgabg.exe
    1336 C:\WINDOWS\system32\svchost.exe
    2016 C:\PROGRA~1\AVG\AVG8\avgemc.exe
    208 C:\Program Files\AVG\AVG8\avgrsx.exe
    1848 C:\Program Files\AVG\AVG8\avgcsrvx.exe
    2312 C:\Program Files\iPod\bin\iPodService.exe
    2336 C:\WINDOWS\system32\lxcrcoms.exe
    2820 alg.exe
    504 C:\WINDOWS\system32\mshta.exe
    1200 C:\WINDOWS\system32\mshta.exe
    3132 C:\Program Files\Mozilla Firefox\firefox.exe
    3720 C:\WINDOWS\system32\mshta.exe
    2464 C:\Documents and Settings\LonnyM\Desktop\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

    PhysicalDrive0 Model Number: Maxtor2F040L0, Rev: VAM51JJ0

    Size Device Name MBR Status
    --------------------------------------------
    38 GB \\.\PhysicalDrive0 Windows XP MBR code detected
    SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


    Done!


    ComboFix 10-12-22.01 - LonnyM 12/23/2010 10:48:09.1.1 - x86 MINIMAL
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1309 [GMT -5:00]
    Running from: c:\documents and settings\LonnyM\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\LonnyM\Application Data\Local
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\0.ddi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\1.ddi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\2.ddi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\3.ddi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\4.ddi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\5.ddi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\6.ddi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\fzbtqhixqcto.avi.ddr
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\ketxagyqhqcn.avi.ddr
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\mtdbypnasqdx.avi.ddr
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\mxlnajgktpcv.avi.ddr
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\ophsdsvflotc.avi.ddr
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\settings.ddi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\sspnzvyxtjot.avi.ddr
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\fzbtqhixqcto.avi.ddp
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\ketxagyqhqcn.avi.ddp
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\mtdbypnasqdx.avi.ddp
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\mxlnajgktpcv.avi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\ophsdsvflotc.avi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\sspnzvyxtjot.avi.ddp
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\wlghgydxqseq.avi
    c:\documents and settings\LonnyM\Application Data\Local\Temp\DDM\Settings\wlghgydxqseq.avi.ddr
    c:\documents and settings\LonnyM\Application Data\PC
    c:\windows\Tasks\At1.job
    c:\windows\Tasks\At10.job
    c:\windows\Tasks\At11.job
    c:\windows\Tasks\At12.job
    c:\windows\Tasks\At13.job
    c:\windows\Tasks\At14.job
    c:\windows\Tasks\At15.job
    c:\windows\Tasks\At16.job
    c:\windows\Tasks\At17.job
    c:\windows\Tasks\At18.job
    c:\windows\Tasks\At19.job
    c:\windows\Tasks\At2.job
    c:\windows\Tasks\At20.job
    c:\windows\Tasks\At21.job
    c:\windows\Tasks\At22.job
    c:\windows\Tasks\At23.job
    c:\windows\Tasks\At24.job
    c:\windows\Tasks\At3.job
    c:\windows\Tasks\At4.job
    c:\windows\Tasks\At5.job
    c:\windows\Tasks\At6.job
    c:\windows\Tasks\At7.job
    c:\windows\Tasks\At8.job
    c:\windows\Tasks\At9.job

    .
    ((((((((((((((((((((((((( Files Created from 2010-11-23 to 2010-12-23 )))))))))))))))))))))))))))))))
    .

    2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\documents and settings\LonnyM\Application Data\Malwarebytes
    2010-12-22 18:48 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-12-22 18:48 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-22 15:58 . 2010-12-22 15:59 -------- d-----w- c:\documents and settings\LonnyM\Application Data\vlc
    2010-12-22 15:55 . 2010-12-22 15:55 -------- d-----w- c:\program files\VideoLAN
    2010-12-21 21:04 . 2010-12-21 21:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-12-21 21:03 . 2010-01-11 00:40 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
    2010-12-21 21:03 . 2010-01-11 00:40 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX
    2010-12-21 16:43 . 2010-12-21 16:43 -------- d-----w- c:\program files\Common Files\DivX Shared
    2010-12-21 01:48 . 2010-12-21 01:48 -------- d-----w- c:\documents and settings\LonnyM\Application Data\DivX
    2010-12-21 01:41 . 2010-12-21 16:43 -------- d-----w- c:\program files\DivX
    2010-12-21 01:41 . 2010-12-21 16:38 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
    2010-12-20 13:52 . 2010-12-20 13:52 -------- d-----w- c:\documents and settings\LonnyM\Local Settings\Application Data\Opera
    2010-12-20 13:52 . 2010-12-20 13:52 -------- d-----w- c:\program files\Opera
    2010-12-20 04:44 . 2010-12-20 04:44 -------- d-----w- c:\documents and settings\LonnyM\Application Data\Panda Security
    2010-12-20 04:32 . 2010-12-22 18:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security
    2010-12-19 14:23 . 2010-12-19 14:23 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2010-12-18 15:40 . 2010-12-18 15:40 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Identities
    2010-12-18 08:12 . 2010-12-18 08:12 -------- d-s---w- c:\documents and settings\LocalService\UserData
    2010-12-18 08:11 . 2010-12-18 08:11 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
    2010-12-11 16:42 . 2010-12-11 16:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
    2010-12-11 16:42 . 2010-12-11 16:42 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-22 20:38 . 2008-04-14 04:14 153344 ----a-w- c:\windows\system32\drivers\dmio.sys
    2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    .

    ------- Sigcheck -------

    [-] 2009-01-15 . 600D58665D16BFBB776EFEFB0E80532D . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SprintModemUpdate"="javaw.exe -cp" [X]
    "Promon.exe"="Promon.exe" [2000-04-13 29184]
    "BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2003-01-27 376912]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
    "lxcrmon.exe"="c:\program files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 286720]
    "EzPrint"="c:\program files\Lexmark 2400 Series\ezprint.exe" [2006-02-07 98304]
    "FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]
    "LXCRCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 65536]
    "REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
    "Matrox PowerDesk SE"="c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe" [2009-02-06 4223232]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2002-1-9 200704]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Opera\\opera.exe"=

    S2 Matrox Centering Service;Matrox Centering Service;c:\program files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe [2/6/2009 1:09 PM 1263872]
    S2 Matrox.Pdesk.ServicesHost;Matrox.Pdesk.ServicesHost;c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe [2/6/2009 1:08 PM 344832]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

    2009-07-04 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
    - c:\program files\Microsoft IntelliPoint\ipoint.exe [2008-06-10 19:56]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    FF - ProfilePath - c:\documents and settings\LonnyM\Application Data\Mozilla\Firefox\Profiles\lbatd972.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-DivX Download Manager - c:\program files\DivX\DivX Plus Web Player\DDmService.exe
    Notify-avgrsstarter - (no file)
    SafeBoot-klmdb.sys



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-12-23 10:53
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    LXCRCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2010-12-23 10:56:57
    ComboFix-quarantined-files.txt 2010-12-23 15:56

    Pre-Run: 26,877,255,680 bytes free
    Post-Run: 26,858,795,008 bytes free

    - - End Of File - - 5AC989CFEBB2E9B41878C8FF32E2A8C7
     
  8. Broni

    Broni Malware Annihilator Posts: 47,704   +268

  9. BlackBabylon

    BlackBabylon TS Rookie Topic Starter

    Ran Combofix in safe mode with networking, the recovery console was installed and installed Avast! antivirus.

    Here is the new Combofix log:

    ComboFix 10-12-22.01 - LonnyM 12/23/2010 13:20:39.2.1 - x86 NETWORK
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1304 [GMT -5:00]
    Running from: c:\documents and settings\LonnyM\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((( Files Created from 2010-11-23 to 2010-12-23 )))))))))))))))))))))))))))))))
    .

    2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\documents and settings\LonnyM\Application Data\Malwarebytes
    2010-12-22 18:48 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-12-22 18:48 . 2010-12-22 18:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-12-22 18:48 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-22 15:58 . 2010-12-22 15:59 -------- d-----w- c:\documents and settings\LonnyM\Application Data\vlc
    2010-12-22 15:55 . 2010-12-22 15:55 -------- d-----w- c:\program files\VideoLAN
    2010-12-21 21:04 . 2010-12-21 21:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-12-21 21:03 . 2010-01-11 00:40 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
    2010-12-21 21:03 . 2010-01-11 00:40 1071088 ----a-w- c:\windows\system32\MSCOMCTL.OCX
    2010-12-21 16:43 . 2010-12-21 16:43 -------- d-----w- c:\program files\Common Files\DivX Shared
    2010-12-21 01:48 . 2010-12-21 01:48 -------- d-----w- c:\documents and settings\LonnyM\Application Data\DivX
    2010-12-21 01:41 . 2010-12-21 16:43 -------- d-----w- c:\program files\DivX
    2010-12-21 01:41 . 2010-12-21 16:38 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
    2010-12-20 13:52 . 2010-12-20 13:52 -------- d-----w- c:\documents and settings\LonnyM\Local Settings\Application Data\Opera
    2010-12-20 13:52 . 2010-12-20 13:52 -------- d-----w- c:\program files\Opera
    2010-12-20 04:44 . 2010-12-20 04:44 -------- d-----w- c:\documents and settings\LonnyM\Application Data\Panda Security
    2010-12-20 04:32 . 2010-12-22 18:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security
    2010-12-19 14:23 . 2010-12-19 14:23 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2010-12-18 15:40 . 2010-12-18 15:40 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Identities
    2010-12-18 08:12 . 2010-12-18 08:12 -------- d-s---w- c:\documents and settings\LocalService\UserData
    2010-12-18 08:11 . 2010-12-18 08:11 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
    2010-12-11 16:42 . 2010-12-11 16:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
    2010-12-11 16:42 . 2010-12-11 16:42 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-22 20:38 . 2008-04-14 04:14 153344 ----a-w- c:\windows\system32\drivers\dmio.sys
    2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    .

    ------- Sigcheck -------

    [-] 2009-01-15 . 600D58665D16BFBB776EFEFB0E80532D . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SprintModemUpdate"="javaw.exe -cp" [X]
    "Promon.exe"="Promon.exe" [2000-04-13 29184]
    "BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2003-01-27 376912]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
    "lxcrmon.exe"="c:\program files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 286720]
    "EzPrint"="c:\program files\Lexmark 2400 Series\ezprint.exe" [2006-02-07 98304]
    "FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 290816]
    "LXCRCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2005-12-01 65536]
    "REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
    "Matrox PowerDesk SE"="c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe" [2009-02-06 4223232]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2002-1-9 200704]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Opera\\opera.exe"=

    S2 Matrox Centering Service;Matrox Centering Service;c:\program files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe [2/6/2009 1:09 PM 1263872]
    S2 Matrox.Pdesk.ServicesHost;Matrox.Pdesk.ServicesHost;c:\program files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe [2/6/2009 1:08 PM 344832]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

    2009-07-04 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
    - c:\program files\Microsoft IntelliPoint\ipoint.exe [2008-06-10 19:56]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    FF - ProfilePath - c:\documents and settings\LonnyM\Application Data\Mozilla\Firefox\Profiles\lbatd972.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-12-23 13:24
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    LXCRCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2010-12-23 13:27:24
    ComboFix-quarantined-files.txt 2010-12-23 18:27
    ComboFix2.txt 2010-12-23 15:56

    Pre-Run: 26,850,430,976 bytes free
    Post-Run: 26,840,756,224 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    - - End Of File - - 6C28EB21F474D40B5B2C14C28F601D0F
     
  10. Broni

    Broni Malware Annihilator Posts: 47,704   +268

    Good :)

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  11. BlackBabylon

    BlackBabylon TS Rookie Topic Starter

    Ran OTL with the text pasted in in the custom scan box.

    Here are the OTL and Extras logs:

    OTL logfile created on: 12/23/2010 2:17:05 PM - Run 1
    OTL by OldTimer - Version 3.2.18.0 Folder = C:\Documents and Settings\LonnyM\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
    2.00 Gb Paging File | 1.00 Gb Available in Paging File | 86.00% Paging File free
    Paging file location(s): C:\pagefile.sys 384 768 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 38.28 Gb Total Space | 23.21 Gb Free Space | 60.64% Space Free | Partition Type: NTFS

    Computer Name: LONNY | User Name: LonnyM | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2010/12/23 14:14:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe
    PRC - [2010/12/11 12:15:28 | 000,910,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
    PRC - [2010/09/07 11:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    PRC - [2009/02/06 13:09:16 | 001,263,872 | ---- | M] (Matrox Graphics Inc.) -- c:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe
    PRC - [2009/02/06 13:08:32 | 004,223,232 | ---- | M] (Matrox Graphics Inc.) -- C:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe
    PRC - [2009/02/06 13:08:28 | 000,344,832 | ---- | M] (Matrox Graphics Inc) -- c:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe
    PRC - [2008/04/14 04:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/04/04 07:48:42 | 000,087,560 | ---- | M] (Matrox Graphics Inc.) -- C:\WINDOWS\system32\mgabg.exe
    PRC - [2006/02/07 00:10:34 | 000,098,304 | ---- | M] (Lexmark International Inc.) -- C:\Program Files\Lexmark 2400 Series\ezprint.exe
    PRC - [2006/02/02 22:11:22 | 000,495,616 | ---- | M] ( ) -- C:\WINDOWS\system32\lxcrcoms.exe
    PRC - [2006/01/22 12:45:08 | 000,286,720 | ---- | M] () -- C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
    PRC - [2003/01/27 16:16:58 | 000,376,912 | ---- | M] () -- C:\Program Files\BroadJump\Client Foundation\CFD.exe
    PRC - [2002/01/09 20:53:14 | 000,200,704 | ---- | M] (FUJI PHOTO FILM CO., LTD.) -- C:\Program Files\FinePixViewer\QuickDCF.exe
    PRC - [2000/04/13 06:34:18 | 000,029,184 | R--- | M] (Intel Corporation) -- C:\WINDOWS\system32\promon.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/12/23 14:14:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe


    ========== Win32 Services (SafeList) ==========

    SRV - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
    SRV - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
    SRV - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
    SRV - [2009/02/06 13:09:16 | 001,263,872 | ---- | M] (Matrox Graphics Inc.) [Auto | Running] -- c:\Program Files\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe -- (Matrox Centering Service)
    SRV - [2009/02/06 13:08:28 | 000,344,832 | ---- | M] (Matrox Graphics Inc) [Auto | Running] -- c:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.Pdesk.ServicesHost.exe -- (Matrox.Pdesk.ServicesHost)
    SRV - [2007/04/04 07:48:42 | 000,087,560 | ---- | M] (Matrox Graphics Inc.) [Auto | Running] -- C:\WINDOWS\system32\mgabg.exe -- (MGABGEXE)
    SRV - [2006/02/02 22:11:22 | 000,495,616 | ---- | M] ( ) [On_Demand | Running] -- C:\WINDOWS\System32\lxcrcoms.exe -- (lxcr_device)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\LonnyM\LOCALS~1\Temp\catchme.sys -- (catchme)
    DRV - [2010/09/07 10:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2010/09/07 10:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2010/09/07 10:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2010/09/07 10:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2010/09/07 10:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2010/09/07 10:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2009/02/06 12:19:52 | 000,350,592 | ---- | M] (Matrox Graphics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\g400dhm.sys -- (G400DH)
    DRV - [2001/08/17 07:49:42 | 000,322,432 | ---- | M] (Matrox Graphics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\G400m.sys -- (G400)
    DRV - [2001/08/17 07:20:04 | 000,096,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Intel(r) 82801 Audio Driver Install Service (WDM)
    DRV - [2000/03/29 16:11:20 | 000,008,096 | ---- | M] (MicroStaff Co.,Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\MASPINT.SYS -- (MASPINT)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "http://www.google.com"

    FF - HKLM\software\mozilla\Mozilla Firefox 3.5.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/11 12:15:36 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.5.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/21 11:43:32 | 000,000,000 | ---D | M]

    [2009/06/30 20:18:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\Mozilla\Extensions
    [2009/06/30 20:18:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\Mozilla\Firefox\Profiles\lbatd972.default\extensions
    [2009/06/30 20:18:02 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

    O1 HOSTS File: ([2010/12/23 10:53:43 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
    O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
    O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
    O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe ()
    O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2400 Series\ezprint.exe (Lexmark International Inc.)
    O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Lexmark Fax Solutions\fm3032.exe ()
    O4 - HKLM..\Run: [LXCRCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.DLL ()
    O4 - HKLM..\Run: [lxcrmon.exe] C:\Program Files\Lexmark 2400 Series\lxcrmon.exe ()
    O4 - HKLM..\Run: [Matrox PowerDesk SE] c:\Program Files\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe (Matrox Graphics Inc.)
    O4 - HKLM..\Run: [Promon.exe] C:\WINDOWS\System32\promon.exe (Intel Corporation)
    O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
    O4 - HKLM..\Run: [SprintModemUpdate] C:\WINDOWS\System32\javaw.exe ()
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\Documents and Settings\LonnyM\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\LonnyM\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2009/06/30 20:49:06 | 000,000,018 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O32 - AutoRun File - [2009/06/29 21:34:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BIT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (16902109354000384)

    ========== Files/Folders - Created Within 30 Days ==========

    [2010/12/23 14:14:39 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe
    [2010/12/23 13:58:19 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2010/12/23 13:44:01 | 000,017,744 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
    [2010/12/23 13:44:00 | 000,165,584 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2010/12/23 13:43:58 | 000,023,376 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2010/12/23 13:43:56 | 000,046,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2010/12/23 13:43:53 | 000,100,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
    [2010/12/23 13:43:53 | 000,094,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
    [2010/12/23 13:43:52 | 000,028,880 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
    [2010/12/23 13:43:20 | 000,038,848 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2010/12/23 13:43:19 | 000,167,592 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2010/12/23 13:30:26 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
    [2010/12/23 13:30:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2010/12/23 13:27:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
    [2010/12/23 13:18:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2010/12/23 13:15:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC
    [2010/12/23 10:45:44 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2010/12/23 10:45:44 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2010/12/23 10:45:44 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2010/12/23 10:45:44 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2010/12/23 10:45:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/12/22 20:08:25 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2010/12/22 18:31:48 | 005,473,272 | ---- | C] (OPSWAT, Inc.) -- C:\Documents and Settings\LonnyM\Desktop\AppRemover.exe
    [2010/12/22 13:48:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\Malwarebytes
    [2010/12/22 13:48:26 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/12/22 13:48:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/12/22 13:48:21 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/12/22 13:48:21 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/12/22 13:46:55 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\LonnyM\Desktop\mbam-setup-1.50.1.1100.exe
    [2010/12/22 13:35:22 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\TFC.exe
    [2010/12/22 10:58:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\vlc
    [2010/12/22 10:55:47 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
    [2010/12/21 16:04:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
    [2010/12/21 11:43:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DivX Shared
    [2010/12/20 20:49:22 | 000,000,000 | R--D | C] -- C:\Documents and Settings\LonnyM\My Documents\My Videos
    [2010/12/20 20:48:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\DivX
    [2010/12/20 20:41:58 | 000,000,000 | ---D | C] -- C:\Program Files\DivX
    [2010/12/20 20:41:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DivX
    [2010/12/20 08:52:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Local Settings\Application Data\Opera
    [2010/12/20 08:52:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\Opera
    [2010/12/20 08:52:34 | 000,000,000 | ---D | C] -- C:\Program Files\Opera
    [2010/12/19 23:44:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LonnyM\Application Data\Panda Security
    [2010/12/19 23:32:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Panda Security
    [2010/12/19 09:23:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Sun
    [2010/12/19 09:23:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
    [2010/12/19 09:23:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
    [2010/12/18 10:40:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Identities
    [2010/12/18 10:40:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Identities
    [2010/12/18 03:11:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
    [2010/12/18 03:11:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Apple Computer
    [2010/12/16 15:55:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
    [2010/12/16 09:47:52 | 001,345,624 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\LonnyM\Desktop\TDSSKiller.exe
    [2010/12/11 11:42:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer
    [2010/12/11 11:42:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Apple Computer
    [2009/08/01 17:28:35 | 000,409,600 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrinpa.dll
    [2009/08/01 17:28:35 | 000,393,216 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcriesc.dll
    [2009/08/01 17:23:38 | 001,183,744 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrserv.dll
    [2009/08/01 17:23:38 | 000,995,328 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrusb1.dll
    [2009/08/01 17:23:38 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrprox.dll
    [2009/08/01 17:23:37 | 000,536,576 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrlmpm.dll
    [2009/08/01 17:23:37 | 000,114,688 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrpplc.dll
    [2009/08/01 17:23:35 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomm.dll
    [2009/08/01 17:23:34 | 000,610,304 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomc.dll

    ========== Files - Modified Within 30 Days ==========

    [2010/12/23 14:14:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe
    [2010/12/23 13:55:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/12/23 13:55:37 | 1609,945,088 | -HS- | M] () -- C:\hiberfil.sys
    [2010/12/23 13:44:02 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2010/12/23 13:43:54 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2010/12/23 13:18:17 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2010/12/23 11:00:51 | 000,000,415 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\Shortcut to ComboFix.lnk
    [2010/12/23 10:53:43 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2010/12/22 18:32:47 | 003,996,586 | R--- | M] () -- C:\Documents and Settings\LonnyM\Desktop\ComboFix.exe
    [2010/12/22 18:32:24 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\MBRCheck.exe
    [2010/12/22 18:31:50 | 005,473,272 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\LonnyM\Desktop\AppRemover.exe
    [2010/12/22 16:49:24 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2010/12/22 15:34:24 | 001,232,020 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\tdsskiller.zip
    [2010/12/22 15:25:07 | 000,013,312 | ---- | M] () -- C:\Documents and Settings\LonnyM\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/12/22 14:05:15 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\4umf5hup.exe
    [2010/12/22 13:48:26 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/12/22 13:47:20 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\LonnyM\Desktop\mbam-setup-1.50.1.1100.exe
    [2010/12/22 13:35:23 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\TFC.exe
    [2010/12/22 10:57:34 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
    [2010/12/21 16:43:41 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/12/20 08:52:44 | 000,001,510 | ---- | M] () -- C:\Documents and Settings\LonnyM\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
    [2010/12/20 08:52:44 | 000,001,492 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Opera.lnk
    [2010/12/17 20:10:07 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2010/12/16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\LonnyM\Desktop\TDSSKiller.exe

    ========== Files Created - No Company Name ==========

    [2010/12/23 13:44:02 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2010/12/23 13:32:20 | 1609,945,088 | -HS- | C] () -- C:\hiberfil.sys
    [2010/12/23 13:18:17 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2010/12/23 13:18:13 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2010/12/23 11:00:51 | 000,000,415 | ---- | C] () -- C:\Documents and Settings\LonnyM\Desktop\Shortcut to ComboFix.lnk
    [2010/12/23 10:45:44 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2010/12/23 10:45:44 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2010/12/23 10:45:44 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/12/23 10:45:44 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2010/12/23 10:45:44 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2010/12/22 18:32:46 | 003,996,586 | R--- | C] () -- C:\Documents and Settings\LonnyM\Desktop\ComboFix.exe
    [2010/12/22 18:32:24 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\LonnyM\Desktop\MBRCheck.exe
    [2010/12/22 15:34:09 | 001,232,020 | ---- | C] () -- C:\Documents and Settings\LonnyM\Desktop\tdsskiller.zip
    [2010/12/22 14:05:14 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\LonnyM\Desktop\4umf5hup.exe
    [2010/12/22 13:48:26 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/12/22 10:57:34 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
    [2010/12/20 08:52:44 | 000,001,510 | ---- | C] () -- C:\Documents and Settings\LonnyM\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
    [2010/12/20 08:52:44 | 000,001,492 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Opera.lnk
    [2009/11/26 19:14:47 | 000,013,312 | ---- | C] () -- C:\Documents and Settings\LonnyM\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2009/11/16 21:28:23 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
    [2009/08/18 19:41:23 | 000,030,208 | ---- | C] () -- C:\WINDOWS\System32\WNASPI32.DLL
    [2009/08/18 19:41:23 | 000,000,291 | ---- | C] () -- C:\WINDOWS\msfsetup.ini
    [2009/08/01 17:28:38 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxcrvs.dll
    [2009/08/01 17:28:33 | 000,303,104 | ---- | C] () -- C:\WINDOWS\System32\lxcrcoin.dll
    [2009/08/01 17:27:41 | 000,684,032 | ---- | C] () -- C:\WINDOWS\System32\lxcrdrs.dll
    [2009/08/01 17:27:41 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxcrcaps.dll
    [2009/08/01 17:27:40 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\lxcrcnv4.dll
    [2009/08/01 17:27:06 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\LXPRMON.DLL
    [2009/08/01 17:27:06 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXPMONUI.DLL
    [2009/08/01 17:23:39 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\LXCRinst.dll
    [2009/07/03 09:28:35 | 000,663,552 | ---- | C] () -- C:\WINDOWS\System32\libeay32_1-1-0_DDR.dll
    [2009/07/03 09:28:35 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32_1-1-0_DDR.dll
    [2009/07/03 09:28:34 | 000,532,594 | ---- | C] () -- C:\WINDOWS\System32\xerces-c_1_40_0_DDR.dll
    [2009/07/03 09:28:34 | 000,524,377 | ---- | C] () -- C:\WINDOWS\System32\stlport_4_0_0_DDR.dll
    [2009/07/03 09:28:34 | 000,307,329 | ---- | C] () -- C:\WINDOWS\System32\BJBase_2-2-2_DDR.dll
    [2009/06/29 17:15:23 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

    ========== LOP Check ==========

    [2010/12/23 13:30:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2009/09/21 20:32:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Matrox
    [2009/09/21 20:32:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Matrox Graphics Inc
    [2010/12/22 13:13:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Panda Security
    [2010/12/21 16:26:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
    [2010/07/30 18:04:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2009/09/10 20:47:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    [2009/07/04 11:01:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    [2009/08/18 19:49:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\FUJIFILM
    [2010/12/20 08:52:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\Opera
    [2010/12/19 23:44:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LonnyM\Application Data\Panda Security

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < >

    < %SYSTEMDRIVE%\*.* >
    [2009/06/30 20:49:06 | 000,000,018 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2009/06/29 21:34:34 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BIT
    [2009/12/23 19:44:20 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2010/12/23 13:18:17 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2010/12/23 13:27:24 | 000,007,997 | ---- | M] () -- C:\ComboFix.txt
    [2009/06/29 21:34:34 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2010/12/23 13:55:37 | 1609,945,088 | -HS- | M] () -- C:\hiberfil.sys
    [2009/06/29 21:50:59 | 000,000,090 | ---- | M] () -- C:\inf.log
    [2009/06/29 21:34:34 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2010/12/22 13:11:24 | 000,003,874 | ---- | M] () -- C:\lxcr.log
    [2010/12/23 13:55:54 | 000,003,244 | ---- | M] () -- C:\lxcrscan.log
    [2009/06/29 21:34:34 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2008/04/13 21:13:04 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2008/04/13 23:01:44 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2010/12/23 13:55:34 | 402,653,184 | -HS- | M] () -- C:\pagefile.sys
    [2009/06/29 21:53:37 | 000,000,169 | ---- | M] () -- C:\setup.log
    [2009/06/29 21:53:32 | 000,000,179 | ---- | M] () -- C:\setup1.log
    [2009/09/19 10:20:46 | 000,000,000 | ---- | M] () -- C:\t1bc.2
    [2009/09/19 10:20:46 | 000,000,000 | ---- | M] () -- C:\t1bc.3

    < %systemroot%\Fonts\*.com >

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2009/06/29 21:33:37 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2006/01/12 09:20:04 | 000,114,688 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\lxcrpp5c.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2010/09/07 11:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2009/06/29 17:08:11 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2009/06/29 17:08:11 | 001,089,536 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2009/06/29 17:08:10 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2009/06/29 21:34:45 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2009/06/29 21:47:50 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\LonnyM\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2009/06/29 21:47:49 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\LonnyM\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2010/12/22 14:05:15 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\4umf5hup.exe
    [2010/12/22 18:31:50 | 005,473,272 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\LonnyM\Desktop\AppRemover.exe
    [2010/12/22 18:32:47 | 003,996,586 | R--- | M] () -- C:\Documents and Settings\LonnyM\Desktop\ComboFix.exe
    [2009/01/11 20:35:49 | 007,518,240 | ---- | M] (Mozilla) -- C:\Documents and Settings\LonnyM\Desktop\Firefox Setup 3.0.5.exe
    [2009/07/04 10:46:11 | 077,690,152 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\LonnyM\Desktop\iTunesSetup.exe
    [2010/12/22 13:47:20 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\LonnyM\Desktop\mbam-setup-1.50.1.1100.exe
    [2010/12/22 18:32:24 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\LonnyM\Desktop\MBRCheck.exe
    [2010/12/23 14:14:41 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\OTL.exe
    [2010/12/16 09:47:52 | 001,345,624 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\LonnyM\Desktop\TDSSKiller.exe
    [2010/12/22 13:35:23 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LonnyM\Desktop\TFC.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2009/06/29 21:47:49 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\LonnyM\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2010/12/23 13:55:50 | 000,032,768 | ---- | M] () -- C:\Documents and Settings\LonnyM\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2008/04/14 04:42:40 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/14 04:41:52 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2007/04/02 22:37:24 | 000,004,821 | R--- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2007/04/02 22:37:24 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 22:00:30 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/14 04:42:30 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2002/08/20 14:29:48 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2002/08/20 14:30:06 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2002/08/20 14:30:06 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2007/04/02 22:37:28 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2007/04/02 22:34:02 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

    < End of report >


    OTL Extras logfile created on: 12/23/2010 2:17:05 PM - Run 1
    OTL by OldTimer - Version 3.2.18.0 Folder = C:\Documents and Settings\LonnyM\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.5512)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
    2.00 Gb Paging File | 1.00 Gb Available in Paging File | 86.00% Paging File free
    Paging file location(s): C:\pagefile.sys 384 768 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 38.28 Gb Total Space | 23.21 Gb Free Space | 60.64% Space Free | Partition Type: NTFS

    Computer Name: LONNY | User Name: LonnyM | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- Reg Error: Key error.
    https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "139:TCP" = 139:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Disabled:mad:xpsp2res.dll,-22002

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
    "C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
    "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" = C:\Program Files\Alwil Software\Avast5\AvastUI.exe:*:Enabled:avast! Free Antivirus -- (AVAST Software)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{02F6993D-B763-4F40-8F93-2A9CD97586E3}" = Microsoft IntelliType Pro 6.3
    "{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
    "{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Toolbar
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.3.2
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
    "{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver
    "{66A9D30D-1464-4C7F-B2F3-507DADAF2595}" = Microsoft IntelliPoint 6.3
    "{7148F0A8-6813-11D6-A77B-00B0D0142050}" = Java 2 Runtime Environment, SE v1.4.2_05
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
    "{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
    "{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}" = iTunes
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9AA7D28F-7C66-45BD-95C0-BEC00CEFD34A}" = Matrox PowerDesk-SE
    "{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
    "{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
    "{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
    "{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
    "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
    "{D3AA158A-9421-4883-8767-E771B0964A1D}" = ImageMixer VCD for FinePix
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "avast5" = avast! Free Antivirus
    "BroadJump Client Foundation" = BroadJump Client Foundation
    "CCleaner" = CCleaner (remove only)
    "InstallShield_{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.3.2
    "Lexmark 2400 Series" = Lexmark 2400 Series
    "Lexmark Fax Solutions" = Lexmark Fax Solutions
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Matrox Graphics Uninstaller" = Matrox Graphics Software (remove only)
    "Mozilla Firefox (3.5.16)" = Mozilla Firefox (3.5.16)
    "MSNINST" = MSN
    "MWASPI" = MicroStaff WINASPI
    "Opera 11.00.1156" = Opera 11.00
    "PROSet" = Intel(R) Network Connections Drivers
    "VLC media player" = VLC media player 1.1.5
    "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

    ========== Last 10 Event Log Errors ==========

    [ System Events ]
    Error - 12/23/2010 2:31:29 PM | Computer Name = LONNY | Source = DCOM | ID = 10005
    Description = DCOM got error "%1084" attempting to start the service EventSystem
    with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

    Error - 12/23/2010 2:32:38 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842784
    Description = Dependent Assembly Microsoft.VC90.MFC could not be found and Last
    Error was The referenced assembly is not installed on your system.

    Error - 12/23/2010 2:32:38 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842811
    Description = Resolve Partial Assembly failed for Microsoft.VC90.MFC. Reference error
    message: The referenced assembly is not installed on your system. .

    Error - 12/23/2010 2:32:38 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842811
    Description = Generate Activation Context failed for C:\Program Files\Alwil Software\Avast5\avastUI.exe.
    Reference
    error message: The operation completed successfully. .

    Error - 12/23/2010 2:32:49 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842784
    Description = Dependent Assembly Microsoft.VC90.MFC could not be found and Last
    Error was The referenced assembly is not installed on your system.

    Error - 12/23/2010 2:32:49 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842811
    Description = Resolve Partial Assembly failed for Microsoft.VC90.MFC. Reference error
    message: The referenced assembly is not installed on your system. .

    Error - 12/23/2010 2:32:49 PM | Computer Name = LONNY | Source = SideBySide | ID = 16842811
    Description = Generate Activation Context failed for C:\Program Files\Alwil Software\Avast5\AvastUI.exe.
    Reference
    error message: The operation completed successfully. .

    Error - 12/23/2010 2:33:25 PM | Computer Name = LONNY | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    i8042prt

    Error - 12/23/2010 2:41:12 PM | Computer Name = LONNY | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    i8042prt

    Error - 12/23/2010 2:56:29 PM | Computer Name = LONNY | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    i8042prt


    < End of report >
     
     
  12. Broni

    Broni Malware Annihilator Posts: 47,704   +268

    Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    =====================================================================

    OTL log looks perfectly clean :)

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  13. BlackBabylon

    BlackBabylon TS Rookie Topic Starter

    Updated java and removed all old versions, Ran Security Check, TFC and did the ESET online scan. ESET did not find any threats so there was no log file.

    Here is the Security Check log:

    Results of screen317's Security Check version 0.99.7
    Windows XP Service Pack 3
    Internet Explorer 6 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    avast! Free Antivirus
    Antivirus out of date!
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    CCleaner (remove only)
    Java(TM) 6 Update 23
    Out of date Java installed!
    Adobe Flash Player 10.1.53.64
    Adobe Reader 9.1
    Out of date Adobe Reader installed!
    Mozilla Firefox (3.5.16) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Alwil Software Avast5 AvastSvc.exe
    Alwil Software Avast5 avastUI.exe
    ``````````End of Log````````````
     
  14. Broni

    Broni Malware Annihilator Posts: 47,704   +268

    Update Internet Explorer to at least version 7.
    Version 6 is obsolete and thus dangerous.

    ==================================================================

    Update Firefox to the current 3.6.13 version.

    ===============================================================

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
    On this page:

    [​IMG]

    make sure, you have both boxes UN-checked AND (important!) click on Decline button

    =====================================================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
     
  15. BlackBabylon

    BlackBabylon TS Rookie Topic Starter

    Finally got around to finishing with the updates.

    Updated to Ie8.
    Updated to the latest Firefox version.
    Updated Adobe Reader.
    Ran OTL run fix and OTL clean up.
    Windows updates are current.
    Installed WOT for firefox.

    The computer seems to be fixed, haven't had an issue with the browser redirect since running through your removal process.

    Here is the OTL log for the run fix:

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes

    User: LonnyM
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 3221006 bytes
    ->Opera cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 3.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default User

    User: LocalService

    User: LonnyM
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.18.0 log created on 12272010_162554

    Files\Folders moved on Reboot...
    File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

    Registry entries deleted on Reboot...
     
  16. Broni

    Broni Malware Annihilator Posts: 47,704   +268

    Way to go!! [​IMG]
    Good luck and stay safe :)
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.