TechSpot

I have a user with the sirefef virus

Solved
By Mike in IT
Aug 30, 2012
  1. I have a user who has the sirefef virus. I have Forefront installed, it will catch it and remove it. But it comes back in a matter of minutes. I am running the scans you ask for in the preliminary removal steps and will post the logs as soon as I get them. This is on an XP laptop that I am remoted into using GoToAssist so I can't shut down the internet connections when running the scans, I hope this won't affect the scans too much. If it will I can get the user a temp and have this one sent back to me for cleaning. Just let me know.
     
  2. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Hello, and welcome to TechSpot.


    [​IMG] Please see here for the board rules and other FAQ.

    Please feel free to introduce yourself, after you follow the steps below to get started.

    Information
    • From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a malware removal helper.
    • Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
    • If you have already asked for help somewhere, please post the link to the topic you were helped.
    • We try our best to reply quickly, but for any reason we do not reply in two days, please reply to this topic with the word BUMP!
    • Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

    Please review the 5-Step removal instructions and post the logs back here for my review.

    Also, include this scan:

    Download AdwCleaner by Xplode onto your Desktop.
    • Double click on AdwCleaner.exe to run the tool.
    • Click on Search.
    • A logfile will automatically open after the scan has finished.
    • Please post the content of that logfile in your reply.
    • You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.
     
  3. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Hello. Are you still with us?

    Your thread has been marked as "Inactive" because of your lack of reply. Please let us know how your computer is running, or if you want to continue in this topic.

    Thanks.
     
  4. Mike in IT

    Mike in IT TS Rookie Topic Starter

    Sorry it took so long to get back to this thread. I've had some computer problems (other than the one mentioned here). I'm still working on getting the computer with the virus, it's in a different state. I'll post here again when I get it and have run all the tests.
     
  5. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Okie dokie.
     
  6. Mike in IT

    Mike in IT TS Rookie Topic Starter

    Sorry it took so long:

    Malwarebytes Anti-Malware 1.62.0.1300
    www.malwarebytes.org

    Database version: v2012.09.07.09

    Windows XP Service Pack 3 x86 NTFS
    Internet Explorer 7.0.5730.13
    mmcnair :: DMA-3161 [administrator]

    9/7/2012 11:21:36 AM
    mbam-log-2012-09-07 (11-21-36).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 371160
    Time elapsed: 7 minute(s), 36 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)
    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2012-09-07 13:12:07
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD1600AAJS-60WAA0 rev.58.01D58
    Running: n1yk8sxh.exe; Driver: c:\windows\temp\uwlyapog.sys
    ---- System - GMER 1.0.15 ----
    SSDT \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys ZwCreateSection [0xBA60C700]
    ---- Kernel code sections - GMER 1.0.15 ----
    .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB95D6380, 0x346307, 0xE8000020]
    ---- Devices - GMER 1.0.15 ----
    Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Roxio)
    ---- EOF - GMER 1.0.15 ----
    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 10.5.1
    Run by mmcnair at 13:42:15 on 2012-09-07
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2031.1124 [GMT -4:00]
    .
    AV: Microsoft Forefront Endpoint Protection *Enabled/Updated* {1F383481-F70E-4E7A-8B69-C4B4A23928E4}
    .
    ============== Running Processes ===============
    .
    C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe
    C:\Program Files\Citrix\GoToAssist Remote Support Customer\430\g2ax_service.exe
    C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
    C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\ProPatches\Scheduler\stSchedEx.exe
    C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSvcm.exe
    C:\WINDOWS\system32\CCM\CcmExec.exe
    C:\Program Files\Citrix\GoToAssist Remote Support Customer\430\g2ax_comm_customer.exe
    C:\Program Files\Citrix\GoToAssist Remote Support Customer\430\g2ax_system_customer.exe
    C:\Program Files\Citrix\GoToAssist Remote Support Customer\430\g2ax_user_customer.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Shoreline Communications\ShoreWare Client\STCLogin.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = https://www.dmacafe.com/
    uInternet Settings,ProxyOverride = <local>
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll
    BHO: Lync Browser Helper: {31d09ba0-12f5-4cce-be8a-2923e76605da} - c:\program files\microsoft lync\OCHelper.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
    BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll
    BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll
    BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
    mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray
    mRun: [SetRefresh] c:\program files\compaq\setrefresh\SetRefresh.exe
    mRun: [AAWTray] c:\program files\lavasoft\ad-aware 2007\AAWTray.exe
    mRun: [RoxioDragToDisc] "c:\program files\roxio\drag-to-disc\DrgToDsc.exe"
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [nwiz] nwiz.exe /install
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [<NO NAME>]
    mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 10.0\acrobat\Acrobat_sl.exe"
    mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 10.0\acrobat\Acrotray.exe"
    mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [Communicator] "c:\program files\microsoft lync\communicator.exe" /fromrunkey
    mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
    mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter4.exe
    dRunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"
    dRunOnce: [TSClientAXDisabler] cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"
    mPolicies-explorer: NoAutorun = 1 (0x1)
    mPolicies-system: disablecad = 1 (0x1)
    mPolicies-system: consentpromptbehavioradmin = 0 (0x0)
    mPolicies-system: consentpromptbehavioruser = 3 (0x3)
    mPolicies-system: enableuiadesktoptoggle = 0 (0x0)
    mPolicies-system: promptonsecuredesktop = 0 (0x0)
    mPolicies-system: MaxGPOScriptWait = 60 (0x3c)
    IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a}
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
    IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft lync\OCHelper.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
    DPF: {00134F72-5284-44F7-95A8-52A619F70751} - hxxp://dmatrend:8080/officescan/console/html/ClientInstall/WinNTChk.cab
    DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} - hxxp://dmatrend:8080/officescan/console/html/ClientInstall/setup.cab
    DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} - hxxp://dmatrend:8080/officescan/console/html/root/AtxEnc.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207759085531
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207759154421
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    TCP: DhcpNameServer = 10.1.2.217 10.1.2.215
    TCP: Interfaces\{EC87D345-94E4-401B-A58E-6EF0A80FAECF} : DhcpNameServer = 10.1.2.217 10.1.2.215
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
    Notify: GoToAssist Express Customer - c:\program files\citrix\gotoassist remote support customer\430\g2ax_winlogon.dll
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
    mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
    R1 MpKslcd8f9a51;MpKslcd8f9a51;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e02ffa68-ca1e-46a9-9c38-548ced214e7f}\MpKslcd8f9a51.sys [2012-9-7 29904]
    R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-8-27 566616]
    R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\pc tools\pc tools security\bdt\BDTUpdateService.exe [2012-8-30 575448]
    R2 GoToAssist Remote Support Customer;GoToAssist Remote Support Customer;c:\program files\citrix\gotoassist remote support customer\430\g2ax_service.exe [2012-8-22 610960]
    R2 msoidsvc;Microsoft Online Services Sign-in Assistant;c:\program files\common files\microsoft shared\microsoft online services\MSOIDSVC.EXE [2011-4-28 1577376]
    R2 Security Scheduler;ScriptLogic Remote Scheduler Service;c:\windows\propatches\scheduler\stSchedEx.exe [2008-12-4 980312]
    R2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\enigma~1\spyhun~1\SH4SER~1.EXE [2012-8-21 763840]
    R3 esgiguard;esgiguard;c:\program files\enigma software group\spyhunter\esgiguard.sys [2011-5-6 13904]
    R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2008-4-9 36608]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-7-2 250056]
    S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-12-27 31124344]
    S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
    S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\drivers\PCTBD.sys [2012-8-30 70768]
    S3 SBRE;SBRE;\??\c:\windows\system32\drivers\sbredrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    .
    =============== Created Last 30 ================
    .
    2012-09-07 15:20:37--------d-----w-c:\documents and settings\mmcnair\application data\Malwarebytes
    2012-09-07 13:46:53--------d-----w-c:\documents and settings\mmcnair\local settings\application data\Sun
    2012-09-07 13:44:2529904----a-w-c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e02ffa68-ca1e-46a9-9c38-548ced214e7f}\MpKslcd8f9a51.sys
    2012-09-07 13:42:26--------d-----w-c:\documents and settings\mmcnair\Tracing
    2012-09-07 13:41:34--------d-----w-c:\documents and settings\mmcnair\application data\ShoreWare Client
    2012-09-07 13:41:0756200----a-w-c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e02ffa68-ca1e-46a9-9c38-548ced214e7f}\offreg.dll
    2012-09-07 12:57:487022536----a-w-c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e02ffa68-ca1e-46a9-9c38-548ced214e7f}\mpengine.dll
    2012-08-30 13:27:17--------d-----w-c:\documents and settings\all users\application data\XoftSpySE
    2012-08-30 13:06:4670768----a-w-c:\windows\system32\drivers\PCTBD.sys
    2012-08-30 13:06:44767960----a-w-c:\windows\BDTSupport.dll
    2012-08-30 13:06:42149464----a-w-c:\windows\SGDetectionTool.dll
    2012-08-30 13:06:402267096----a-w-c:\windows\PCTBDCore.dll
    2012-08-30 13:06:401689560----a-w-c:\windows\PCTBDRes.dll
    2012-08-30 13:01:06203120----a-w-c:\windows\system32\drivers\PCTSD.sys
    2012-08-30 13:01:03--------d-----w-c:\program files\common files\PC Tools
    2012-08-30 13:01:01--------d-----w-c:\program files\PC Tools
    2012-08-30 13:00:32--------d-----w-c:\documents and settings\all users\application data\PC Tools
    2012-08-30 12:23:43--------d-----w-C:\sh4ldr
    2012-08-30 12:23:43--------d-----w-c:\program files\Enigma Software Group
    2012-08-30 12:23:03--------d-----w-c:\windows\ADAFC0B4FC1545D9BAB3BC7A8829D0C4.TMP
    2012-08-29 14:00:17--------d-----w-c:\program files\stinger
    2012-08-29 13:30:45--------d-----w-c:\documents and settings\all users\application data\Malwarebytes
    2012-08-29 13:30:4322344----a-w-c:\windows\system32\drivers\mbam.sys
    2012-08-29 13:30:43--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2012-08-27 13:24:19--------d-----w-c:\program files\Microsoft Synchronization Services
    2012-08-27 13:23:26--------d-----w-c:\program files\Microsoft SQL Server Compact Edition
    2012-08-27 13:23:26--------d-----w-c:\documents and settings\all users\Microsoft
    2012-08-27 13:13:56--------d-----w-c:\program files\Microsoft Visual Studio 8
    2012-08-27 13:11:56--------d-----w-c:\program files\Microsoft Analysis Services
    2012-08-15 16:25:43--------d-----w-c:\program files\Microsoft Lync
    2012-08-15 16:24:54--------d-----w-c:\program files\OCSetup
    2012-08-15 13:57:1978336------w-c:\windows\system32\dllcache\browser.dll
    .
    ==================== Find3M ====================
    .
    2012-08-09 13:39:47426184----a-w-c:\windows\system32\FlashPlayerApp.exe
    2012-08-09 13:39:4670344----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-07-06 13:58:5178336----a-w-c:\windows\system32\browser.dll
    2012-07-06 02:07:08143872----a-w-c:\windows\system32\javacpl.cpl
    2012-07-06 02:06:30772544----a-w-c:\windows\system32\npDeployJava1.dll
    2012-07-06 02:06:20687544----a-w-c:\windows\system32\deployJava1.dll
    2012-07-04 14:05:18139784----a-w-c:\windows\system32\drivers\rdpwd.sys
    2012-07-03 15:07:44832512----a-w-c:\windows\system32\wininet.dll
    2012-07-03 15:07:431830912------w-c:\windows\system32\inetcpl.cpl
    2012-07-03 15:07:4278336----a-w-c:\windows\system32\ieencode.dll
    2012-07-03 15:07:4217408------w-c:\windows\system32\corpol.dll
    2012-07-03 13:40:151866112----a-w-c:\windows\system32\win32k.sys
    .
    ============= FINISH: 13:42:38.40 ===============
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 5/19/2008 9:58:34 AM
    System Uptime: 9/7/2012 8:05:56 AM (5 hours ago)
    .
    Motherboard: Hewlett-Packard | | 2820h
    Processor: Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz | XU1 PROCESSOR | 2327/1333mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 149 GiB total, 118.925 GiB free.
    D: is CDROM ()
    H: is NetworkDisk (NTFS) - 7060 GiB total, 3351.007 GiB free.
    N: is NetworkDisk (NTFS) - 7060 GiB total, 3351.007 GiB free.
    S: is NetworkDisk (NTFS) - 7060 GiB total, 3351.007 GiB free.
    Y: is NetworkDisk (NTFS) - 7060 GiB total, 3351.007 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
    Description: PS/2 Compatible Mouse
    Device ID: ACPI\PNP0F13\4&1E368A7A&0
    Manufacturer: Microsoft
    Name: PS/2 Compatible Mouse
    PNP Device ID: ACPI\PNP0F13\4&1E368A7A&0
    Service: i8042prt
    .
    ==== System Restore Points ===================
    .
    No restore point in system.
    .
    ==== Installed Programs ======================
    .
    .
    32 Bit HP CIO Components Installer
    Ad-Aware 2007
    Adobe Acrobat X Standard - English, Français, Deutsch
    Adobe Flash Player 11 ActiveX
    Adobe Reader X (10.1.3)
    AutoSplit Pro Plug-In, v. 2.3
    Browser Guard 4.0
    Compatibility Pack for the 2007 Office system
    Configuration Manager Client
    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
    FileZilla Client 3.4.0
    GoToAssist Customer 1.6.0.430
    High Definition Audio Driver Package - KB888111
    Hotfix for Microsoft .NET Framework 3.0 (KB932471)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) PRO Network Connections 12.1.14.1
    Intel® Management Engine Interface
    Java Auto Updater
    Java(TM) 6 Update 2
    Java(TM) 7 Update 5
    JavaFX 2.1.1
    LightScribe System Software 1.10.23.1
    Malwarebytes Anti-Malware version 1.62.0.1300
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2656353)
    Microsoft .NET Framework 1.1 Security Update (KB2656370)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Antimalware
    Microsoft Application Error Reporting
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Forefront Endpoint Protection
    Microsoft Forefront Endpoint Protection 2010 Server Management
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Lync 2010
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2010 Service Pack 1 (SP1)
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Groove MUI (English) 2010
    Microsoft Office InfoPath MUI (English) 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional Plus 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Online Services Sign-in Assistant
    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
    Microsoft Security Client
    Microsoft Silverlight
    Microsoft Software Update for Web Folders (English) 14
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft WSE 2.0 SP3 Runtime
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6.0 Parser (KB933579)
    NVIDIA Drivers
    PDF-XChange 3.5
    PDF reDirect (remove only)
    perform plus III
    PowerQuest DeployCenter 5.0
    RDC
    Roxio Creator Audio
    Roxio Creator Basic v9
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator Tools
    Roxio Drag-to-Disc
    Roxio Express Labeler 3
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
    Security Update for Microsoft InfoPath 2010 (KB2553322) 32-Bit Edition
    Security Update for Microsoft InfoPath 2010 (KB2553431) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2553260) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2589322) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
    Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition
    Security Update for Microsoft Windows (KB2564958)
    Security Update for Windows Internet Explorer 7 (KB2183461)
    Security Update for Windows Internet Explorer 7 (KB2360131)
    Security Update for Windows Internet Explorer 7 (KB2416400)
    Security Update for Windows Internet Explorer 7 (KB2482017)
    Security Update for Windows Internet Explorer 7 (KB2497640)
    Security Update for Windows Internet Explorer 7 (KB2530548)
    Security Update for Windows Internet Explorer 7 (KB2544521)
    Security Update for Windows Internet Explorer 7 (KB2559049)
    Security Update for Windows Internet Explorer 7 (KB2586448)
    Security Update for Windows Internet Explorer 7 (KB2618444)
    Security Update for Windows Internet Explorer 7 (KB2647516)
    Security Update for Windows Internet Explorer 7 (KB2675157)
    Security Update for Windows Internet Explorer 7 (KB2699988)
    Security Update for Windows Internet Explorer 7 (KB2722913)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB972260)
    Security Update for Windows Internet Explorer 7 (KB974455)
    Security Update for Windows Internet Explorer 7 (KB976325)
    Security Update for Windows Internet Explorer 7 (KB978207)
    Security Update for Windows Internet Explorer 7 (KB982381)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB2393802)
    Security Update for Windows XP (KB2412687)
    Security Update for Windows XP (KB2419632)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB2436673)
    Security Update for Windows XP (KB2440591)
    Security Update for Windows XP (KB2443105)
    Security Update for Windows XP (KB2476490)
    Security Update for Windows XP (KB2476687)
    Security Update for Windows XP (KB2478960)
    Security Update for Windows XP (KB2478971)
    Security Update for Windows XP (KB2479628)
    Security Update for Windows XP (KB2479943)
    Security Update for Windows XP (KB2481109)
    Security Update for Windows XP (KB2483185)
    Security Update for Windows XP (KB2485376)
    Security Update for Windows XP (KB2485663)
    Security Update for Windows XP (KB2503658)
    Security Update for Windows XP (KB2503665)
    Security Update for Windows XP (KB2506212)
    Security Update for Windows XP (KB2506223)
    Security Update for Windows XP (KB2507618)
    Security Update for Windows XP (KB2507938)
    Security Update for Windows XP (KB2508272)
    Security Update for Windows XP (KB2508429)
    Security Update for Windows XP (KB2509553)
    Security Update for Windows XP (KB2510581)
    Security Update for Windows XP (KB2511455)
    Security Update for Windows XP (KB2524375)
    Security Update for Windows XP (KB2535512)
    Security Update for Windows XP (KB2536276-v2)
    Security Update for Windows XP (KB2536276)
    Security Update for Windows XP (KB2544893-v2)
    Security Update for Windows XP (KB2544893)
    Security Update for Windows XP (KB2555917)
    Security Update for Windows XP (KB2566454)
    Security Update for Windows XP (KB2567053)
    Security Update for Windows XP (KB2567680)
    Security Update for Windows XP (KB2570222)
    Security Update for Windows XP (KB2570947)
    Security Update for Windows XP (KB2584146)
    Security Update for Windows XP (KB2585542)
    Security Update for Windows XP (KB2592799)
    Security Update for Windows XP (KB2598479)
    Security Update for Windows XP (KB2603381)
    Security Update for Windows XP (KB2618451)
    Security Update for Windows XP (KB2619339)
    Security Update for Windows XP (KB2620712)
    Security Update for Windows XP (KB2621440)
    Security Update for Windows XP (KB2624667)
    Security Update for Windows XP (KB2631813)
    Security Update for Windows XP (KB2633171)
    Security Update for Windows XP (KB2639417)
    Security Update for Windows XP (KB2641653)
    Security Update for Windows XP (KB2646524)
    Security Update for Windows XP (KB2653956)
    Security Update for Windows XP (KB2655992)
    Security Update for Windows XP (KB2659262)
    Security Update for Windows XP (KB2660465)
    Security Update for Windows XP (KB2661637)
    Security Update for Windows XP (KB2685939)
    Security Update for Windows XP (KB2686509)
    Security Update for Windows XP (KB2691442)
    Security Update for Windows XP (KB2698365)
    Security Update for Windows XP (KB2705219)
    Security Update for Windows XP (KB2707511)
    Security Update for Windows XP (KB2709162)
    Security Update for Windows XP (KB2712808)
    Security Update for Windows XP (KB2718523)
    Security Update for Windows XP (KB2719985)
    Security Update for Windows XP (KB2723135)
    Security Update for Windows XP (KB2731847)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371-v2)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981349)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    ShoreTel Call Manager
    Sonic Activation Module
    SoundMAX
    Spelling Dictionaries Support For Adobe Reader 8
    SpyHunter
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Office 2010 (KB2598289) 32-Bit Edition
    Update for Windows Internet Explorer 7 (KB976749)
    Update for Windows Internet Explorer 7 (KB980182)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB2541763)
    Update for Windows XP (KB2607712)
    Update for Windows XP (KB2616676)
    Update for Windows XP (KB2641690)
    Update for Windows XP (KB2718704)
    Update for Windows XP (KB943729)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    VNC Free Edition 4.1.2
    WebFldrs XP
    WIMGAPI
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Internet Explorer 7
    Windows Media Format 11 runtime
    Windows Media Format SDK Hotfix - KB891122
    Windows Media Player 11
    Windows Presentation Foundation
    Windows XP Service Pack 3
    XML Paper Specification Shared Components Pack 1.0
    ZipGenius 6 (6.0.3.1140)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    9/7/2012 9:05:26 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures.New Signature Version: Previous Signature Version: 1.135.639.0Update Source: Microsoft Update ServerUpdate Stage: InstallSource Path: http://www.microsoft.comSignature Type: AntiVirusUpdate Type: FullUser: NT AUTHORITY\SYSTEMCurrent Engine Version: Previous Engine Version: 1.1.8704.0Error code: 0x80240017Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
    9/7/2012 8:06:13 AM, error: Dhcp [1002] - The IP address lease 10.1.27.17 for the Network Card with network address 001E0BB89247 has been denied by the DHCP server 10.1.2.215 (The DHCP Server sent a DHCPNACK message).
    9/4/2012 8:35:42 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures.New Signature Version: Previous Signature Version: 1.135.390.0Update Source: Microsoft Update ServerUpdate Stage: InstallSource Path: http://www.microsoft.comSignature Type: AntiVirusUpdate Type: FullUser: NT AUTHORITY\SYSTEMCurrent Engine Version: Previous Engine Version: 1.1.8704.0Error code: 0x80240017Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
    8/31/2012 8:41:54 AM, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore
    8/31/2012 8:18:18 AM, error: DCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {24FF4FDC-1D9F-4195-8C79-0DA39248FF48} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18). This security permission can be modified using the Component Services administrative tool.
    8/31/2012 8:17:33 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt
    8/31/2012 10:16:28 AM, error: DCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {0C0A3666-30C9-11D0-8F20-00805F2CD064} to the user DMAINC\lmatthews SID (S-1-5-21-1644491937-1343024091-839522115-34300). This security permission can be modified using the Component Services administrative tool.
    .
    ==== End Of File ===========================
    # AdwCleaner v2.000 - Logfile created 09/07/2012 at 13:45:06
    # Updated 30/08/2012 by Xplode
    # Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
    # User : mmcnair - DMA-3161
    # Boot Mode : Normal
    # Running from : C:\Documents and Settings\mmcnair\Desktop\adwcleaner.exe
    # Option [Search]
    ***** [Services] *****
    ***** [Files / Folders] *****
    ***** [Registry] *****
    Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
    ***** [Internet Browsers] *****
    -\\ Internet Explorer v7.0.5730.13
    [OK] Registry is clean.
    *************************
    AdwCleaner[R1].txt - [615 octets] - [07/09/2012 13:45:05]
    ########## EOF - H:\AdwCleaner[R1].txt - [674 octets] ##########
    That is all of them.
     
  7. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    ComboFix

    Please download ComboFix[​IMG] by sUBs
    From BleepingComputer.com

    Please save the file to your Desktop, but rename it first to svchost.exe

    Important information about ComboFix

    Before the download:
    • Please copy and paste these instructions to Notepad and save to your Desktop, or print them - for easier access.
    • It is important to rename ComboFix before the download.
    • Please do not rename ComboFix to other names, but only the one indicated.
    After the download:
    • Close any open browsers.
    • Very Important: Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Please visit here if you don't know how.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
    • If there is no Internet connection after running ComboFix, then restart your computer to restore back your connection.
    Running ComboFix:
    • Double click on svchost.exe & follow the prompts.
    • It will attempt to install the Recovery Console:
    • When ComboFix finishes, it will produce a report for you.
    • Please post the "C:\Combo-Fix.txt" in your next reply.
    Troubleshooting ComboFix

    Safe Mode:

    If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there.

    (To boot into Safe Mode, tap F8 after BIOS, and just before the Windows
    logo appears. A list of options will appear, select "Safe Mode.")

    Re-downloading:

    If this doesn't work either, try the same method (above method), but try to download it again, except name
    ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe.

    Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe.

    NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
     
  8. Mike in IT

    Mike in IT TS Rookie Topic Starter

    ComboFix 12-09-09.02 - mmcnair 09/10/2012 7:37.2.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2031.1312 [GMT -4:00]
    Running from: c:\documents and settings\mmcnair\Desktop\ComboFix.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\All Users\Application Data\TEMP
    c:\documents and settings\Default User\FXI326E.tmp
    c:\documents and settings\Default User\RD3268.tmp
    c:\documents and settings\Default User\REG3269.tmp
    c:\documents and settings\Default User\REG326A.tmp
    c:\documents and settings\Default User\REG326F.tmp
    c:\documents and settings\Default User\REG3270.tmp
    c:\documents and settings\lmathews.DMAINC\g2ax_customer_downloadhelper_win32_x86.exe
    c:\documents and settings\lmathews.DMAINC\g2mdlhlpx.exe
    c:\documents and settings\LocalService\INI3551.tmp
    c:\documents and settings\lrjohnson\Local Settings\Application Data\assembly\tmp
    c:\windows\system32\URTTemp
    c:\windows\system32\URTTemp\fusion.dll
    c:\windows\system32\URTTemp\mscoree.dll
    c:\windows\system32\URTTemp\mscoree.dll.local
    c:\windows\system32\URTTemp\mscorsn.dll
    c:\windows\system32\URTTemp\mscorwks.dll
    c:\windows\system32\URTTemp\msvcr71.dll
    c:\windows\system32\URTTemp\regtlib.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-08-10 to 2012-09-10 )))))))))))))))))))))))))))))))
    .
    .
    2012-09-07 15:20 . 2012-09-07 15:20--------d-----w-c:\documents and settings\mmcnair\Application Data\Malwarebytes
    2012-09-07 13:46 . 2012-09-07 13:46--------d-----w-c:\documents and settings\mmcnair\Local Settings\Application Data\Sun
    2012-09-07 13:42 . 2012-09-07 13:42--------d-----w-c:\documents and settings\mmcnair\Tracing
    2012-09-07 13:41 . 2012-09-07 13:41--------d-----w-c:\documents and settings\mmcnair\Application Data\ShoreWare Client
    2012-08-30 20:26 . 2012-08-30 20:26--------d-----w-c:\documents and settings\lmathews.DMAINC\Local Settings\Application Data\Threat Expert
    2012-08-30 13:32 . 2012-08-30 13:32--------d-----w-c:\documents and settings\lmathews.DMAINC\Application Data\Malwarebytes
    2012-08-30 13:27 . 2012-08-30 13:27--------d-----w-c:\documents and settings\All Users\Application Data\XoftSpySE
    2012-08-30 13:25 . 2012-08-30 13:25--------d-----w-c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert
    2012-08-30 13:06 . 2012-06-22 15:3970768----a-w-c:\windows\system32\drivers\PCTBD.sys
    2012-08-30 13:06 . 2012-06-22 15:38767960----a-w-c:\windows\BDTSupport.dll
    2012-08-30 13:06 . 2012-06-22 15:39149464----a-w-c:\windows\SGDetectionTool.dll
    2012-08-30 13:06 . 2012-06-22 15:392267096----a-w-c:\windows\PCTBDCore.dll
    2012-08-30 13:06 . 2012-06-22 15:391689560----a-w-c:\windows\PCTBDRes.dll
    2012-08-30 13:01 . 2012-06-22 19:34203120----a-w-c:\windows\system32\drivers\PCTSD.sys
    2012-08-30 13:01 . 2012-08-30 14:05--------d-----w-c:\program files\Common Files\PC Tools
    2012-08-30 13:01 . 2012-08-30 13:25--------d-----w-c:\program files\PC Tools
    2012-08-30 13:00 . 2012-08-30 13:26--------d-----w-c:\documents and settings\All Users\Application Data\PC Tools
    2012-08-30 13:00 . 2012-08-30 13:00--------d-----w-c:\documents and settings\Administrator\Application Data\TestApp
    2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconF7A21AF7.exe
    2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconD7F16134.exe
    2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconCF33A0CE.exe
    2012-08-30 12:23 . 2012-08-30 12:24--------d-----w-C:\sh4ldr
    2012-08-30 12:23 . 2012-08-30 12:23--------d-----w-c:\program files\Enigma Software Group
    2012-08-30 12:23 . 2012-08-30 12:23--------d-----w-c:\windows\ADAFC0B4FC1545D9BAB3BC7A8829D0C4.TMP
    2012-08-29 14:00 . 2012-08-29 14:06--------d-----w-c:\program files\stinger
    2012-08-29 13:30 . 2012-08-29 13:30--------d-----w-c:\documents and settings\genadmin\Application Data\Malwarebytes
    2012-08-29 13:30 . 2012-08-29 13:30--------d-----w-c:\documents and settings\All Users\Application Data\Malwarebytes
    2012-08-29 13:30 . 2012-08-29 13:31--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2012-08-29 13:30 . 2012-07-03 17:4622344----a-w-c:\windows\system32\drivers\mbam.sys
    2012-08-27 13:24 . 2012-08-27 13:24--------d-----w-c:\program files\Microsoft Synchronization Services
    2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\program files\Microsoft Sync Framework
    2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\program files\Microsoft SQL Server Compact Edition
    2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\documents and settings\All Users\Microsoft
    2012-08-27 13:13 . 2012-08-27 13:13--------d-----w-c:\program files\Microsoft Visual Studio 8
    2012-08-27 13:11 . 2012-08-27 13:11--------d-----w-c:\program files\Microsoft Analysis Services
    2012-08-17 13:37 . 2012-08-17 13:37--------d-----w-c:\documents and settings\LocalService\13973
    2012-08-16 13:11 . 2012-08-16 13:11--------d-----w-c:\documents and settings\lmathews.DMAINC\Lync Recordings
    2012-08-15 18:10 . 2012-09-05 11:39--------d-----w-c:\documents and settings\lmathews.DMAINC\Tracing
    2012-08-15 16:25 . 2012-08-16 15:01--------d-----w-c:\program files\Microsoft Lync
    2012-08-15 16:24 . 2012-08-15 16:25--------d-----w-c:\program files\OCSetup
    2012-08-15 16:24 . 2012-08-15 16:25--------d-----w-c:\documents and settings\LocalService\Tracing
    2012-08-15 13:57 . 2012-07-06 13:5878336------w-c:\windows\system32\dllcache\browser.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-08-09 13:39 . 2012-07-02 11:55426184----a-w-c:\windows\system32\FlashPlayerApp.exe
    2012-08-09 13:39 . 2012-07-02 11:5570344----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-07-06 13:58 . 2004-08-04 07:5678336----a-w-c:\windows\system32\browser.dll
    2012-07-06 02:07 . 2008-04-09 16:12143872----a-w-c:\windows\system32\javacpl.cpl
    2012-07-06 02:06 . 2012-07-23 13:19772544----a-w-c:\windows\system32\npDeployJava1.dll
    2012-07-06 02:06 . 2012-07-23 13:19687544----a-w-c:\windows\system32\deployJava1.dll
    2012-07-04 14:05 . 2004-08-04 08:01139784----a-w-c:\windows\system32\drivers\rdpwd.sys
    2012-07-03 15:07 . 2004-08-04 07:56832512----a-w-c:\windows\system32\wininet.dll
    2012-07-03 15:07 . 2004-08-04 07:561830912------w-c:\windows\system32\inetcpl.cpl
    2012-07-03 15:07 . 2004-08-04 07:5678336----a-w-c:\windows\system32\ieencode.dll
    2012-07-03 15:07 . 2004-08-04 07:5617408------w-c:\windows\system32\corpol.dll
    2012-07-03 13:40 . 2004-08-04 06:171866112----a-w-c:\windows\system32\win32k.sys
    2012-06-28 01:08 . 2012-06-28 01:089226440----a-w-c:\documents and settings\Default User\InstallAX.exe
    2012-06-22 14:43 . 2012-08-30 13:063488----a-w-c:\windows\UDB.zip
    2012-06-22 14:43 . 2012-08-30 13:06131----a-w-c:\windows\IDB.zip
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-07 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-07 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-07 137752]
    "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-07-10 1036288]
    "SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
    "AAWTray"="c:\program files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 88024]
    "RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-10-30 1116920]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
    "nwiz"="nwiz.exe" [2007-12-05 1626112]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
    "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-06-06 36760]
    "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-06-06 2903448]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
    "Communicator"="c:\program files\Microsoft Lync\communicator.exe" [2012-05-16 12098648]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
    "SpyHunter Security Suite"="c:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe" [2012-08-21 5158848]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
    "TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-19 2247]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "disablecad"= 1 (0x1)
    "consentpromptbehavioradmin"= 0 (0x0)
    "consentpromptbehavioruser"= 3 (0x3)
    "enableuiadesktoptoggle"= 0 (0x0)
    "promptonsecuredesktop"= 0 (0x0)
    "MaxGPOScriptWait"= 60 (0x3c)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoAutorun"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist Express Customer]
    2012-08-22 11:39610448----a-w-c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_winlogon.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-24657\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-24657\Scripts\Logon\1\0]
    "Script"=INDProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29634\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29634\Scripts\Logon\1\0]
    "Script"=INDProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\1\0]
    "Script"=FWAProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\1\1]
    "Script"=firefox_login.vbs
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34298\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34298\Scripts\Logon\1\0]
    "Script"=INDProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34300\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34300\Scripts\Logon\1\0]
    "Script"=INDProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\1\0]
    "Script"=FWAProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\1\1]
    "Script"=firefox_login.vbs
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @="Service"
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Lync\\UcMapi.exe"=
    "c:\\Program Files\\Microsoft Lync\\communicator.exe"=
    .
    R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [8/30/2012 9:06 AM 575448]
    R2 GoToAssist Remote Support Customer;GoToAssist Remote Support Customer;c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_service.exe [8/22/2012 7:40 AM 610960]
    R2 msoidsvc;Microsoft Online Services Sign-in Assistant;c:\program files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE [4/28/2011 6:14 AM 1577376]
    R2 Security Scheduler;ScriptLogic Remote Scheduler Service;c:\windows\ProPatches\Scheduler\stSchedEx.exe [12/4/2008 3:33 PM 980312]
    R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/9/2008 2:54 PM 36608]
    S2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [8/21/2012 3:29 PM 763840]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [7/2/2012 7:56 AM 250056]
    S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [5/6/2011 4:57 PM 13904]
    S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [12/27/2010 11:50 PM 31124344]
    S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
    S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\drivers\PCTBD.sys [8/30/2012 9:06 AM 70768]
    S3 PSEXESVC;PsExec;c:\windows\PSEXESVC.EXE [11/9/2011 3:00 PM 181064]
    S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2007-11-19 21:47451872----a-w-c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-02 13:39]
    .
    2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{0E861FB1-C66E-45CF-9406-7D9D1560DBDE}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
    .
    2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{522A8A50-1244-4CDE-A5EC-ED570D15BF57}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
    .
    2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{64A7070F-64BE-43B6-B469-5D22F7B68FF5}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://www.dmacafe.com/
    uInternet Settings,ProxyOverride = <local>
    IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    TCP: DhcpNameServer = 10.1.2.217 10.1.2.215
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-09-10 07:42
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(688)
    c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_winlogon.dll
    .
    Completion time: 2012-09-10 07:43:48
    ComboFix-quarantined-files.txt 2012-09-10 11:43
    .
    Pre-Run: 127,956,733,952 bytes free
    Post-Run: 130,656,681,984 bytes free
    .
    - - End Of File - - BD3F9D93B4614AE744F858E138453041
     
  9. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    ComboFix Script

    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Open notepad and copy/paste the text in the codebox below into it:
    • Save this as CFScript.txt, in the same location as ComboFix.exe

      [​IMG]
    • Referring to the picture above, drag CFScript into ComboFix.exe
    • When finished, it shall produce a log for you at C:\ComboFix.txt
    • Please post the contents of the log in your next reply.

    ESET Online Scan

    Please run a free online scan with the ESET Online Scanner
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • When asked, allow the ActiveX control to install, or it will ask to download an installer. Please do so an install it.
    • Click Start or wait for the scanner to load.
    • Make sure that the options Remove found threats and the option Scan unwanted applications are checked.
    • Click Scan (This scan can take several hours, so please be patient)
    • Once the scan is completed, there are a couple of things to keep in mind:
    • 1. If NO threats were found, allow the scanner to Uninstall on close and then close the Window.
    • 2. If threats WERE detected, click on List of Threats Found, Export to Text File...save it as ESET-Scan-Log.txt. Click the back button/link, put a checkmark to Uninstall Application on Close and then close the window.
    • Open the logfile from wherever you saved it
    • Copy and paste the contents in your next reply.
     
  10. Mike in IT

    Mike in IT TS Rookie Topic Starter

    ComboFix 12-09-10.02 - mmcnair 09/10/2012 10:23:54.3.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2031.1204 [GMT -4:00]
    Running from: c:\documents and settings\mmcnair\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\mmcnair\Desktop\CFScript.txt
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-08-10 to 2012-09-10 )))))))))))))))))))))))))))))))
    .
    .
    2012-09-07 15:20 . 2012-09-07 15:20--------d-----w-c:\documents and settings\mmcnair\Application Data\Malwarebytes
    2012-09-07 13:46 . 2012-09-07 13:46--------d-----w-c:\documents and settings\mmcnair\Local Settings\Application Data\Sun
    2012-09-07 13:42 . 2012-09-07 13:42--------d-----w-c:\documents and settings\mmcnair\Tracing
    2012-09-07 13:41 . 2012-09-07 13:41--------d-----w-c:\documents and settings\mmcnair\Application Data\ShoreWare Client
    2012-08-30 20:26 . 2012-08-30 20:26--------d-----w-c:\documents and settings\lmathews.DMAINC\Local Settings\Application Data\Threat Expert
    2012-08-30 13:32 . 2012-08-30 13:32--------d-----w-c:\documents and settings\lmathews.DMAINC\Application Data\Malwarebytes
    2012-08-30 13:27 . 2012-08-30 13:27--------d-----w-c:\documents and settings\All Users\Application Data\XoftSpySE
    2012-08-30 13:25 . 2012-08-30 13:25--------d-----w-c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert
    2012-08-30 13:06 . 2012-06-22 15:3970768----a-w-c:\windows\system32\drivers\PCTBD.sys
    2012-08-30 13:06 . 2012-06-22 15:38767960----a-w-c:\windows\BDTSupport.dll
    2012-08-30 13:06 . 2012-06-22 15:39149464----a-w-c:\windows\SGDetectionTool.dll
    2012-08-30 13:06 . 2012-06-22 15:392267096----a-w-c:\windows\PCTBDCore.dll
    2012-08-30 13:06 . 2012-06-22 15:391689560----a-w-c:\windows\PCTBDRes.dll
    2012-08-30 13:01 . 2012-06-22 19:34203120----a-w-c:\windows\system32\drivers\PCTSD.sys
    2012-08-30 13:01 . 2012-08-30 14:05--------d-----w-c:\program files\Common Files\PC Tools
    2012-08-30 13:01 . 2012-08-30 13:25--------d-----w-c:\program files\PC Tools
    2012-08-30 13:00 . 2012-08-30 13:26--------d-----w-c:\documents and settings\All Users\Application Data\PC Tools
    2012-08-30 13:00 . 2012-08-30 13:00--------d-----w-c:\documents and settings\Administrator\Application Data\TestApp
    2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconF7A21AF7.exe
    2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconD7F16134.exe
    2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconCF33A0CE.exe
    2012-08-30 12:23 . 2012-08-30 12:24--------d-----w-C:\sh4ldr
    2012-08-30 12:23 . 2012-08-30 12:23--------d-----w-c:\program files\Enigma Software Group
    2012-08-30 12:23 . 2012-08-30 12:23--------d-----w-c:\windows\ADAFC0B4FC1545D9BAB3BC7A8829D0C4.TMP
    2012-08-29 14:00 . 2012-08-29 14:06--------d-----w-c:\program files\stinger
    2012-08-29 13:30 . 2012-08-29 13:30--------d-----w-c:\documents and settings\genadmin\Application Data\Malwarebytes
    2012-08-29 13:30 . 2012-08-29 13:30--------d-----w-c:\documents and settings\All Users\Application Data\Malwarebytes
    2012-08-29 13:30 . 2012-08-29 13:31--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2012-08-29 13:30 . 2012-07-03 17:4622344----a-w-c:\windows\system32\drivers\mbam.sys
    2012-08-27 13:24 . 2012-08-27 13:24--------d-----w-c:\program files\Microsoft Synchronization Services
    2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\program files\Microsoft Sync Framework
    2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\program files\Microsoft SQL Server Compact Edition
    2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\documents and settings\All Users\Microsoft
    2012-08-27 13:13 . 2012-08-27 13:13--------d-----w-c:\program files\Microsoft Visual Studio 8
    2012-08-27 13:11 . 2012-08-27 13:11--------d-----w-c:\program files\Microsoft Analysis Services
    2012-08-17 13:37 . 2012-08-17 13:37--------d-----w-c:\documents and settings\LocalService\13973
    2012-08-16 13:11 . 2012-08-16 13:11--------d-----w-c:\documents and settings\lmathews.DMAINC\Lync Recordings
    2012-08-15 18:10 . 2012-09-05 11:39--------d-----w-c:\documents and settings\lmathews.DMAINC\Tracing
    2012-08-15 16:25 . 2012-08-16 15:01--------d-----w-c:\program files\Microsoft Lync
    2012-08-15 16:24 . 2012-08-15 16:25--------d-----w-c:\program files\OCSetup
    2012-08-15 16:24 . 2012-08-15 16:25--------d-----w-c:\documents and settings\LocalService\Tracing
    2012-08-15 13:57 . 2012-07-06 13:5878336------w-c:\windows\system32\dllcache\browser.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-08-09 13:39 . 2012-07-02 11:55426184----a-w-c:\windows\system32\FlashPlayerApp.exe
    2012-08-09 13:39 . 2012-07-02 11:5570344----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-07-06 13:58 . 2004-08-04 07:5678336----a-w-c:\windows\system32\browser.dll
    2012-07-06 02:07 . 2008-04-09 16:12143872----a-w-c:\windows\system32\javacpl.cpl
    2012-07-06 02:06 . 2012-07-23 13:19772544----a-w-c:\windows\system32\npDeployJava1.dll
    2012-07-06 02:06 . 2012-07-23 13:19687544----a-w-c:\windows\system32\deployJava1.dll
    2012-07-04 14:05 . 2004-08-04 08:01139784----a-w-c:\windows\system32\drivers\rdpwd.sys
    2012-07-03 15:07 . 2004-08-04 07:56832512----a-w-c:\windows\system32\wininet.dll
    2012-07-03 15:07 . 2004-08-04 07:561830912------w-c:\windows\system32\inetcpl.cpl
    2012-07-03 15:07 . 2004-08-04 07:5678336----a-w-c:\windows\system32\ieencode.dll
    2012-07-03 15:07 . 2004-08-04 07:5617408------w-c:\windows\system32\corpol.dll
    2012-07-03 13:40 . 2004-08-04 06:171866112----a-w-c:\windows\system32\win32k.sys
    2012-06-28 01:08 . 2012-06-28 01:089226440----a-w-c:\documents and settings\Default User\InstallAX.exe
    2012-06-22 14:43 . 2012-08-30 13:063488----a-w-c:\windows\UDB.zip
    2012-06-22 14:43 . 2012-08-30 13:06131----a-w-c:\windows\IDB.zip
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-09-10_11.42.38 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2012-09-10 14:27 . 2012-09-10 14:2753248 c:\windows\Temp\catchme.dll
    - 2012-09-10 11:42 . 2012-09-10 11:4253248 c:\windows\Temp\catchme.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-07 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-07 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-07 137752]
    "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-07-10 1036288]
    "SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
    "AAWTray"="c:\program files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 88024]
    "RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-10-30 1116920]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
    "nwiz"="nwiz.exe" [2007-12-05 1626112]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
    "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-06-06 36760]
    "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-06-06 2903448]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
    "Communicator"="c:\program files\Microsoft Lync\communicator.exe" [2012-05-16 12098648]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
    "SpyHunter Security Suite"="c:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe" [2012-08-21 5158848]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
    "TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-19 2247]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "disablecad"= 1 (0x1)
    "consentpromptbehavioradmin"= 0 (0x0)
    "consentpromptbehavioruser"= 3 (0x3)
    "enableuiadesktoptoggle"= 0 (0x0)
    "promptonsecuredesktop"= 0 (0x0)
    "MaxGPOScriptWait"= 60 (0x3c)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoAutorun"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist Express Customer]
    2012-08-22 11:39610448----a-w-c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_winlogon.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-24657\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-24657\Scripts\Logon\1\0]
    "Script"=INDProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29634\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29634\Scripts\Logon\1\0]
    "Script"=INDProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\1\0]
    "Script"=FWAProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\1\1]
    "Script"=firefox_login.vbs
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34298\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34298\Scripts\Logon\1\0]
    "Script"=INDProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34300\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34300\Scripts\Logon\1\0]
    "Script"=INDProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\0\0]
    "Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\1\0]
    "Script"=FWAProxy.bat
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\1\1]
    "Script"=firefox_login.vbs
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @="Service"
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Lync\\UcMapi.exe"=
    "c:\\Program Files\\Microsoft Lync\\communicator.exe"=
    .
    R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [8/30/2012 9:06 AM 575448]
    R2 GoToAssist Remote Support Customer;GoToAssist Remote Support Customer;c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_service.exe [8/22/2012 7:40 AM 610960]
    R2 msoidsvc;Microsoft Online Services Sign-in Assistant;c:\program files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE [4/28/2011 6:14 AM 1577376]
    R2 Security Scheduler;ScriptLogic Remote Scheduler Service;c:\windows\ProPatches\Scheduler\stSchedEx.exe [12/4/2008 3:33 PM 980312]
    R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/9/2008 2:54 PM 36608]
    S2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [8/21/2012 3:29 PM 763840]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [7/2/2012 7:56 AM 250056]
    S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [5/6/2011 4:57 PM 13904]
    S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [12/27/2010 11:50 PM 31124344]
    S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
    S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\drivers\PCTBD.sys [8/30/2012 9:06 AM 70768]
    S3 PSEXESVC;PsExec;c:\windows\PSEXESVC.EXE [11/9/2011 3:00 PM 181064]
    S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2007-11-19 21:47451872----a-w-c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-02 13:39]
    .
    2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{0E861FB1-C66E-45CF-9406-7D9D1560DBDE}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
    .
    2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{522A8A50-1244-4CDE-A5EC-ED570D15BF57}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
    .
    2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{64A7070F-64BE-43B6-B469-5D22F7B68FF5}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://www.dmacafe.com/
    uInternet Settings,ProxyOverride = <local>
    IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    TCP: DhcpNameServer = 10.1.2.217 10.1.2.215
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-09-10 10:27
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(688)
    c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_winlogon.dll
    .
    - - - - - - - > 'explorer.exe'(2860)
    c:\windows\system32\WININET.dll
    c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
    c:\progra~1\MICROS~2\Office14\1033\GrooveIntlResource.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2012-09-10 10:28:19
    ComboFix-quarantined-files.txt 2012-09-10 14:28
    ComboFix2.txt 2012-09-10 11:43
    .
    Pre-Run: 130,660,487,168 bytes free
    Post-Run: 130,667,532,288 bytes free
    .
    - - End Of File - - A6FF0A9642EAA4A4AD06D35D88BDA007
    I'm running the other scanner, the ESET scanner, right now.
     
  11. Mike in IT

    Mike in IT TS Rookie Topic Starter

    It said no threats were found.
     
     
  12. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Any more issues?

    We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

    Many of the things to note for us would be:

    • Slow computer
    • Error messages
    • Fake antivirus alerts or the icon in the system tray
    • svchost.exe running at 100%
    • System crashes or blue screen of death
     
  13. Mike in IT

    Mike in IT TS Rookie Topic Starter

    There don't seem to be any other problems. Isn't svchost.exe the ComboFix.exe you had me download? Is it supposed to still be running? It appeared to run fine when you had me run it.
     
  14. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Svchost.exe as a regular Windows process is a legitimate critical part of Windows. I had you rename ComboFix.exe to svchost.exe to mask the malware removal tool so it would not be blocked from running.

    Your logs appear to be clean. If there are no more issues, then we shall finish up!

    Clean up System Restore

    Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."
    • Select Start > All Programs > Accessories > System tools > System Restore.
    • On the dialogue box that appears select Create a Restore Point
    • Click NEXT
    • Enter a name e.g. Clean
    • Click CREATE
    You now have a clean restore point, to get rid of the bad ones:
    • Select Start > All Programs > Accessories > System tools > Disk Cleanup.
    • In the Drop down box that appears select your main drive e.g. C
    • Click OK
    • The System will do some calculation and the display a dialogue box with TABS
    • Select the More Options Tab.
    • At the bottom will be a system restore box with a CLEANUP button click this
    • Accept the Warning and select OK again, the program will close and you are done

    Run OTC to remove our tools

    To remove all of the tools we used and the files and folders they created, please do the following:
    Please download OTC.exe by OldTimer:
    • Save it to your Desktop.
    • Double click OTC.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.
    Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

    Purge old temporary files

    Download CCleaner Slim and save it to your Desktop - Alternate download link

    When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
    Follow the prompts to install the program.

    * Double-click the CCleaner shortcut on the desktop to start the program.
    * Click on the Options block on the left, then choose Cookies.
    * Under Cookies to Delete, highlight any cookies you would like to retain permanently
    * Click the right arrow > to move them to the Cookies to Keep window.
    * Go into Options > Advanced & uncheck Only delete files in Windows Temp folders older than 48 hours
    * Click Cleaner on the left then Run Cleaner on the right to run the program.
    * Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

    Caution: Only use the Registry feature if you are very familiar with the registry.
    Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

    Security Check

    Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
    • Save it to your Desktop.
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
     
  15. Mike in IT

    Mike in IT TS Rookie Topic Starter

    Results of screen317's Security Check version 0.99.50
    Windows XP Service Pack 3 x86 (UAC is enabled)
    Internet Explorer 7 Out of date!
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Security Center service is not running! This report may not be accurate!
    Windows Firewall Disabled!
    Please wait while WMIC compiles updated MOF files.
    WMI entry may not exist for antivirus; attempting automatic update.
    `````````Anti-malware/Other Utilities Check:`````````
    SpyHunter
    Malwarebytes Anti-Malware version 1.62.0.1300
    CCleaner
    JavaFX 2.1.1
    Java 7 Update 7
    Java(TM) 6 Update 2
    Adobe Reader 8 Adobe Reader out of Date!
    Adobe Reader X 10.1.3 Adobe Reader out of Date!
    ````````Process Check: objlist.exe by Laurent````````
    Ad-Aware AAWTray.exe
    Common Files Microsoft Shared Microsoft Online Services MSOIDSVC.EXE
    Common Files Microsoft Shared Microsoft Online Services MSOIDSvcm.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C:: 8%
    ````````````````````End of Log``````````````````````
     
  16. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Uninstall old versions of plugins

    Please go to Start > Control Panel > Add or Remove Programs and remove the following (if present):

    • Java(TM) 6 Update 2
    • Adobe Reader 8
    • Adobe Reader X 10.1.3

    Adobe Reader Update!

    Please download and install the newest version of Adobe Acrobat Reader from Adobe.com


    Personal Tips on Preventing Malware

    See this page for more info about malware and prevention.

    Read more about "FAQ: How did Sirefef or ZeroAccess Infect You?"

    Any other questions before I mark this topic solved?
     
  17. Mike in IT

    Mike in IT TS Rookie Topic Starter

    Nope you did a great job thanks!
     
  18. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Excellent. You did a good job too!

    Marked as solved. √
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.