TechSpot

Having trouble removing "application cannot be executed" malware

By vokoun
Feb 8, 2011
  1. Hello everyone,
    I apologize if this is a duplicate post, but I read the notice that one should not try the fixes prescribed to another user, so I thought I would start a new thread.
    I also apologize in advance for being a total dummy as far as technology goes. You will probably have to speak slowly and repeat things........
    My laptop has been infected with the virus that poses as "antivirus software" and pops up the false "application cannot be executed, the file ####.exe is corrupted" warning box every 10-15 seconds. It also does this when I try to open task manager or virtually any other program.
    Internet Explorer doesn't work but fortunately I also have Firefox and for some reason Firefox seems to still work relatively unimpeded so far.

    What I tried so far:
    I was able to download MBAM. I then tried running it while in normal mode but the virus cut it off at the knees. I then ran MBAM in safe mode and it found 1 infected file. I told it to remove/fix the file and then rebooted to normal mode. The virus was still there.
    I was somehow able to then run MBAM in normal mode (I think by clicking on it immediately before the virus had 'set up camp' so to speak). It then found no infected files. A third scan in safe mode found no infected files. But the virus is still there. It has MBAM hornswoggled somehow.

    I really am at the limits of my meager tech-savvy and am very frustrated. Any help to restore my laptop would be greatly appreciated.
    I have intermittent access on another computer and will respond when I can. Thank you.
     
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    [​IMG]
    (Image courtesy animationplayhouse.com)

    Welcome to TechSpot! I'll be glad to help you but need information first.
    Please follow the steps in the Preliminary Virus and Malware Removal thread HERE.

    When you have finished, leave the logs for review in your next reply .
    NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.

    Important!
    Please do not use any other cleaning programs or scans while I'm helping you, unless I direct you to. Do not use a Registry cleaner or make any changes in the Registry.
     
  3. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    Strange development - I turned the laptop on again (after about a week of inactivity) and the malware did not appear. I tried MBAM just to see if it would run again and it did - it found 7 infected files this time and fixed them.
    Laptop seems to be running normally. All programs seem to work as usual now.
    Thoughts?
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Where is the Mbam log? Where are the other logs? Just because one function has been restored does not mean all the malware is gone.
     
  5. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    Indeed. Malware is still there. Laptop worked normally through the day (used intermittently, rebooted a couple of different times). Then at 11:59 or midnight the malware reappeared, with a different name and slightly different verbiage. Once again cutting off other programs at the knees, except for the first 15 seconds or so upon rebooting. Still trying to work through the 8 steps but it takes some time (life gets in the way). Please bear with me and thanks in advance for your patience.

    PS:If I can't run a process in normal mode, does it do any good to do it in safe mode?
    PPS: Is it helpful to you to have the MBAM logs before the other logs are done?
     
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Unless you give me some logs so I can see what's running, I'm not going to be able to help you. If you do have a Trojan.FakeAlert, it will show, then be quarantined in Mbam, I I haven't seen any log yet.
     
  7. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    Sorry about that. Here are the Mbam logs I have so far (6 total).

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5363

    Windows 5.1.2600 Service Pack 2 (Safe Mode)
    Internet Explorer 6.0.2900.2180

    2/2/2011 12:42:35 AM
    mbam-log-2011-02-02 (00-42-35).txt

    Scan type: Quick scan
    Objects scanned: 154326
    Time elapsed: 8 minute(s), 15 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\documents and settings\CMT\local settings\Temp\0.3212313812740757.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

    ---------------------

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5363

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    2/2/2011 12:52:37 AM
    mbam-log-2011-02-02 (00-52-37).txt

    Scan type: Quick scan
    Objects scanned: 155265
    Time elapsed: 4 minute(s), 20 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    -------------------

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5363

    Windows 5.1.2600 Service Pack 2 (Safe Mode)
    Internet Explorer 6.0.2900.2180

    2/2/2011 1:14:21 AM
    mbam-log-2011-02-02 (01-14-21).txt

    Scan type: Quick scan
    Objects scanned: 154326
    Time elapsed: 7 minute(s), 42 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    -------------------------

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5722

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    2/9/2011 11:33:23 AM
    mbam-log-2011-02-09 (11-33-23).txt

    Scan type: Quick scan
    Objects scanned: 160857
    Time elapsed: 4 minute(s), 35 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 3
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 3

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\ineufbr1v (Malware.Trace) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bfdircnq (Trojan.Downloader) -> Value: bfdircnq -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ebkxklus (Trojan.Downloader) -> Value: ebkxklus -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\documents and settings\CMT\local settings\Temp\nxinynabi\nwnkxrssjmo.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\documents and settings\CMT\local settings\Temp\clkmywnly\nngcmhfsjmo.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    c:\documents and settings\CMT\local settings\Temp\5.69050665606115e8.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

    -------------------

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5722

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    2/10/2011 12:04:38 AM
    mbam-log-2011-02-10 (00-04-38).txt

    Scan type: Quick scan
    Objects scanned: 161522
    Time elapsed: 4 minute(s), 38 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\documents and settings\CMT\local settings\Temp\0.13379155563689915.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

    --------------------

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5722

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    2/10/2011 12:20:06 AM
    mbam-log-2011-02-10 (00-20-06).txt

    Scan type: Quick scan
    Objects scanned: 161292
    Time elapsed: 4 minute(s), 25 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
  8. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    Okay I was finally able to get through the 8 (or now 6) steps. Hopefully I was able to do everything correctly.
    I ran another Mbam in the prescribed order of the steps so I am going to include it here too.

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5722

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    2/10/2011 9:45:53 PM
    mbam-log-2011-02-10 (21-45-53).txt

    Scan type: Quick scan
    Objects scanned: 151329
    Time elapsed: 3 minute(s), 52 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    --------
    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2011-02-10 21:58:24
    Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e FUJITSU_MHW2120BH rev.00000012
    Running: yw1y3oo5.exe; Driver: C:\DOCUME~1\CMT\LOCALS~1\Temp\uflcifob.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
    AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
    AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
    AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
    AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

    ---- EOF - GMER 1.0.15 ----


    DDS (Ver_10-12-12.02) - NTFSx86
    Run by CMT at 22:06:40.65 on Thu 02/10/2011
    Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_07
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.624 [GMT -8:00]

    AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
    AV: avast! antivirus 4.7.1043 [VPS 000773-1] *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\WINDOWS\BisonCam\BisonHK.exe
    C:\Program Files\Power Manager\PM.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    svchost.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\CMT\My Documents\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = <local>
    uInternet Settings,ProxyServer = http=127.0.0.1:18810
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
    uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
    uRun: [RegistryBooster] "c:\program files\uniblue\registrybooster\launcher.exe" delay 20000
    uRun: [iphausbw] c:\docume~1\cmt\locals~1\temp\yadmqgbgd\fbkemwwsika.exe
    uRun: [pwnwfpwt] c:\docume~1\cmt\locals~1\temp\pbjlqycyg\fjodtjhsika.exe
    mRun: [RTHDCPL] RTHDCPL.EXE
    mRun: [Alcmtr] ALCMTR.EXE
    mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
    mRun: [BisonHK] c:\windows\bisoncam\BisonHK.exe
    mRun: [PowerManager] c:\program files\power manager\PM.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
    mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
    mRun: [NWEReboot]
    mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
    mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
    mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe"
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    Notify: igfxcui - igfxdev.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\cmt\applic~1\mozilla\firefox\profiles\diz83s0c.default\
    FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
    FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
    FF - plugin: c:\documents and settings\cmt\application data\move networks\plugins\npqmp071505000011.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\cmt\application data\Move Networks
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\Ext

    ============= SERVICES / DRIVERS ===============

    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-2-10 11608]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-2-10 135336]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-2-10 267944]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-2-10 61960]
    S2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2007-12-4 132472]
    S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2007-12-4 243064]
    S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2007-12-4 345464]

    =============== Created Last 30 ================

    2011-02-11 04:44:21 -------- d-----w- c:\windows\system32\NtmsData
    2011-02-11 04:43:47 -------- d-----w- c:\docume~1\cmt\applic~1\Avira
    2011-02-11 04:40:30 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-02-11 04:40:29 -------- d-----w- c:\program files\Avira
    2011-02-11 04:40:29 -------- d-----w- c:\docume~1\alluse~1\applic~1\Avira
    2011-02-01 08:13:06 -------- d-----w- c:\docume~1\cmt\applic~1\Malwarebytes
    2011-02-01 08:12:18 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-01 08:12:18 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2011-02-01 08:12:15 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-02-01 08:12:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    ==================== Find3M ====================


    ============= FINISH: 22:07:19.62 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-12.02)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 11/25/2007 9:37:54 PM
    System Uptime: 2/10/2011 9:40:29 PM (1 hours ago)

    Motherboard: Intel Corporation | | SANTA ROSA CRB
    Processor: Intel(R) Pentium(R) Dual CPU T2310 @ 1.46GHz | U2E1 | 1463/mhz
    Processor: Intel(R) Pentium(R) Dual CPU T2310 @ 1.46GHz | U2E1 | 1462/mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 112 GiB total, 66.142 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Intel(R) PRO/Wireless 3945ABG Network Connection
    Device ID: PCI\VEN_8086&DEV_4222&SUBSYS_10008086&REV_02\4&29E2C51B&0&00E1
    Manufacturer: Intel Corporation
    Name: Intel(R) PRO/Wireless 3945ABG Network Connection
    PNP Device ID: PCI\VEN_8086&DEV_4222&SUBSYS_10008086&REV_02\4&29E2C51B&0&00E1
    Service: NETw4x32

    ==== System Restore Points ===================

    RP705: 11/3/2010 4:53:01 PM - System Checkpoint
    RP706: 11/4/2010 7:59:51 PM - System Checkpoint
    RP707: 11/6/2010 4:03:37 PM - System Checkpoint
    RP708: 11/6/2010 5:41:56 PM - Installed Steam
    RP709: 11/7/2010 12:05:20 AM - Removed Steam
    RP710: 11/8/2010 1:12:24 PM - System Checkpoint
    RP711: 11/9/2010 5:56:01 PM - System Checkpoint
    RP712: 11/10/2010 1:19:22 PM - Software Distribution Service 3.0
    RP713: 11/11/2010 1:44:02 PM - System Checkpoint
    RP714: 11/12/2010 2:54:43 PM - System Checkpoint
    RP715: 11/14/2010 3:25:38 PM - System Checkpoint
    RP716: 11/15/2010 11:52:54 PM - System Checkpoint
    RP717: 11/17/2010 12:16:25 AM - System Checkpoint
    RP718: 11/18/2010 4:48:50 PM - System Checkpoint
    RP719: 11/20/2010 12:45:12 AM - System Checkpoint
    RP720: 11/21/2010 2:33:47 PM - System Checkpoint
    RP721: 11/22/2010 3:18:20 PM - System Checkpoint
    RP722: 11/23/2010 5:18:54 PM - System Checkpoint
    RP723: 11/24/2010 5:58:39 PM - System Checkpoint
    RP724: 11/25/2010 6:37:37 PM - System Checkpoint
    RP725: 11/26/2010 7:03:30 PM - System Checkpoint
    RP726: 11/27/2010 9:08:21 PM - System Checkpoint
    RP727: 11/29/2010 2:26:14 PM - System Checkpoint
    RP728: 12/1/2010 5:14:35 PM - System Checkpoint
    RP729: 12/2/2010 11:30:14 PM - System Checkpoint
    RP730: 12/4/2010 4:16:51 PM - System Checkpoint
    RP731: 12/5/2010 4:33:31 PM - System Checkpoint
    RP732: 12/6/2010 4:51:11 PM - System Checkpoint
    RP733: 12/7/2010 6:54:25 PM - System Checkpoint
    RP734: 12/8/2010 9:13:41 PM - System Checkpoint
    RP735: 12/9/2010 9:57:02 PM - System Checkpoint
    RP736: 12/11/2010 6:34:59 PM - System Checkpoint
    RP737: 12/12/2010 8:07:14 PM - System Checkpoint
    RP738: 12/13/2010 8:41:31 PM - System Checkpoint
    RP739: 12/14/2010 9:28:45 PM - System Checkpoint
    RP740: 12/15/2010 11:55:59 AM - Software Distribution Service 3.0
    RP741: 12/15/2010 12:46:53 PM - Software Distribution Service 3.0
    RP742: 12/16/2010 5:43:18 PM - System Checkpoint
    RP743: 12/18/2010 2:58:53 PM - System Checkpoint
    RP744: 12/20/2010 12:05:09 AM - System Checkpoint
    RP745: 12/21/2010 12:19:57 AM - System Checkpoint
    RP746: 12/22/2010 12:23:17 AM - System Checkpoint
    RP747: 12/23/2010 12:25:03 AM - System Checkpoint
    RP748: 12/24/2010 12:26:36 AM - System Checkpoint
    RP749: 12/25/2010 12:57:41 AM - System Checkpoint
    RP750: 12/26/2010 2:48:35 PM - System Checkpoint
    RP751: 12/27/2010 11:03:27 PM - System Checkpoint
    RP752: 12/28/2010 11:31:43 PM - System Checkpoint
    RP753: 12/30/2010 6:47:51 PM - System Checkpoint
    RP754: 12/31/2010 7:42:22 PM - System Checkpoint
    RP755: 1/1/2011 8:21:16 PM - System Checkpoint
    RP756: 1/2/2011 8:24:55 PM - System Checkpoint
    RP757: 1/3/2011 9:52:17 PM - System Checkpoint
    RP758: 1/5/2011 12:34:44 AM - System Checkpoint
    RP759: 1/6/2011 11:52:00 AM - System Checkpoint
    RP760: 1/7/2011 7:24:18 PM - System Checkpoint
    RP761: 1/8/2011 8:31:03 PM - System Checkpoint
    RP762: 1/9/2011 9:22:41 PM - System Checkpoint
    RP763: 1/10/2011 10:47:58 PM - System Checkpoint
    RP764: 1/11/2011 11:12:16 PM - System Checkpoint
    RP765: 1/12/2011 3:00:30 AM - Software Distribution Service 3.0
    RP766: 1/13/2011 3:59:54 AM - System Checkpoint
    RP767: 1/14/2011 4:06:33 AM - System Checkpoint
    RP768: 1/16/2011 1:48:03 PM - System Checkpoint
    RP769: 1/17/2011 5:33:54 PM - System Checkpoint
    RP770: 1/19/2011 5:26:14 PM - System Checkpoint
    RP771: 1/20/2011 5:53:34 PM - System Checkpoint
    RP772: 1/21/2011 6:15:37 PM - System Checkpoint
    RP773: 1/22/2011 7:15:36 PM - System Checkpoint
    RP774: 1/23/2011 7:40:12 PM - System Checkpoint
    RP775: 1/24/2011 7:58:36 PM - System Checkpoint
    RP776: 1/26/2011 12:15:05 AM - System Checkpoint
    RP777: 1/27/2011 11:24:31 AM - System Checkpoint
    RP778: 1/28/2011 5:16:43 PM - System Checkpoint
    RP779: 1/29/2011 8:19:09 PM - System Checkpoint
    RP780: 1/30/2011 8:30:46 PM - System Checkpoint
    RP781: 2/9/2011 11:40:24 PM - System Checkpoint
    RP782: 2/10/2011 8:31:11 PM - Software Distribution Service 3.0

    ==== Installed Programs ======================

    2007 Microsoft Office system
    aaa
    Activation Assistant for the 2007 Microsoft Office suites
    Adobe Flash Player ActiveX
    Adobe Flash Player Plugin
    Adobe Shockwave Player
    ArcGIS Desktop
    avast! Antivirus
    Avira AntiVir Personal - Free Antivirus
    Bison WebCam
    Bison WebCam Ap
    ESPN Java Check
    High Definition Audio Driver Package - KB888111
    Hotfix for Windows XP (KB935448)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    Intel(R) Graphics Media Accelerator Driver
    Java(TM) 6 Update 7
    Malwarebytes' Anti-Malware
    Marvell Miniport Driver
    Microsoft Age of Empires II
    Microsoft Age of Empires II: The Conquerors Expansion
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Professional Hybrid 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Software Update for Web Folders (English) 12
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Motorola SM56 Data Fax Modem
    Move Media Player
    Mozilla Firefox (3.5.16)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Nero 7 Essentials
    NHL® 08
    Oblivion
    Power Manager 2.4.3
    PowerDVD
    Python 2.4.1
    RealPlayer
    Realtek High Definition Audio Driver
    RealUpgrade 1.0
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2289158)
    Security Update for 2007 Microsoft Office System (KB2344875)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB2345035)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office PowerPoint 2007 (KB982158)
    Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
    Security Update for Microsoft Office Publisher 2007 (KB2284697)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player (KB979402)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB936782)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB890046)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921503)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB938127)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB938829)
    Security Update for Windows XP (KB939653)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941568)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941644)
    Security Update for Windows XP (KB941693)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944338)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB945553)
    Security Update for Windows XP (KB946026)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB947864)
    Security Update for Windows XP (KB948590)
    Security Update for Windows XP (KB948881)
    Security Update for Windows XP (KB950749)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958470)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969897)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972260)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974455)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB976325)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB981350)
    Security Update for Windows XP (KB982381)
    Synaptics Pointing Device Driver
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft Office Outlook 2007 (KB2412171)
    Update for Outlook 2007 Junk Email Filter (KB2492475)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB908531)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB911164)
    Update for Windows XP (KB911280)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB933360)
    Update for Windows XP (KB936357)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update for Windows XP (KB976749)
    Update for Windows XP (KB978207)
    Update for Windows XP (KB980182)
    WebFldrs XP
    Windows Installer 3.1 (KB893803)
    Windows Media Format Runtime
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB891781
    World Championship Poker 2

    ==== Event Viewer Messages From Past Week ========

    2/9/2011 1:02:15 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
    2/9/2011 1:02:15 PM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\CMT\LOCALS~1\Temp\RarSFX0\redist.dll. Reference error message: The operation completed successfully. .
    2/9/2011 1:02:15 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
    2/10/2011 9:36:01 PM, error: Service Control Manager [7034] - The Cyberlink RichVideo Service(CRVS) service terminated unexpectedly. It has done this 1 time(s).
    2/10/2011 9:36:00 PM, error: Service Control Manager [7034] - The avast! iAVS4 Control Service service terminated unexpectedly. It has done this 1 time(s).
    2/10/2011 6:12:28 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    2/10/2011 6:12:04 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD aswTdi Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip WINIO
    2/10/2011 6:12:04 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
    2/10/2011 6:12:04 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    2/10/2011 6:12:04 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    2/10/2011 6:12:04 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    2/10/2011 6:11:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    2/10/2011 6:11:31 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    2/10/2011 12:06:24 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.
    2/10/2011 12:06:24 AM, error: Service Control Manager [7000] - The avast! Antivirus service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

    ==== End Of File ===========================


    Again, thanks for bearing with me.
     
  9. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Okay, let's get you down to only one antivirus and make it current. Right now you show these:
    avast! Antivirus
    Avira AntiVir Personal - Free Antivirus

    And both show Outdated in the DDS Header.
    Please decide which one of these programs you want to keep> Avast or Avira and uninstall the other. Multiple antivirus programs make a system more vulnerable, not less. It can also slow a system down.
    Here are Tools to help remove the program you're not going to keep:
    Avast Removal
    To uninstall Avira:
    • Start> Settings> Control Panel> Add or Remove Programs (Windows 2000/ XP) or Start - Control Panel - Uninstall a program (Windows Vista / 7)
    • Wait for the list of installed programs to load, then click the name of the Avira program.
    • Click Remove next to the program's name (Windows 2000 / XP) or in the menu above the list (Windows Vista / 7).
    • Press Yes, to confirm the removal and then OK.
    • . Click Next until Finish. The software is removed.
    Handle this and reboot the computer when through.
    =================================
    The malware is still on the system. Please run the following:

    Run Eset NOD32 Online AntiVirus scan HERE
    1. Tick the box next to YES, I accept the Terms of Use.
    2. Click Start
    3. When asked, allow the Active X control to install
    4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    5. Click Start
    6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    7. Click Scan
    8. Wait for the scan to finish
    9. Re-enable your Antivirus software.
    10. A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.
    ==============================
    Download Combofix to your desktop from one of these locations:
    Link 1
    Link 2
    • Double click combofix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Query- Recovery Console image
      [​IMG]
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes it will open a text window. Please paste that log in your next reply.
    Notes:
    1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

    You can go ahead and delete all the Malwarebytes logs.
     
  10. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    I used the link to remove Avast. Not sure why Avira shows up as outdated as I just downloaded it a few days ago. How would I make it current?

    Here are the new logs:

    ESETSmartInstaller@High as downloader log:
    Can not open internetESETSmartInstaller@High as downloader log:
    Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
    Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
    Can not open internet# version=7
    # OnlineScannerApp.exe=1.0.0.1
    # OnlineScanner.ocx=1.0.0.6419
    # api_version=3.0.2
    # EOSSerial=1dac756e38613f40b7cd2edc0d43ae1b
    # end=finished
    # remove_checked=false
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=false
    # antistealth_checked=true
    # utc_time=2011-02-12 08:41:33
    # local_time=2011-02-12 12:41:33 (-0800, Pacific Standard Time)
    # country="United States"
    # lang=1033
    # osver=5.1.2600 NT Service Pack 2
    # compatibility_mode=768 16777215 100 0 0 0 0 0
    # compatibility_mode=1797 16774121 100 93 0 33959384 0 0
    # compatibility_mode=8192 67108863 100 0 0 0 0 0
    # scanned=58692
    # found=0
    # cleaned=0
    # scan_time=1660

    --------------------

    ComboFix 11-02-12.01 - CMT 02/12/2011 13:20:24.1.2 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.539 [GMT -8:00]
    Running from: c:\documents and settings\CMT\My Documents\Downloads\ComboFix.exe
    AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\CMT\Recent\stunners.pif
    c:\windows\system\BisonCam.dll

    .
    ((((((((((((((((((((((((( Files Created from 2011-01-12 to 2011-02-12 )))))))))))))))))))))))))))))))
    .

    2011-02-12 19:56 . 2011-02-12 19:56 -------- d-----w- c:\program files\ESET
    2011-02-11 04:44 . 2011-02-11 05:25 -------- d-----w- c:\windows\system32\NtmsData
    2011-02-11 04:43 . 2011-02-11 04:43 -------- d-----w- c:\documents and settings\CMT\Application Data\Avira
    2011-02-11 04:40 . 2011-01-10 22:23 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-02-11 04:40 . 2011-01-10 22:23 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2011-02-11 04:40 . 2010-06-17 22:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
    2011-02-11 04:40 . 2010-06-17 22:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
    2011-02-11 04:40 . 2011-02-11 04:40 -------- d-----w- c:\program files\Avira
    2011-02-11 04:40 . 2011-02-11 04:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
    2011-02-01 08:13 . 2011-02-01 08:13 -------- d-----w- c:\documents and settings\CMT\Application Data\Malwarebytes
    2011-02-01 08:12 . 2011-02-01 08:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-02-01 08:12 . 2010-12-21 02:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-01 08:12 . 2011-02-01 08:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-02-01 08:12 . 2010-12-21 02:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
    "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-23 630784]
    "BisonHK"="c:\windows\BisonCam\BisonHK.exe" [2007-08-07 65536]
    "PowerManager"="c:\program files\Power Manager\PM.exe" [2007-09-13 31744]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-10 839680]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-10 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-10 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-10 137752]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
    "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-06 54832]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-13 155648]
    "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-31 202256]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"=

    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/10/2011 8:40 PM 135336]
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-4154816913-2211111127-2111535249-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]

    2011-02-10 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-4154816913-2211111127-2111535249-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = <local>
    uInternet Settings,ProxyServer = http=127.0.0.1:18810
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    FF - ProfilePath - c:\documents and settings\CMT\Application Data\Mozilla\Firefox\Profiles\diz83s0c.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\CMT\Application Data\Move Networks
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-RegistryBooster - c:\program files\Uniblue\RegistryBooster\launcher.exe
    HKLM-Run-NWEReboot - (no file)



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-12 13:23
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2011-02-12 13:25:04
    ComboFix-quarantined-files.txt 2011-02-12 21:25

    Pre-Run: 70,825,566,208 bytes free
    Post-Run: 70,787,743,744 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    - - End Of File - - 4887D63783594280A1FA29D48AAF55D8
     
  11. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Whenever you download and install a new antivirus program, the first thing you should do is update the program. This can usually be done using a right click on the AV icon in the Notification Area> Update.

    Does your ISP require you to use this port? uInternet Settings,ProxyServer = http=127.0.0.1:18810
    [And then override it? uInternet Settings,ProxyOverride = <local>
    Mbam found malware (PUM.Bad.Proxy) -> Value: ProxyServer which is why we need to veryfy the proxy settings.
    =================================
    There is malware, usually named Trojan.FakeAlert that puts p[ alerts of a problem, usually making if sound 'critical.' The ides is a scare tactic so you will click on the popups which then takes you to a site to pay money for the removal. I did not see this in the logs. But I saw Trojan.Downloader in Mbam, not Trojan.Fake Alert. Eset is clean, GMER is clean.
    =================================
    I notice that Combofix removed the file:
    c:\windows\system\BisonCam.dll
    but that you have the driver for the BisonCam loading from the Registry as
    "BisonHK"="c:\windows\BisonCam\BisonHK.exe" [2007-08-07 65536]
    and you have the following programs installed:
    Bison WebCam
    Bison WebCam Ap

    You make want to check that program out> see if it needs a firmware update.
    =================================
    And it's unusual that the only Service showing is one for Avira Have you disabled any Services or Drivers? Are you still having a problem? Are you still having a problem with the popups. I would appreciate it if you could give me any error message you get, comletely and correctly.
    ==================================
    Download HijackThis and save to your desktop.
    • Extract it to a directory on your hard drive called c:\HijackThis.
    • Then navigate to that directory and double-click on the hijackthis.exe file.
    • When started click on the Scan button and then the Save Log button to create a log of your information.
    • The log file and then the log will open in notepad. Be sure to click on Format> Uncheck Word Wrap when you open Notepad
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and paste (Ctrl+V) the log in your next reply.

    NOTE: Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
     
  12. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    First:

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 11:27:43 AM, on 2/14/2011
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\WINDOWS\BisonCam\BisonHK.exe
    C:\Program Files\Power Manager\PM.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    C:\Documents and Settings\CMT\My Documents\Downloads\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:18810
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [BisonHK] C:\WINDOWS\BisonCam\BisonHK.exe
    O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

    --
    End of file - 5247 bytes


    I updated Avira.

    I have to admit I don't know anything about proxy settings. What do I need to do to verify them?

    Bison Cam is something I don't use. The laptop has a cam built into the lid but I never use it. There was software included when I bought the computer but I don't really know what's supposed to be there and what's not.

    I haven't disabled any services or drivers to the best of my knowledge, although I'm not sure what all would be included in those categories. Have had no popups and no visible signs of malware since running Temporary File Cleaner.

    When the popups did occur, they read "Application cannot be executed. The file ####.exe is infected. Do you want to activate your antivirus software now?" In some cases the phrase "application cannot be executed" was replaced by "Virus Alert! Application can't be started!"

    Sorry my tech knowhow is so limited! Thanks for all of your clear instructions and for your patience.
     
  13. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    New Development

    A new popup began appearing about an hour and a half ago. Unfortunately I didn't jot down exactly what it said. This one looked slightly different (not like an official Microsoft window - it had some kind of red border) but it was similar in purpose to the previous ones (i.e. Security Alert, you need to start your scan now, the popup kept recurring no matter how many times I clicked Close, and it prevented any program from opening.)
    I tried to do Mbam first thing; it would start and then disappear. I then tried TFC instead. It ran, and the computer rebooted. I ran an Avira scan which found nothing and then was able to run Mbam which found 7 infected files:

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5722

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    2/15/2011 10:35:00 PM
    mbam-log-2011-02-15 (22-35-00).txt

    Scan type: Quick scan
    Objects scanned: 151419
    Time elapsed: 3 minute(s), 54 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 0
    Registry Keys Infected: 3
    Registry Values Infected: 2
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    c:\documents and settings\CMT\application data\Adobe\plugs\kb6249750.exe (Trojan.Agent) -> 1904 -> Unloaded process successfully.

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe (Security.Hijack) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe (Security.Hijack) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe (Security.Hijack) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger (Security.Hijack) -> Value: Debugger -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\Debugger (Security.Hijack) -> Value: Debugger -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\documents and settings\CMT\application data\Adobe\plugs\kb6249750.exe (Trojan.Agent) -> Quarantined and deleted successfully.

    -------
    Popups haven't reappeared since one immediately after TFC scan & reboot (before Avira scan).

    Should I do Gmer and DDS again?

    Thanks! you have helped so much already and I feel bad that I keep having to ask for more help!
     
  14. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    So there is still a peep hole where the malware is getting in! You don't have to go through all of the scans, but I think it's best to run the Eset online virus scan and Combofix again. I may have missed something.

    Directions for both are in Reply #7.

    It sounds like some of the malware was still in the temporary internet files, so it was removed by TFC in those files. But since Mbam showed malware again, I need to see what the location is and if it's new malware. You got a computer with data someone else left on it, so it's important that you learn how to get around the computer so anything you don't need/ want can be removed.
     
  15. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    Ok, here are new Eset and Combofix logs:

    ESETSmartInstaller@High as downloader log:
    all ok
    # version=7
    # OnlineScannerApp.exe=1.0.0.1
    # OnlineScanner.ocx=1.0.0.6419
    # api_version=3.0.2
    # EOSSerial=1dac756e38613f40b7cd2edc0d43ae1b
    # end=finished
    # remove_checked=false
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=true
    # antistealth_checked=true
    # utc_time=2011-02-22 08:12:07
    # local_time=2011-02-22 12:12:07 (-0800, Pacific Standard Time)
    # country="United States"
    # lang=1033
    # osver=5.1.2600 NT Service Pack 2
    # compatibility_mode=512 16777215 100 0 0 0 0 0
    # compatibility_mode=768 16777215 100 0 780894 780894 0 0
    # compatibility_mode=1797 16775141 100 93 0 34821432 0 0
    # compatibility_mode=8192 67108863 100 0 780314 780314 0 0
    # scanned=67880
    # found=0
    # cleaned=0
    # scan_time=1846

    -------

    ComboFix 11-02-22.01 - CMT 02/22/2011 12:19:50.2.2 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.596 [GMT -8:00]
    Running from: c:\documents and settings\CMT\My Documents\Downloads\ComboFix.exe
    AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\CMT\Application Data\Adobe\plugs

    .
    ((((((((((((((((((((((((( Files Created from 2011-01-22 to 2011-02-22 )))))))))))))))))))))))))))))))
    .

    2011-02-18 02:49 . 2011-02-18 02:49 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-02-18 02:49 . 2011-02-18 02:48 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-02-12 19:56 . 2011-02-12 19:56 -------- d-----w- c:\program files\ESET
    2011-02-11 04:44 . 2011-02-16 06:27 -------- d-----w- c:\windows\system32\NtmsData
    2011-02-11 04:43 . 2011-02-11 04:43 -------- d-----w- c:\documents and settings\CMT\Application Data\Avira
    2011-02-11 04:40 . 2011-01-10 22:23 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-02-11 04:40 . 2011-01-10 22:23 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2011-02-11 04:40 . 2010-06-17 22:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
    2011-02-11 04:40 . 2010-06-17 22:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
    2011-02-11 04:40 . 2011-02-11 04:40 -------- d-----w- c:\program files\Avira
    2011-02-11 04:40 . 2011-02-11 04:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
    2011-02-01 08:13 . 2011-02-01 08:13 -------- d-----w- c:\documents and settings\CMT\Application Data\Malwarebytes
    2011-02-01 08:12 . 2011-02-01 08:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-02-01 08:12 . 2010-12-21 02:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-01 08:12 . 2011-02-01 08:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-02-01 08:12 . 2010-12-21 02:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-02-18 02:48 . 2008-08-29 23:55 73728 ----a-w- c:\windows\system32\javacpl.cpl
    .

    ((((((((((((((((((((((((((((( SnapShot@2011-02-12_21.23.10 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2011-02-22 19:31 . 2011-02-22 19:31 16384 c:\windows\temp\Perflib_Perfdata_5e0.dat
    + 2011-02-18 02:49 . 2011-02-18 02:48 153376 c:\windows\system32\javaws.exe
    + 2011-02-18 02:49 . 2011-02-18 02:48 145184 c:\windows\system32\javaw.exe
    + 2011-02-18 02:49 . 2011-02-18 02:48 145184 c:\windows\system32\java.exe
    + 2011-02-18 02:49 . 2011-02-18 02:49 180224 c:\windows\Installer\30665d.msi
    + 2011-02-18 02:48 . 2011-02-18 02:48 676352 c:\windows\Installer\306658.msi
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
    "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-23 630784]
    "BisonHK"="c:\windows\BisonCam\BisonHK.exe" [2007-08-07 65536]
    "PowerManager"="c:\program files\Power Manager\PM.exe" [2007-09-13 31744]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-10 839680]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-10 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-10 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-10 137752]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
    "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-06 54832]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-13 155648]
    "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-31 202256]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"=

    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/10/2011 8:40 PM 135336]
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-22 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-4154816913-2211111127-2111535249-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]

    2011-02-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-4154816913-2211111127-2111535249-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = <local>
    uInternet Settings,ProxyServer = http=127.0.0.1:18810
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    FF - ProfilePath - c:\documents and settings\CMT\Application Data\Mozilla\Firefox\Profiles\diz83s0c.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\CMT\Application Data\Move Networks
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-22 12:23
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2011-02-22 12:25:07
    ComboFix-quarantined-files.txt 2011-02-22 20:25
    ComboFix2.txt 2011-02-12 21:25

    Pre-Run: 70,752,120,832 bytes free
    Post-Run: 70,934,429,696 bytes free

    - - End Of File - - 6D376406449396BD7AF1809496804B8C
     
  16. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Have you added anything to the system since the last Mbam which was clean? A download? An update? Program or App?

    Malware used what is called Image File Execution (IFEO) to block the executables of the Eset scan and Windows Defender. This shows in the Registry entries it found and removed.

    What is IFEO?
    IFEO is an area of the registry that tells Windows what to do when a given application is run on your system.Malware is modifying the IFEO key so that when you attempt to run them, they either do not run at all, or actually launch another copy of the virus executable itself! A simple reboot after adding the malware to IFEO may give you to opportunity to delete it and finish your cleaning process.the problem is that Windows does not verify that the application that you tell it to run instead of the program is actually a legitimate debugger or not.
    ======================================
    I'd like to see if this program can find the malware opening:
    Download Dr.Web CureIt! and save it to your desktop.

    • [1] Double click to Run the utility and press the "Start" button in the opened window.
      [2] Confirm the launch by pressing the "OK" button and wait for the scanning results of the main memory and startup files. (this is express scan)
      [3] Click on the Green Arrow to the right to Select the Complete scan
      [4] When being scanned, infected files are cured, incurable files are moved to the quarantine directory.Answer Yes if asked to move or cure a file.
      [5] When the scanning is finished, save the report to your desktop: it is named DrWeb.csv.
    Close the program.
    Reboot the computer: this is important to complete the moves or deletions.
    Copy the DrWeb.cvs report to Notepad, then paste it in your next reply.
     
  17. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    I haven't added any program or apps. I did update both Avira and Java - was that a mistake?

    DrWeb Cureit found some stuff, here are the results:

    OTS.exe;C:\Documents and Settings\CMT\My Documents\Downloads;Trojan.Siggen2.17135;Incurable.Moved.;
    mcf.dll;C:\Program Files\ArcGIS\Data Interoperability Extension;Trojan.Fraudster.166;Deleted.;
    ntf.dll;C:\Program Files\ArcGIS\Data Interoperability Extension;Trojan.Fraudster.167;Deleted.;
    tiger.dll;C:\Program Files\ArcGIS\Data Interoperability Extension;Trojan.Fraudster.170;Deleted.;
    CRC_func.dll;C:\Program Files\ArcGIS\Data Interoperability Extension\plugins;Trojan.Fraudster.168;Deleted.;
    A0075564.dll;C:\System Volume Information\_restore{200F293E-8068-47F2-B82D-0FEC17049D1D}\RP785;Trojan.Fraudster.166;Deleted.;
    A0075565.dll;C:\System Volume Information\_restore{200F293E-8068-47F2-B82D-0FEC17049D1D}\RP785;Trojan.Fraudster.167;Deleted.;
    A0075566.dll;C:\System Volume Information\_restore{200F293E-8068-47F2-B82D-0FEC17049D1D}\RP785;Trojan.Fraudster.170;Deleted.;
    A0075567.dll;C:\System Volume Information\_restore{200F293E-8068-47F2-B82D-0FEC17049D1D}\RP785;Trojan.Fraudster.168;Deleted.;

    The first 1 was found during express scan, and the other 8 were found during complete scan.
    IIRC, I downloaded OTS after the malware first appeared but before I found the help of this forum. I stopped short of actually installing it.
    ArcGIS is a cartography program I used for a class a few years ago, but haven't used since.

    Thanks again for all the time you are taking to assist me.
     
  18. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
    Code:
    File::
    
    Extra::
    File::
    c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    Firefox::
    Firefox-:-Profile- c:\documents and settings\CMT\Application Data\Mozilla\Firefox\Profiles\diz83s0c.default\
    DDS::
    uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
    uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=pavilion&pf=laptop
    uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BisonHK"=-
    
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
    =========================================
    Please uninstall this program in Add/Remove Programs in the Control Panel.
    Then Right click on Start> Explore> My Computer> Double click on Local Drive (C)> Programs> find AreGIS program folder> do a Right Click> Delete on the folder.
    Exit Windows explorer.
    =====================================
    Most of the entries in Dr. Web are for System Volume> these are the restore points. I will have you drop them at the emd of cleaning, Malware in the restore points can only ireinfect the system if you do a System Restore and happen to choose that particular restore point.
    ====================================
    Dr. Web has it's own unique names for some malware. Please run the Eset scan again to see if it picks something up.
    =====================================
    Have you noticed any improvement in the system?
     
  19. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    Ok, here is the log from that custom CF Script:

    ComboFix 11-02-25.02 - CMT 02/26/2011 16:12:45.3.2 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.638 [GMT -8:00]
    Running from: c:\documents and settings\CMT\My Documents\Downloads\ComboFix.exe
    Command switches used :: c:\documents and settings\CMT\My Documents\Downloads\CFScript.txt
    AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
    * Created a new restore point

    FILE ::
    "c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}"
    "c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}"
    .

    ((((((((((((((((((((((((( Files Created from 2011-01-27 to 2011-02-27 )))))))))))))))))))))))))))))))
    .

    2011-02-24 22:11 . 2011-02-24 22:30 -------- d-----w- c:\documents and settings\CMT\DoctorWeb
    2011-02-18 02:49 . 2011-02-18 02:49 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-02-18 02:49 . 2011-02-18 02:48 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-02-12 19:56 . 2011-02-12 19:56 -------- d-----w- c:\program files\ESET
    2011-02-11 04:44 . 2011-02-16 06:27 -------- d-----w- c:\windows\system32\NtmsData
    2011-02-11 04:43 . 2011-02-11 04:43 -------- d-----w- c:\documents and settings\CMT\Application Data\Avira
    2011-02-11 04:40 . 2011-01-10 22:23 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-02-11 04:40 . 2011-01-10 22:23 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2011-02-11 04:40 . 2010-06-17 22:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
    2011-02-11 04:40 . 2010-06-17 22:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
    2011-02-11 04:40 . 2011-02-11 04:40 -------- d-----w- c:\program files\Avira
    2011-02-11 04:40 . 2011-02-11 04:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
    2011-02-01 08:13 . 2011-02-01 08:13 -------- d-----w- c:\documents and settings\CMT\Application Data\Malwarebytes
    2011-02-01 08:12 . 2011-02-01 08:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-02-01 08:12 . 2010-12-21 02:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-02-01 08:12 . 2011-02-01 08:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-02-01 08:12 . 2010-12-21 02:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-02-18 02:48 . 2008-08-29 23:55 73728 ----a-w- c:\windows\system32\javacpl.cpl
    .

    ((((((((((((((((((((((((((((( SnapShot@2011-02-12_21.23.10 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2011-02-26 23:50 . 2011-02-26 23:50 16384 c:\windows\temp\Perflib_Perfdata_5e0.dat
    + 2011-02-18 02:49 . 2011-02-18 02:48 153376 c:\windows\system32\javaws.exe
    + 2011-02-18 02:49 . 2011-02-18 02:48 145184 c:\windows\system32\javaw.exe
    + 2011-02-18 02:49 . 2011-02-18 02:48 145184 c:\windows\system32\java.exe
    + 2011-02-18 02:49 . 2011-02-18 02:49 180224 c:\windows\Installer\30665d.msi
    + 2011-02-18 02:48 . 2011-02-18 02:48 676352 c:\windows\Installer\306658.msi
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
    "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-23 630784]
    "PowerManager"="c:\program files\Power Manager\PM.exe" [2007-09-13 31744]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-10 839680]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-10 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-10 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-10 137752]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
    "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-06 54832]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-13 155648]
    "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-31 202256]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"=

    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/10/2011 8:40 PM 135336]
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-4154816913-2211111127-2111535249-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]

    2011-02-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-4154816913-2211111127-2111535249-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = <local>
    uInternet Settings,ProxyServer = http=127.0.0.1:18810
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    FF - ProfilePath - c:\documents and settings\CMT\Application Data\Mozilla\Firefox\Profiles\diz83s0c.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\CMT\Application Data\Move Networks
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-26 16:16
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2011-02-26 16:18:32
    ComboFix-quarantined-files.txt 2011-02-27 00:18
    ComboFix2.txt 2011-02-22 20:25
    ComboFix3.txt 2011-02-12 21:25

    Pre-Run: 70,901,907,456 bytes free
    Post-Run: 70,936,440,832 bytes free

    - - End Of File - - 3E9940FF929D834EC230643064434FCB
    =========================================
    Removed ArcGIS, using Add/Remove Programs. Upon attempting to delete the folder, it was already gone.
    =============================
    Here is a new Eset Log:
    ESETSmartInstaller@High as downloader log:
    all ok
    # version=7
    # OnlineScannerApp.exe=1.0.0.1
    # OnlineScanner.ocx=1.0.0.6425
    # api_version=3.0.2
    # EOSSerial=1dac756e38613f40b7cd2edc0d43ae1b
    # end=finished
    # remove_checked=false
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=true
    # antistealth_checked=true
    # utc_time=2011-02-27 01:14:40
    # local_time=2011-02-26 05:14:40 (-0800, Pacific Standard Time)
    # country="United States"
    # lang=1033
    # osver=5.1.2600 NT Service Pack 2
    # compatibility_mode=512 16777215 100 0 0 0 0 0
    # compatibility_mode=768 16777215 100 0 1144805 1144805 0 0
    # compatibility_mode=1797 16775145 100 93 0 35185343 474418 0
    # compatibility_mode=8192 67108863 100 0 1144225 1144225 0 0
    # scanned=58242
    # found=0
    # cleaned=0
    # scan_time=1688
    =============================
    Re: Improvement in the system......... No visible signs of malware since post #13 of this thread, on 2/15/11....... (although of course the DrWeb Cure It scan indicated otherwise) but I want to heed your warning i.e. just because I don't see the malware, doesn't necessarily mean it's gone. I want to make sure. That said, system has behaved with no noticeable problems since then.
    Will await further instructions.
     
  20. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap> and copy/paste the text in the code below into it:
    Code:
    File::
    Folder::
    c:\documents and settings\CMT\DoctorWeb
    Extra::
    File::
    c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    Firefox::
    Firefox-: -Profile- c:\documents and settings\CMT\Application Data\Mozilla\Firefox\Profiles\diz83s0c.default\
    DDS:
    uInternet Settings,ProxyServer = http=127.0.0.1:18810
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste into to your next reply.
    ====================
    Please update Java: Java Updates Current is v6u24. Uninstall any earlier versions in Add/Remove Programs as they are vulnerabilities for the system.
    Note: It is recommended that you do not copy Java plugins from other locations to the Firefox plugins folder. Outdated Java plugins can cause Java not to work if you update Java and then uninstall the older Java version, if plugins from the old Java version are still in the Firefox plugins folder.
    ====================
    Last scan to make sure no bad entries remain, then I'll have you remove the cleaning tools.
    Download HijackThis and save to your desktop.
    • Extract it to a directory on your hard drive called c:\HijackThis.
    • Then navigate to that directory and double-click on the hijackthis.exe file.
    • When started click on the Scan button and then the Save Log button to create a log of your information.
    • The log file and then the log will open in notepad. Be sure to click on Format> Uncheck Word Wrap when you open Notepad
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and paste (Ctrl+V) the log in your next reply.

    NOTE: Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
     
  21. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    Here are the latest logs. Uninstalled old versions of Java in Add/Remove Programs, installed v6u24. Wasn't sure what to look for in the plugins folder though.

    ComboFix 11-03-04.02 - CMT 03/04/2011 12:25:12.4.2 - x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1014.639 [GMT -8:00]
    Running from: c:\documents and settings\CMT\My Documents\Downloads\ComboFix.exe
    Command switches used :: c:\documents and settings\CMT\My Documents\Downloads\CFScript.txt
    AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
    .
    FILE ::
    "c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}"
    "c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}"
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\CMT\DoctorWeb
    c:\documents and settings\CMT\DoctorWeb\CureIt.log
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-02-04 to 2011-03-04 )))))))))))))))))))))))))))))))
    .
    .
    2011-02-18 02:49 . 2011-02-18 02:49 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-02-18 02:49 . 2011-02-18 02:48 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-02-12 19:56 . 2011-02-12 19:56 -------- d-----w- c:\program files\ESET
    2011-02-11 04:44 . 2011-02-16 06:27 -------- d-----w- c:\windows\system32\NtmsData
    2011-02-11 04:43 . 2011-02-11 04:43 -------- d-----w- c:\documents and settings\CMT\Application Data\Avira
    2011-02-11 04:40 . 2011-01-10 22:23 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-02-11 04:40 . 2011-01-10 22:23 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2011-02-11 04:40 . 2010-06-17 22:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
    2011-02-11 04:40 . 2010-06-17 22:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
    2011-02-11 04:40 . 2011-02-11 04:40 -------- d-----w- c:\program files\Avira
    2011-02-11 04:40 . 2011-02-11 04:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-02-18 02:48 . 2008-08-29 23:55 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-12-21 02:09 . 2011-02-01 08:12 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-21 02:08 . 2011-02-01 08:12 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2011-02-12_21.23.10 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2011-03-04 20:11 . 2011-03-04 20:11 16384 c:\windows\temp\Perflib_Perfdata_5dc.dat
    + 2007-11-12 20:01 . 2011-02-27 03:14 35088 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\oisicon.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 35088 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\oisicon.exe
    + 2007-11-12 20:01 . 2011-02-27 03:14 18704 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\mspicons.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 18704 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\mspicons.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 20240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\cagicon.exe
    + 2007-11-12 20:01 . 2011-02-27 03:14 20240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\cagicon.exe
    + 2011-02-18 02:49 . 2011-02-18 02:48 153376 c:\windows\system32\javaws.exe
    + 2011-02-18 02:49 . 2011-02-18 02:48 145184 c:\windows\system32\javaw.exe
    + 2011-02-18 02:49 . 2011-02-18 02:48 145184 c:\windows\system32\java.exe
    + 2011-02-18 02:49 . 2011-02-18 02:49 180224 c:\windows\Installer\30665d.msi
    + 2011-02-18 02:48 . 2011-02-18 02:48 676352 c:\windows\Installer\306658.msi
    + 2007-11-12 20:01 . 2011-02-27 03:14 888080 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\wordicon.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 888080 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\wordicon.exe
    + 2007-11-12 20:01 . 2011-02-27 03:14 272648 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pubs.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 272648 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pubs.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 922384 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pptico.exe
    + 2007-11-12 20:01 . 2011-02-27 03:14 922384 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pptico.exe
    + 2007-11-12 20:01 . 2011-02-27 03:14 845584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\outicon.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 845584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\outicon.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 217864 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\misc.exe
    + 2007-11-12 20:01 . 2011-02-27 03:14 217864 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\misc.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 1172240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\xlicons.exe
    + 2007-11-12 20:01 . 2011-02-27 03:14 1172240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\xlicons.exe
    - 2007-11-12 20:01 . 2011-02-11 04:31 1165584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\accicons.exe
    + 2007-11-12 20:01 . 2011-02-27 03:14 1165584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\accicons.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416]
    "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-23 630784]
    "PowerManager"="c:\program files\Power Manager\PM.exe" [2007-09-13 31744]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-10 839680]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-10 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-10 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-10 137752]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
    "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-06 54832]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-13 155648]
    "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-31 202256]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"=
    .
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2/10/2011 8:40 PM 135336]
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-03-04 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-4154816913-2211111127-2111535249-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
    .
    2011-03-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-4154816913-2211111127-2111535249-1006.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 05:09]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = <local>
    uInternet Settings,ProxyServer = http=127.0.0.1:18810
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    FF - ProfilePath - c:\documents and settings\CMT\Application Data\Mozilla\Firefox\Profiles\diz83s0c.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\CMT\Application Data\Move Networks
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-03-04 12:28
    Windows 5.1.2600 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    Completion time: 2011-03-04 12:30:39
    ComboFix-quarantined-files.txt 2011-03-04 20:30
    ComboFix2.txt 2011-02-27 00:18
    ComboFix3.txt 2011-02-22 20:25
    ComboFix4.txt 2011-02-12 21:25
    .
    Pre-Run: 71,595,364,352 bytes free
    Post-Run: 71,810,674,688 bytes free
    .
    - - End Of File - - D66F78A049A8B1365CA01C9D1FAB226A


    ---------------------------------------

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 1:05:37 PM, on 3/4/2011
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Program Files\Power Manager\PM.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\CMT\My Documents\Downloads\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:18810
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

    --
    End of file - 5195 bytes


    ================================
    Just ran an MBAM scan and here were the results:

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5954

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    3/4/2011 1:43:04 PM
    mbam-log-2011-03-04 (13-43-04).txt

    Scan type: Quick scan
    Objects scanned: 145178
    Time elapsed: 3 minute(s), 39 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\g043oqxanu (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    Not sure what to make of that but I thought I would add it to the post.
     
  22. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Okay, this is related to my question about this:
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:18810

    Please do the following: Click on Control Panel> Internet Options> Connections tab> Click on LAN Settings button lower right>
    You will now be at the Local Area Network (LAN) settings screen as shown by the image below.
    [​IMG]
    Image courtesy bleeping computer.

    Under the Proxy Server section, please uncheck the checkbox labeled Use a proxy server for your LAN.
    Then press the OK button to close this screen. Then press the OK button to close the Internet Options screen. Now that you have disabled the proxy server you will be able to browse the web again with Internet Explorer.

    This is what was causing both these entries in Mbam:
    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\g043oqxanu (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    Registry Values Infected:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

    Reboot the computer and let me know how the system is. I suspected the port- which was why I asked about it. There are some ISPs that require a specific port be used. This isn't one of them
     
  23. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    When I navigated to that tab, the "Use a proxy server for your LAN" checkbox was already unchecked. Made sure to select OK and rebooted the computer though. System appears to be behaving normally.
     
  24. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Good! Sometimes it just takes a reboot to finish up.
    Please reopen HijackThis to 'do system scan only.' Check each of the following, if present:

    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:18810
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)


    Close all Windows except HijackThis and click on "Fix Checked."
    =================================================
    Removing all of the tools we used and the files and folders they created
    • Uninstall ComboFix and all Backups of the files it deleted
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [​IMG]
    • Download OTCleanIt by OldTimer and save it to your Desktop.
    • Double click OTCleanIt.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.

    Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.
    • You should now set a new Restore Point and remove the old restore points to prevent infection from any previous Restore Points.
    • Go to Start > All Programs > Accessories > System Tools
    • Click "System Restore".
    • Choose "Create a Restore Point" on the first screen then click "Next".
    • Give the Restore Point a name> click "Create".
    • Go back and follow the path to > System Tools.
      [*]Choose Disc Cleanup
      [*]Click "OK" to select the partition or drive you want.
      [*]Click the "More Options" Tab.
      [*]Click "Clean Up" in the System Restore section to remove all previous Restore Points except the newly created one.


    Empty the Recycle Bin

    A reminder on this:
    Platform: Windows XP SP2 (WinNT 5.01.2600) Now up to SP3, support soon to stop.
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Now up to IE8 and Beta v9
     
  25. vokoun

    vokoun TS Rookie Topic Starter Posts: 16

    Hi...... sorry it took me a couple days to respond, thanks for hanging in there with me. Followed these instructions and everything seemed to go ok.

    On HijackThis, of the entries you indicated, the only one that matched exactly was the one beginning with "O23 - Service: avast." Checked it and chose 'fix checked.'

    Uninstalled Combofix, ran OTClean It, created a new Restore point, Recycle bin was already empty.

    What specific actions should I take regarding the reminders at the end of your previous post?
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...