TechSpot

[Not curable- Ramnit] Family PC probably infected

By acslo
Apr 16, 2011
  1. Hi. I'm cleaning up my family's PC, and recently had some problems with AVG detecting Win32/zbot.g as well as vbscript generic trojans. So I came here to seek some advice. Something that concerned me at the end of the GMER scan was the dialog message it gave me: "GMER has found system modification cased by ROOTKIT activity". Here's the logs:

    MBAM Log
    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6375

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    16/04/2011 19:50:28
    mbam-log-2011-04-16 (19-50-28).txt

    Scan type: Quick scan
    Objects scanned: 150376
    Time elapsed: 2 minute(s), 43 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    GMER Log
    GMER 1.0.15.15570 - http://www.gmer.net
    Rootkit scan 2011-04-16 21:53:17
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e SAMSUNG_HD501LJ rev.CR100-13
    Running: 14uvfjos.exe; Driver: C:\DOCUME~1\Family52\LOCALS~1\Temp\pxlcypog.sys


    ---- System - GMER 1.0.15 ----

    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwAssignProcessToJobObject [0xA6BE6FE4]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0xA7241534]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwCreateFile [0xA6BE7996]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0xA725A6DC]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0xA7241CC0]
    SSDT \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\25973\RapportCerberus_25973.sys (RapportCerberus/Trusteer Ltd.) ZwCreateThread [0xB955CDB6]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xA7241DF6]
    SSDT \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\25973\RapportCerberus_25973.sys (RapportCerberus/Trusteer Ltd.) ZwDeleteFile [0xB955BE12]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteKey [0xA6BEB36C]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteValueKey [0xA6BEB39E]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwLoadKey [0xA6BEB500]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xA725CB44]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenFile [0xA6BE7A5A]
    SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xA73716C0]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenThread [0xA6BE731A]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwProtectVirtualMemory [0xA6BE744C]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwQueryValueKey [0xA6BEB476]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwRenameKey [0xA6BEB3E0]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwReplaceKey [0xA6BEB412]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xA72410F4]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwRestoreKey [0xA6BEB444]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetContextThread [0xA6BE6F8A]
    SSDT \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\25973\RapportCerberus_25973.sys (RapportCerberus/Trusteer Ltd.) ZwSetInformationFile [0xB955BE86]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xA725DE12]
    SSDT \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\25973\RapportCerberus_25973.sys (RapportCerberus/Trusteer Ltd.) ZwSetValueKey [0xB955CC92]
    SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSuspendThread [0xA6BE6F26]
    SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xA7371770]
    SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xA7371810]
    SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xA73718B0]

    ---- User code sections - GMER 1.0.15 ----

    .text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[972] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 00414C10 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (RapportMgmtService/Trusteer Ltd.)
    .text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[972] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
    .text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[972] USER32.dll!GetGUIThreadInfo + FB 7E428023 6 Bytes JMP 716E001E
    .text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[972] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71650022
    .text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[972] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 71680022
    .text C:\program files\real\realplayer\update\realsched.exe[992] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
    .text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[2736] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 004397C0 C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (RapportService/Trusteer Ltd.)
    .text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[2736] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 716B0022
    .text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[2736] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71680022
    .text C:\Program Files\Trusteer\Rapport\bin\RapportService.exe[2736] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 716E0022

    ---- Kernel IAT/EAT - GMER 1.0.15 ----

    IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [A7246672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [A72464C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [A7246CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [A7244C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [A7246672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [A7244C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [A7246CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [A72464C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [A7246CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [A72464C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [A7246672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [A7244C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [A7246672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [A72464C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [A7246CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

    Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

    Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

    Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

    Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    ---- Modules - GMER 1.0.15 ----

    Module (noname) (*** hidden *** ) 00D00000-0194C000 (12894208 bytes)

    ---- EOF - GMER 1.0.15 ----

    DDS Logs
    DDS.txt
    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Family52 at 21:53:39.96 on 16/04/2011
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
    Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1299 [GMT 1:00]
    .
    AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    FW: ZoneAlarm Firewall *Disabled*
    .
    ============== Running Processes ===============
    .
    C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AVG\AVG10\avgwdsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\AVG\AVG10\avgtray.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\program files\real\realplayer\update\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\Family52\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
    C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
    C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
    C:\Program Files\AVG\AVG10\avgnsx.exe
    C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\PROGRA~1\AVG\AVG10\avgrsx.exe
    C:\Program Files\AVG\AVG10\avgcsrvx.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Documents and Settings\Family52\My Documents\Downloads\dds.scr
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.rthk.org.hk/rthk/news/summary/index_news.htm?summary
    uInternet Settings,ProxyOverride = local
    mWinlogon: Userinit=c:\windows\system32\userinit.exe,,c:\program files\oaupmguh\wgmcwjex.exe
    BHO: AutorunsDisabled - No File
    BHO: ThunderAtOnce Class: {01443aec-0fd1-40fd-9c87-e93d1494c233} - c:\program files\thunder network\thunder\comdlls\TDAtOnce_Now.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [Firefox] "c:\program files\mozilla firefox\firefox.exe"
    uRun: [Octoshape Streaming Services] "c:\documents and settings\family52\application data\octoshape\octoshape streaming services\OctoshapeClient.exe" -inv:bootrun
    mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    dRunOnce: [RunNarrator] Narrator.exe
    dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe
    StartupFolder: c:\docume~1\family52\startm~1\programs\startup\stardock objectdock.lnk - c:\program files\stardock\objectdock\ObjectDock.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: ?????? - c:\program files\thunder network\thunder\program\GetUrl.htm
    IE: ?????????? - c:\program files\thunder network\thunder\program\GetAllUrl.htm
    IE: {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\thunder network\thunder\Thunder.exe
    IE: {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\thunder network\thunder\Thunder.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    Trusted Zone: com.tw\asia.msi
    Trusted Zone: com.tw\global.msi
    Trusted Zone: com.tw\www.msi
    DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
    DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: {7760638E-8E4F-4FED-83EE-C5C00DC1B488} = 192.168.2.1,4.2.2.1
    TCP: {E82868EA-1B57-49CF-AB22-5B9405787DD8} = 192.168.2.1
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\docume~1\family52\applic~1\mozilla\firefox\profiles\8nb0w21p.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.singtao.com|http://www.google.com/ig
    FF - prefs.js: network.proxy.type - 4
    FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
    FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordlegacyext.dll
    FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
    FF - plugin: c:\documents and settings\family52\application data\mozilla\plugins\npoctoshape.dll
    FF - plugin: c:\documents and settings\family52\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\common files\thunder network\kankan\npDapCtrlFirefox.2.0.5901.12.(961).dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll
    FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\program files\windows media player\np-mswmp.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\Ext
    FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\avg\avg10\Firefox4
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: network.cookie.cookieBehavior - 0
    FF - user.js: privacy.clearOnShutdown.cookies - false
    FF - user.js: security.warn_viewing_mixed - false
    FF - user.js: security.warn_viewing_mixed.show_once - false
    FF - user.js: security.warn_submit_insecure - false
    FF - user.js: security.warn_submit_insecure.show_once - false
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
    R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-3-30 13496]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 251728]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 299984]
    R1 RapportCerberus_25973;RapportCerberus_25973;c:\documents and settings\all users\application data\trusteer\rapport\store\exts\rapportcerberus\25973\RapportCerberus_25973.sys [2011-4-13 57144]
    R1 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2010-10-4 169320]
    R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2011-4-10 532224]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-1-6 6128720]
    R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400]
    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-10-16 54752]
    R2 RapportMgmtService;Rapport Management Service;c:\program files\trusteer\rapport\bin\RapportMgmtService.exe [2010-10-4 767208]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192]
    R3 genmcmnUSB;USB Scroll Mouse Driver;c:\windows\system32\drivers\gflmouhid.sys [2003-8-7 6528]
    R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [2008-6-21 44664]
    R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-9-25 1425280]
    S1 RapportKELL;RapportKELL;\??\c:\program files\trusteer\rapport\bin\rapportkell.sys --> c:\program files\trusteer\rapport\bin\RapportKELL.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
    S3 cpuz132;cpuz132;\??\c:\docume~1\family52\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\family52\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]
    S3 Micorsoft Windows Service;Micorsoft Windows Service;\??\c:\docume~1\family52\locals~1\temp\ernjagwk.sys --> c:\docume~1\family52\locals~1\temp\ernjagwk.sys [?]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]
    S4 RapportIaso;RapportIaso;c:\documents and settings\all users\application data\trusteer\rapport\store\exts\rapportms\24413\RapportIaso.sys [2011-4-15 18872]
    .
    =============== Created Last 30 ================
    .
    2011-04-15 23:41:12 -------- dc----w- c:\program files\common files\ODBC
    2011-04-15 21:44:44 -------- dc----w- c:\program files\oaupmguh
    2011-04-15 14:18:37 -------- dc----w- c:\docume~1\family52\locals~1\applic~1\Trusteer
    2011-04-10 09:54:22 1238528 -c--a-w- c:\windows\system32\zpeng25.dll
    2011-04-10 09:54:22 -------- dc----w- c:\windows\system32\ZoneLabs
    2011-04-10 09:54:20 -------- dc----w- c:\program files\Zone Labs
    2011-04-10 09:47:15 -------- dc----w- c:\windows\Internet Logs
    2011-04-02 08:59:25 -------- dc----w- c:\docume~1\family52\applic~1\Usenet.nl
    2011-04-02 08:59:20 -------- dc----w- c:\program files\Usenet.nl
    2011-03-30 18:27:14 29520 -c--a-w- c:\windows\system32\SmartDefragBootTime.exe
    2011-03-30 18:27:14 13496 -c--a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
    2011-03-27 14:35:39 77824 -c--a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
    2011-03-27 14:35:39 32768 -c--a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
    2011-03-27 14:35:39 225280 -c--a-w- c:\program files\common files\installshield\iscript\iscript.dll
    2011-03-27 14:35:39 176128 -c--a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
    2011-03-27 14:35:37 614532 -c--a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
    2011-03-27 14:32:47 20992 -c--a-w- c:\windows\system32\dshowext.ax
    .
    ==================== Find3M ====================
    .
    2011-03-07 05:33:50 692736 -c--a-w- c:\windows\system32\inetcomm.dll
    2011-03-04 06:37:06 420864 -c--a-w- c:\windows\system32\vbscript.dll
    2011-03-03 13:21:11 1857920 -c--a-w- c:\windows\system32\win32k.sys
    2011-02-22 23:06:29 916480 -c--a-w- c:\windows\system32\wininet.dll
    2011-02-22 23:06:29 43520 -c--a-w- c:\windows\system32\licmgr10.dll
    2011-02-22 23:06:29 1469440 -c----w- c:\windows\system32\inetcpl.cpl
    2011-02-22 11:41:59 385024 -c--a-w- c:\windows\system32\html.iec
    2011-02-17 12:32:12 5120 -c--a-w- c:\windows\system32\xpsp4res.dll
    2011-02-15 12:56:39 290432 -c--a-w- c:\windows\system32\atmfd.dll
    2011-02-11 21:58:42 1409 -c--a-w- c:\windows\system32\tmpE4214.FOT
    2011-02-11 21:58:42 1409 -c--a-w- c:\windows\system32\tmpCB214.FOT
    2011-02-11 21:58:42 1409 -c--a-w- c:\windows\system32\tmpA1314.FOT
    2011-02-11 21:58:42 1409 -c--a-w- c:\windows\system32\tmp93314.FOT
    2011-02-11 21:58:42 1409 -c--a-w- c:\windows\system32\tmp85314.FOT
    2011-02-11 21:58:42 1409 -c--a-w- c:\windows\system32\tmp77314.FOT
    2011-02-11 21:58:42 1409 -c--a-w- c:\windows\system32\tmp2C114.FOT
    2011-02-09 13:53:52 270848 -c--a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 -c--a-w- c:\windows\system32\encdec.dll
    2011-02-08 13:33:55 978944 -c--a-w- c:\windows\system32\mfc42.dll
    2011-02-08 13:33:55 974848 -c--a-w- c:\windows\system32\mfc42u.dll
    2011-02-02 07:58:35 2067456 -c--a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57:06 677888 -c--a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44:37 439296 -c--a-w- c:\windows\system32\shimgvw.dll
    2007-11-19 12:31:00 3686400 -c--a-w- c:\program files\Shortcut to IKEA Home Planner.lnk
    .
    ============= FINISH: 21:54:09.23 ===============

    Attach.txt
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_11-03-05.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 08/07/2010 16:34:47
    System Uptime: 16/04/2011 19:44:20 (2 hours ago)
    .
    Motherboard: ASUSTeK Computer INC. | | P5KPL-AM
    Processor: Intel(R) Pentium(R) Dual CPU E2200 @ 2.20GHz | Socket 775 | 2199/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 466 GiB total, 374.761 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Realtek RTL8102E Family PCI-E Fast Ethernet NIC
    Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_83471043&REV_02\4&38D2602C&0&00E1
    Manufacturer: Realtek Semiconductor Corp.
    Name: Realtek RTL8102E Family PCI-E Fast Ethernet NIC
    PNP Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_83471043&REV_02\4&38D2602C&0&00E1
    Service: RTLE8023xp
    .
    Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
    Description: Microsoft PS/2 Mouse
    Device ID: ACPI\PNP0F03\4&2C575ACB&0
    Manufacturer: Microsoft
    Name: Microsoft PS/2 Mouse
    PNP Device ID: ACPI\PNP0F03\4&2C575ACB&0
    Service: i8042prt
    .
    ==== System Restore Points ===================
    .
    RP161: 18/01/2011 17:54:03 - System Checkpoint
    RP162: 21/01/2011 13:42:04 - System Checkpoint
    RP163: 22/01/2011 14:13:53 - System Checkpoint
    RP164: 23/01/2011 11:52:16 - Installed DirectX
    RP165: 24/01/2011 15:12:38 - System Checkpoint
    RP166: 25/01/2011 18:26:21 - System Checkpoint
    RP167: 27/01/2011 16:04:01 - System Checkpoint
    RP168: 29/01/2011 12:35:55 - System Checkpoint
    RP169: 31/01/2011 18:12:54 - System Checkpoint
    RP170: 01/02/2011 18:17:13 - System Checkpoint
    RP171: 02/02/2011 19:03:07 - System Checkpoint
    RP172: 05/02/2011 11:55:53 - System Checkpoint
    RP173: 06/02/2011 12:35:30 - System Checkpoint
    RP174: 08/02/2011 12:40:19 - System Checkpoint
    RP175: 10/02/2011 12:12:14 - System Checkpoint
    RP176: 10/02/2011 13:21:44 - Software Distribution Service 3.0
    RP177: 11/02/2011 14:43:17 - System Checkpoint
    RP178: 11/02/2011 16:47:33 - Installed HP Product Detection.
    RP179: 15/02/2011 13:18:16 - System Checkpoint
    RP180: 19/02/2011 14:56:24 - System Checkpoint
    RP181: 21/02/2011 11:07:18 - System Checkpoint
    RP182: 24/02/2011 13:52:34 - System Checkpoint
    RP183: 25/02/2011 14:42:54 - System Checkpoint
    RP184: 26/02/2011 15:56:02 - System Checkpoint
    RP185: 27/02/2011 22:19:11 - System Checkpoint
    RP186: 01/03/2011 12:10:27 - System Checkpoint
    RP187: 03/03/2011 11:29:35 - System Checkpoint
    RP188: 04/03/2011 12:08:53 - System Checkpoint
    RP189: 05/03/2011 12:36:52 - System Checkpoint
    RP190: 06/03/2011 14:06:05 - System Checkpoint
    RP191: 08/03/2011 12:29:10 - System Checkpoint
    RP192: 10/03/2011 12:17:31 - Software Distribution Service 3.0
    RP193: 11/03/2011 12:22:08 - System Checkpoint
    RP194: 14/03/2011 12:41:15 - System Checkpoint
    RP195: 16/03/2011 13:14:15 - System Checkpoint
    RP196: 16/03/2011 14:45:32 - Software Distribution Service 3.0
    RP197: 19/03/2011 14:55:05 - System Checkpoint
    RP198: 20/03/2011 16:26:45 - System Checkpoint
    RP199: 22/03/2011 10:48:45 - System Checkpoint
    RP200: 23/03/2011 15:30:23 - System Checkpoint
    RP201: 24/03/2011 11:19:32 - Software Distribution Service 3.0
    RP202: 26/03/2011 11:30:52 - System Checkpoint
    RP203: 27/03/2011 15:36:14 - Installed MediaImpression
    RP204: 28/03/2011 17:26:37 - System Checkpoint
    RP205: 29/03/2011 17:57:44 - System Checkpoint
    RP206: 30/03/2011 21:57:16 - System Checkpoint
    RP207: 01/04/2011 11:15:12 - System Checkpoint
    RP208: 02/04/2011 11:30:53 - System Checkpoint
    RP209: 03/04/2011 18:45:30 - System Checkpoint
    RP210: 05/04/2011 10:30:53 - System Checkpoint
    RP211: 07/04/2011 16:01:45 - System Checkpoint
    RP212: 09/04/2011 12:29:41 - System Checkpoint
    RP213: 11/04/2011 10:28:49 - System Checkpoint
    RP214: 12/04/2011 11:37:36 - System Checkpoint
    RP215: 13/04/2011 13:42:57 - System Checkpoint
    RP216: 14/04/2011 13:57:44 - System Checkpoint
    RP217: 16/04/2011 00:37:39 - Software Distribution Service 3.0
    .
    ==== Installed Programs ======================
    .
    ???????
    ??5
    ?Google ???
    Ad-Aware
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Color - Photoshop Specific
    Adobe Color Common Settings
    Adobe Color EU Extra Settings
    Adobe Color JA Extra Settings
    Adobe Color NA Recommended Settings
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe Download Manager
    Adobe ExtendScript Toolkit 2
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Fonts All
    Adobe Help Viewer CS3
    Adobe Linguistics CS3
    Adobe PDF Library Files
    Adobe Photoshop CS3
    Adobe Reader 9.4.3
    Adobe Setup
    Adobe Stock Photos CS3
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe WinSoft Linguistics Plugin
    Adobe XMP Panels CS3
    All To MP3 Converter 2.15
    Any Video Converter 2.6.5
    Apple Application Support
    Apple Software Update
    ArcSoft MediaImpression 2
    AVG 2011
    BufferChm
    CCleaner
    Chinese Traditional Fonts Support For Adobe Reader 9
    Citrix Presentation Server Client
    Citrix Secure Access Client
    CP_CalendarTemplates1
    cp_OnlineProjectsConfig
    CP_Package_Basic1
    CP_Panorama1Config
    cp_PosterPrintConfig
    CueTour
    Destinations
    DeviceManagementQFolder
    DocProc
    DocProcQFolder
    Docudesk GPL Ghostscript 8.15
    EPSON Printer Software
    ESET Online Scanner v3
    eSupportQFolder
    Free DWG Viewer 6.2
    FullDPAppQFolder
    Google Chrome
    GoToMeeting 4.5.0.457
    Hotfix for Microsoft .NET Framework 3.0 (KB932471)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB2443685)
    Hotfix for Windows XP (KB942288-v3)
    hp LaserJet 1010 Series
    HP Product Detection
    HP Scanjet 3800 series 7.0
    HP Update
    hpg3800
    hpg3800QFolder
    HPProductAssistant
    IKEA Home Planner
    InfraRecorder
    InstantShareDevices
    Intel(R) Graphics Media Accelerator Driver
    Java Auto Updater
    Java(TM) 6 Update 21
    Java(TM) 6 Update 6
    Java(TM) 6 Update 7
    Junk Mail filter update
    Kate's Video Converter
    Kate's Video Joiner
    Korean Fonts Support For Adobe Reader 8
    Magical Jelly Bean KeyFinder
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft AutoRoute 2001
    Microsoft Bootvis
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Office Outlook Connector
    Microsoft Office Professional Edition 2003
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable - KB2467175
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Mozilla Firefox (3.6.16)
    MSVCRT
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6 Service Pack 2 (KB973686)
    NTREGOPT 1.1j
    NVIDIA Drivers
    Octoshape Streaming Services
    OGA Notifier 2.0.0048.0
    Overture 4.0 ???
    PanoStandAlone
    PDF Settings
    PhotoGallery
    Platform
    PrimoPDF
    PrimoPDF -- brought to you by Nitro PDF Software
    QuickTime
    RandMap
    Rapport
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    RealPlayer
    REALTEK GbE & FE Ethernet PCI-E NIC Driver
    Realtek High Definition Audio Driver
    RealUpgrade 1.1
    Scan
    ScannerCopy
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2393802)
    Security Update for Windows XP (KB2412687)
    Security Update for Windows XP (KB2419632)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB2436673)
    Security Update for Windows XP (KB2440591)
    Security Update for Windows XP (KB2443105)
    Security Update for Windows XP (KB2476687)
    Security Update for Windows XP (KB2478960)
    Security Update for Windows XP (KB2478971)
    Security Update for Windows XP (KB2479628)
    Security Update for Windows XP (KB2479943)
    Security Update for Windows XP (KB2481109)
    Security Update for Windows XP (KB2483185)
    Security Update for Windows XP (KB2485376)
    Security Update for Windows XP (KB2485663)
    Security Update for Windows XP (KB2503658)
    Security Update for Windows XP (KB2506212)
    Security Update for Windows XP (KB2506223)
    Security Update for Windows XP (KB2507618)
    Security Update for Windows XP (KB2508272)
    Security Update for Windows XP (KB2508429)
    Security Update for Windows XP (KB2509553)
    Security Update for Windows XP (KB2511455)
    Security Update for Windows XP (KB2524375)
    Security Update for Windows XP (KB923789)
    Segoe UI
    SkinsHP1
    Skype™ 5.1
    SlideShow
    Smart Defrag 2
    SolidWorks eDrawings 2009
    SolutionCenter
    Sonic_PrimoSDK
    SpeedFan (remove only)
    Spybot - Search & Destroy
    StairDesigner 6.05c
    Tweak UI
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB982632)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB971029)
    Usenet.nl
    VLC media player 1.1.5
    WebFldrs XP
    WebReg
    Windows Driver Package - Hewlett-Packard Image (12/28/2006 8.0.0.0)
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live Mail
    Windows Live Messenger
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Upload Tool
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Presentation Foundation
    Windows XP Service Pack 3
    XML Paper Specification Shared Components Pack 1.0
    ZoneAlarm
    .
    ==== Event Viewer Messages From Past Week ========
    .
    16/04/2011 19:42:53, error: Service Control Manager [7034] - The TrueVector Internet Monitor service terminated unexpectedly. It has done this 1 time(s).
    16/04/2011 00:23:54, error: atapi [9] - The device, \Device\Ide\IdePort2, did not respond within the timeout period.
    16/04/2011 00:07:07, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
    15/04/2011 23:06:49, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for DeleteFlag with the following error: Access is denied.
    15/04/2011 23:06:46, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.
    .
    ==== End Of File ===========================

    Thanks in advance.
     
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Welcome to TechSpot! I'll help you with the system.

    While I do see some entries to be removed and others to identify, I'm not seeing the rootkit entry you mention in GMER. It does indicate there is a hidden module though so we'll look into that. There are also a few entries specific to you on the internet, so I may have you submit files for identification..

    It appears that you may have other languages besides English on the system. But I'm puzzled. You participate in Usenet on the Netherlands but also have Chinese and Korean fonts. Is that correct? It could make an entry hard to ID on a scan. For instance, these appear in your installed programs: (question marks are in the log- they're not mine!)
    ???????
    ??5
    ?Google ???
    IE: ?????? - c:\program files\thunder network\thunder\program\GetUrl.htm
    IE: ?????????? - c:\program files\thunder network\thunder\program\GetAllUrl.htm

    Please do not use the Thunder Network while I am helping you. This is not a virus or a Trojan. It is detected as a "potentially unwanted program". It is an download program. It gets installed Browser Helper Object.
    There are also some entries with question marks in the Trusteer/Rapport entries
    ==========================================
    I am going to have you run Combofix. It won't run with AVG on the system so you will have to remove it temporarily: Download AppRemover and save to the desktop.
    1. Double click the setup on the desktop> click Next
    2. Select “Remove Security Application”
    3. Let scan finish to determine security apps
    4. A screen like below will appear:
      http://www.appremover.com/about/chooseuninstall.gif/image_preview[/img[*] Click on [b]Next[/b] after choice has been made
      [*] Check the AVG program you want to uninstall
      [*] After uninstall shows complete, follow online prompts to Exit the program.[/list]
      [B]Temporary AV:[/B]
      [url=http://download.cnet.com/Avira-AntiVir-Personal-Free-Antivirus/3000-2239_4-10322935.html?part=dl-10322935&subj=dl&tag=button&cdlPid=11012914][b][color=blue]Avira-AntiVir-Personal-Free-Antivirus[/b][/color][/url] or
      [URL="http://download.cnet.com/Avast-Free-Antivirus/3000-2239_4-10019223.html?part=dl-85737&subj=dl&tag=button"][B][COLOR="RoyalBlue"]Avast Free Version[/COLOR][/B][/URL]
      =============================================
      [b]Download Combofix from [url=http://www.bleepingcomputer.com/download/anti-virus/combofix]HERE[/url] or [url=http://www.forospyware.com/sUBs/ComboFix.exe]HERE[/b][/url] and save to the desktop[list]
      [*]Double click combofix.exe & follow the prompts.
      [*] ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      [b]**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.[/b]
      [*]Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
      [*]Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [*]Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [img]http://img.photobucket.com/albums/v706/ried7/whatnext.png
    5. .Click on Yes, to continue scanning for malware
    6. .If Combofix asks you to update the program, allow
    7. .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    8. .Close any open browsers.
    9. .Double click combofix.exe[​IMG] & follow the prompts to run.
    10. When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.
    Notes:
    1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    ========================================
    Run Eset NOD32 Online AntiVirus scan HERE
    1. Tick the box next to YES, I accept the Terms of Use.
    2. Click Start
    3. When asked, allow the Active X control to install
    4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    5. Click Start
    6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    7. Click Scan
    8. Wait for the scan to finish
    9. Click on "Copy to Clipboard"> (you won't see the 'clipboard')
    10. Click anywhere in the post where you want the logs to go, the do Ctrl V. The log will be sent from the clipboard and pasted in the post.
    11. Re-enable your Antivirus software.
      NOTE: If you forget to copy to the clipboard you can find the log here:
      C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

    Please paste logs from Combofix and the Eset scan in your next reply.
     
  3. acslo

    acslo TS Rookie Topic Starter

    I forgot to mention that it was the hidden module in GMER that was coloured red, so I think that's the module that GMER was talking about.

    The programs with the question marks are chinese programs, and my father downloaded Usenet.nl to try it out. It could be uninstalled though, as it's not used anymore. So yeah, it's a bit weird but the chinese fonts and the Usenet.nl programs are meant to be there.

    The log file for ESET is below. Should I paste the ComboFix log here too, or could I attach the file? The file itself is 423kb, so it would take roughly 9 posts to show you the complete log...

    ESET log
    ESETSmartInstaller@High as downloader log:
    all ok
    # version=7
    # OnlineScannerApp.exe=1.0.0.1
    # OnlineScanner.ocx=1.0.0.6427
    # api_version=3.0.2
    # EOSSerial=1cedb0c39ebff94d9509f45487fe77a6
    # end=finished
    # remove_checked=false
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=false
    # antistealth_checked=true
    # utc_time=2011-04-17 11:48:40
    # local_time=2011-04-17 12:48:40 (+0000, GMT Daylight Time)
    # country="United Kingdom"
    # lang=1033
    # osver=5.1.2600 NT Service Pack 3
    # compatibility_mode=512 16777215 100 0 55536234 55536234 0 0
    # compatibility_mode=768 16777215 100 0 0 0 0 0
    # compatibility_mode=1797 16775141 100 93 313 39573914 0 0
    # compatibility_mode=8192 67108863 100 0 23847562 23847562 0 0
    # compatibility_mode=9217 16777214 75 70 608043 2634677 0 0
    # scanned=103988
    # found=0
    # cleaned=0
    # scan_time=3576
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Okay on the language- I thought that was it.

    Regarding size of Combofix log: 423 kilobits = 54 144 bytes
    I see routine size logs that are in this area: 184,764,891,136 bytes

    When you open Notepad, make sure you click on Format and uncheck Word Wrap. If the wrap is on, each entry can take up to 3 lines with spaces after. And the logs will look fragmented. If this is the problem, copy the log to Notepad and uncheck Word Wrap.

    One other part can can make for a long log is the Snapshot section. Sometimes, Combofix can spit out a very lengthy Snapshot. If that is the cause of such a lengthy log, you can cut that section out of the log, being very careful not to remove any other sections or entries, then paste it here.

    I can't think of any other reason to generate a log needing 9 posts. But it does need to be pasted in.
     
  5. acslo

    acslo TS Rookie Topic Starter

    I meant 423 kilobytes :) But, it was the snapshot section that was contributing to the majority of the file.

    Here's the ComboFix log:
    ComboFix 11-04-16.02 - Family52 17/04/2011 11:32:04.4.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1270 [GMT 1:00]
    Running from: c:\documents and settings\Family52\Desktop\ComboFix.exe
    FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Family52\Application Data\Azxoa
    c:\documents and settings\Family52\Application Data\Azxoa\amypi.tmp
    c:\windows\system32\drivers\etc\lmhosts
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-03-17 to 2011-04-17 )))))))))))))))))))))))))))))))
    .
    .
    2011-04-15 21:44 . 2011-04-15 22:19 -------- dc----w- c:\program files\oaupmguh
    2011-04-15 14:18 . 2011-04-15 14:18 -------- dc----w- c:\documents and settings\Family52\Local Settings\Application Data\Trusteer
    2011-04-10 09:54 . 2011-03-18 00:24 104448 -c--a-w- c:\windows\system32\zlcommdb.dll
    2011-04-10 09:54 . 2011-03-18 00:24 69120 -c--a-w- c:\windows\system32\zlcomm.dll
    2011-04-10 09:54 . 2011-04-10 09:54 -------- dc----w- c:\windows\system32\ZoneLabs
    2011-04-10 09:54 . 2011-03-18 00:24 1238528 -c--a-w- c:\windows\system32\zpeng25.dll
    2011-04-10 09:54 . 2011-04-10 09:54 -------- dc----w- c:\program files\Zone Labs
    2011-04-10 09:47 . 2011-04-17 10:34 -------- dc----w- c:\windows\Internet Logs
    2011-04-02 08:59 . 2011-04-07 18:32 -------- dc----w- c:\documents and settings\Family52\Application Data\Usenet.nl
    2011-04-02 08:59 . 2011-04-02 08:59 -------- dc----w- c:\program files\Usenet.nl
    2011-03-30 18:27 . 2011-02-23 16:04 13496 -c--a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
    2011-03-30 18:27 . 2011-02-23 15:54 29520 -c--a-w- c:\windows\system32\SmartDefragBootTime.exe
    2011-03-27 14:38 . 2011-03-27 14:52 -------- dc----w- c:\documents and settings\Family52\Application Data\ArcSoft
    2011-03-27 14:36 . 2011-03-27 14:36 -------- dc----w- c:\program files\ArcSoft
    2011-03-27 14:36 . 2011-03-27 14:37 -------- dc----w- c:\program files\Common Files\ArcSoft
    2011-03-27 14:35 . 2001-09-05 03:18 77824 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
    2011-03-27 14:35 . 2001-09-05 03:18 225280 -c--a-w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
    2011-03-27 14:35 . 2001-09-05 03:14 176128 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
    2011-03-27 14:35 . 2001-09-05 03:13 32768 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
    2011-03-27 14:35 . 2002-07-25 08:07 614532 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
    2011-03-27 14:32 . 2008-04-14 00:12 20992 -c--a-w- c:\windows\system32\dshowext.ax
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-03-07 05:33 . 2008-05-27 15:57 692736 -c--a-w- c:\windows\system32\inetcomm.dll
    2011-03-04 06:37 . 2004-08-03 23:56 420864 -c--a-w- c:\windows\system32\vbscript.dll
    2011-03-03 13:21 . 2004-08-03 22:17 1857920 -c--a-w- c:\windows\system32\win32k.sys
    2011-02-22 23:06 . 2004-08-03 23:56 1469440 -c----w- c:\windows\system32\inetcpl.cpl
    2011-02-22 23:06 . 2004-08-03 23:56 916480 -c--a-w- c:\windows\system32\wininet.dll
    2011-02-22 23:06 . 2004-08-03 23:56 43520 -c--a-w- c:\windows\system32\licmgr10.dll
    2011-02-22 11:41 . 2004-08-03 21:59 385024 -c--a-w- c:\windows\system32\html.iec
    2011-02-17 13:18 . 2004-08-03 22:15 455936 -c--a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-02-17 13:18 . 2004-08-03 22:14 357888 -c--a-w- c:\windows\system32\drivers\srv.sys
    2011-02-17 12:32 . 2009-04-16 12:48 5120 -c--a-w- c:\windows\system32\xpsp4res.dll
    2011-02-15 12:56 . 2004-08-03 23:56 290432 -c--a-w- c:\windows\system32\atmfd.dll
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmpE4214.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmpCB214.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmpA1314.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmp93314.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmp85314.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmp77314.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmp2C114.FOT
    2011-02-09 13:53 . 2004-08-03 23:56 270848 -c--a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53 . 2004-08-03 23:56 186880 -c--a-w- c:\windows\system32\encdec.dll
    2011-02-08 13:33 . 2004-08-03 23:56 978944 -c--a-w- c:\windows\system32\mfc42.dll
    2011-02-08 13:33 . 2004-08-03 23:56 974848 -c--a-w- c:\windows\system32\mfc42u.dll
    2011-02-02 07:58 . 2008-05-27 15:56 2067456 -c--a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57 . 2008-05-27 15:56 677888 -c--a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44 . 2004-08-03 23:56 439296 -c--a-w- c:\windows\system32\shimgvw.dll
    2007-11-19 12:31 . 2009-08-21 09:23 3686400 -c--a-w- c:\program files\Shortcut to IKEA Home Planner.lnk
    2008-02-07 21:46 . 2010-10-12 21:03 13624 -c--a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2008-02-07 21:46 . 2010-10-12 21:03 87360 -c--a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2008-02-07 21:46 . 2010-10-12 21:03 91448 -c--a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2008-02-07 21:46 . 2010-10-12 21:03 21824 -c--a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2008-02-07 21:46 . 2010-10-12 21:03 206136 -c--a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2008-02-07 21:46 . 2010-10-12 21:03 31544 -c--a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2008-02-07 21:46 . 2010-10-12 21:03 40248 -c--a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2007-03-16 17:27 . 2010-10-12 21:03 479232 -c--a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
    2007-03-16 17:27 . 2010-10-12 21:03 548864 -c--a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
    2007-03-16 17:27 . 2010-10-12 21:03 626688 -c--a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
    2007-07-20 12:47 . 2010-10-12 21:03 981170 -c--a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2008-02-07 21:46 . 2010-10-12 21:03 24384 -c--a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2010-10-24_17.02.35 )))))))))))))))))))))))))))))))))))))))))
    .
    *snapshot manually removed*
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Octoshape Streaming Services"="c:\documents and settings\Family52\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-21 137752]
    "TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2010-12-10 274608]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2008-04-14 53760]
    "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
    .
    c:\documents and settings\Family52\Start Menu\Programs\Startup\
    Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-6-1 2746104]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
    2010-10-20 19:47 136176 -c--atw- c:\documents and settings\Family52\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    2004-08-03 21:32 208952 -c--a-w- c:\windows\ime\imjp8_1\imjpmig.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    2004-08-03 21:31 59392 -c--a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
    2006-09-19 08:07 827392 -c--a-w- c:\windows\vsnpstd3.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "gupdate1c9b23e86bfd82"=2 (0x2)
    "NVSvc"=2 (0x2)
    "NAV"=2 (0x2)
    "Themes"=2 (0x2)
    "aawservice"=2 (0x2)
    "TapiSrv"=3 (0x3)
    "RemoteRegistry"=2 (0x2)
    "RDSessMgr"=3 (0x3)
    "RasMan"=3 (0x3)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Thunder Network\\Thunder\\Program\\Thunder5.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Thunder Network\\Xmp\\ThunderLiveUD.exe"=
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderService.exe"=
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderLiveUD.exe"=
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\XLBugReport.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
    .
    R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [30/03/2011 19:27 13496]
    R1 RapportCerberus_25973;RapportCerberus_25973;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\25973\RapportCerberus_25973.sys [13/04/2011 10:59 57144]
    R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [04/10/2010 00:43 169320]
    R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [04/10/2010 00:43 767208]
    R3 genmcmnUSB;USB Scroll Mouse Driver;c:\windows\system32\drivers\gflmouhid.sys [07/08/2003 16:42 6528]
    R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [21/06/2008 16:17 44664]
    R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [25/09/2009 14:45 1425280]
    S1 RapportKELL;RapportKELL;\??\c:\program files\Trusteer\Rapport\bin\RapportKELL.sys --> c:\program files\Trusteer\Rapport\bin\RapportKELL.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]
    S3 Micorsoft Windows Service;Micorsoft Windows Service;\??\c:\docume~1\Family52\LOCALS~1\Temp\ernjagwk.sys --> c:\docume~1\Family52\LOCALS~1\Temp\ernjagwk.sys [?]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 00:56 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    getPlusHelper REG_MULTI_SZ getPlusHelper
    WINRM REG_MULTI_SZ WINRM
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-04-16 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
    .
    2011-04-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1343024091-839522115-1003Core.job
    - c:\documents and settings\Family52\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-20 19:47]
    .
    2011-04-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1343024091-839522115-1003UA.job
    - c:\documents and settings\Family52\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-20 19:47]
    .
    2011-04-17 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 14:07]
    .
    2011-04-17 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-776561741-1343024091-839522115-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    .
    2011-04-17 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-776561741-1343024091-839522115-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    .
    2011-04-17 c:\windows\Tasks\User_Feed_Synchronization-{EC378D39-9E34-4E43-B026-544AD0229CE2}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.rthk.org.hk/rthk/news/summary/index_news.htm?summary
    uInternet Settings,ProxyOverride = local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: ?????? - c:\program files\Thunder Network\Thunder\Program\GetUrl.htm
    IE: ?????????? - c:\program files\Thunder Network\Thunder\Program\GetAllUrl.htm
    IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\Thunder Network\Thunder\Thunder.exe
    IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\Thunder Network\Thunder\Thunder.exe
    Trusted Zone: com.tw\asia.msi
    Trusted Zone: com.tw\global.msi
    Trusted Zone: com.tw\www.msi
    TCP: {7760638E-8E4F-4FED-83EE-C5C00DC1B488} = 192.168.2.1,4.2.2.1
    TCP: {E82868EA-1B57-49CF-AB22-5B9405787DD8} = 192.168.2.1
    FF - ProfilePath - c:\documents and settings\Family52\Application Data\Mozilla\Firefox\Profiles\8nb0w21p.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.singtao.com|http://www.google.com/ig
    FF - prefs.js: network.proxy.type - 4
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF - user.js: network.cookie.cookieBehavior - 0
    FF - user.js: privacy.clearOnShutdown.cookies - false
    FF - user.js: security.warn_viewing_mixed - false
    FF - user.js: security.warn_viewing_mixed.show_once - false
    FF - user.js: security.warn_submit_insecure - false
    FF - user.js: security.warn_submit_insecure.show_once - false
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-04-17 11:35
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-776561741-1343024091-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\½Z *½Z]
    "Order"=hex:08,00,00,00,02,00,00,00,a4,0a,00,00,01,00,00,00,19,00,00,00,5a,00,
    00,00,00,00,00,00,4c,00,32,00,c4,00,00,00,48,30,ab,80,20,00,41,72,63,6f,66,\
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @DACL=(02 0010)
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @DACL=(02 0010)
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @DACL=(02 0010)
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    Completion time: 2011-04-17 11:37:03
    ComboFix-quarantined-files.txt 2011-04-17 10:37
    ComboFix2.txt 2010-10-24 17:06
    ComboFix3.txt 2010-10-22 23:16
    ComboFix4.txt 2010-10-22 13:19
    .
    Pre-Run: 402,371,510,272 bytes free
    Post-Run: 402,321,350,656 bytes free
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    .
    - - End Of File - - 74D1AB0C457B56056482FF7F0A73B592
     
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Regarding this:
    We have you uninstall Combofix and the backups it created when finished.
    So either you ran Combofix on your own last year or whoever helped you didn't have you uninstall it when finished-or-you just didn't uninstall it:

    Did you use this version, already installed from 2010? If so, you will need to uninstall this Combofix, the download again from the link I gave you and repeat the scan.

    Uninstall ComboFix and all Backups of the files it deleted
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [​IMG]

    Now D/L, run and scan again.

    I can remove the Usenet/NL for you and anything else that need to be removed, but I want to be sure that you are running the most current version of Combofix.
     
  7. acslo

    acslo TS Rookie Topic Starter

    My father says that the old ComboFix installation was from when he ran it before. Obviously he forgot to uninstall it! However, I did run a newly downloaded version. I've uninstalled ComboFix completely from this computer, and re-downloaded and re-run it, just in case it made any difference. The new log can be found below.

    Also, thank you for being patient with me, and your continued help :)

    ComboFix 11-04-17.03 - Family52 18/04/2011 18:57:42.5.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1398 [GMT 1:00]
    Running from: c:\documents and settings\Family52\Desktop\ComboFix.exe
    AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
    FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-03-18 to 2011-04-18 )))))))))))))))))))))))))))))))
    .
    .
    2011-04-17 10:46 . 2011-04-17 10:46 -------- dc----w- c:\documents and settings\Family52\Application Data\Avira
    2011-04-17 10:42 . 2011-03-04 15:11 137656 -c--a-w- c:\windows\system32\drivers\avipbb.sys
    2011-04-17 10:42 . 2011-03-04 13:37 61960 -c--a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-04-17 10:42 . 2010-06-17 13:27 45416 -c--a-w- c:\windows\system32\drivers\avgntdd.sys
    2011-04-17 10:42 . 2010-06-17 13:27 22360 -c--a-w- c:\windows\system32\drivers\avgntmgr.sys
    2011-04-17 10:42 . 2011-04-17 10:42 -------- dc----w- c:\program files\Avira
    2011-04-17 10:42 . 2011-04-17 10:42 -------- dc----w- c:\documents and settings\All Users\Application Data\Avira
    2011-04-15 21:44 . 2011-04-15 22:19 -------- dc----w- c:\program files\oaupmguh
    2011-04-15 14:18 . 2011-04-15 14:18 -------- dc----w- c:\documents and settings\Family52\Local Settings\Application Data\Trusteer
    2011-04-10 09:54 . 2011-03-18 00:24 104448 -c--a-w- c:\windows\system32\zlcommdb.dll
    2011-04-10 09:54 . 2011-03-18 00:24 69120 -c--a-w- c:\windows\system32\zlcomm.dll
    2011-04-10 09:54 . 2011-04-10 09:54 -------- dc----w- c:\windows\system32\ZoneLabs
    2011-04-10 09:54 . 2011-03-18 00:24 1238528 -c--a-w- c:\windows\system32\zpeng25.dll
    2011-04-10 09:54 . 2011-04-10 09:54 -------- dc----w- c:\program files\Zone Labs
    2011-04-10 09:47 . 2011-04-18 17:57 -------- dc----w- c:\windows\Internet Logs
    2011-04-02 08:59 . 2011-04-07 18:32 -------- dc----w- c:\documents and settings\Family52\Application Data\Usenet.nl
    2011-04-02 08:59 . 2011-04-02 08:59 -------- dc----w- c:\program files\Usenet.nl
    2011-03-30 18:27 . 2011-02-23 16:04 13496 -c--a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
    2011-03-30 18:27 . 2011-02-23 15:54 29520 -c--a-w- c:\windows\system32\SmartDefragBootTime.exe
    2011-03-27 14:38 . 2011-03-27 14:52 -------- dc----w- c:\documents and settings\Family52\Application Data\ArcSoft
    2011-03-27 14:36 . 2011-03-27 14:36 -------- dc----w- c:\program files\ArcSoft
    2011-03-27 14:36 . 2011-03-27 14:37 -------- dc----w- c:\program files\Common Files\ArcSoft
    2011-03-27 14:35 . 2001-09-05 03:18 77824 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
    2011-03-27 14:35 . 2001-09-05 03:18 225280 -c--a-w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
    2011-03-27 14:35 . 2001-09-05 03:14 176128 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
    2011-03-27 14:35 . 2001-09-05 03:13 32768 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
    2011-03-27 14:35 . 2002-07-25 08:07 614532 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
    2011-03-27 14:32 . 2008-04-14 00:12 20992 -c--a-w- c:\windows\system32\dshowext.ax
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-03-07 05:33 . 2008-05-27 15:57 692736 -c--a-w- c:\windows\system32\inetcomm.dll
    2011-03-04 06:37 . 2004-08-03 23:56 420864 -c--a-w- c:\windows\system32\vbscript.dll
    2011-03-03 13:21 . 2004-08-03 22:17 1857920 -c--a-w- c:\windows\system32\win32k.sys
    2011-02-22 23:06 . 2004-08-03 23:56 1469440 -c----w- c:\windows\system32\inetcpl.cpl
    2011-02-22 23:06 . 2004-08-03 23:56 916480 -c--a-w- c:\windows\system32\wininet.dll
    2011-02-22 23:06 . 2004-08-03 23:56 43520 -c--a-w- c:\windows\system32\licmgr10.dll
    2011-02-22 11:41 . 2004-08-03 21:59 385024 -c--a-w- c:\windows\system32\html.iec
    2011-02-17 13:18 . 2004-08-03 22:15 455936 -c--a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-02-17 13:18 . 2004-08-03 22:14 357888 -c--a-w- c:\windows\system32\drivers\srv.sys
    2011-02-17 12:32 . 2009-04-16 12:48 5120 -c--a-w- c:\windows\system32\xpsp4res.dll
    2011-02-15 12:56 . 2004-08-03 23:56 290432 -c--a-w- c:\windows\system32\atmfd.dll
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmpE4214.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmpCB214.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmpA1314.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmp93314.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmp85314.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmp77314.FOT
    2011-02-11 21:58 . 2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmp2C114.FOT
    2011-02-09 13:53 . 2004-08-03 23:56 270848 -c--a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53 . 2004-08-03 23:56 186880 -c--a-w- c:\windows\system32\encdec.dll
    2011-02-08 13:33 . 2004-08-03 23:56 978944 -c--a-w- c:\windows\system32\mfc42.dll
    2011-02-08 13:33 . 2004-08-03 23:56 974848 -c--a-w- c:\windows\system32\mfc42u.dll
    2011-02-02 07:58 . 2008-05-27 15:56 2067456 -c--a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57 . 2008-05-27 15:56 677888 -c--a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44 . 2004-08-03 23:56 439296 -c--a-w- c:\windows\system32\shimgvw.dll
    2007-11-19 12:31 . 2009-08-21 09:23 3686400 -c--a-w- c:\program files\Shortcut to IKEA Home Planner.lnk
    2008-02-07 21:46 . 2010-10-12 21:03 13624 -c--a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2008-02-07 21:46 . 2010-10-12 21:03 87360 -c--a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2008-02-07 21:46 . 2010-10-12 21:03 91448 -c--a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2008-02-07 21:46 . 2010-10-12 21:03 21824 -c--a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2008-02-07 21:46 . 2010-10-12 21:03 206136 -c--a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2008-02-07 21:46 . 2010-10-12 21:03 31544 -c--a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2008-02-07 21:46 . 2010-10-12 21:03 40248 -c--a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2007-03-16 17:27 . 2010-10-12 21:03 479232 -c--a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
    2007-03-16 17:27 . 2010-10-12 21:03 548864 -c--a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
    2007-03-16 17:27 . 2010-10-12 21:03 626688 -c--a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
    2007-07-20 12:47 . 2010-10-12 21:03 981170 -c--a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2008-02-07 21:46 . 2010-10-12 21:03 24384 -c--a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Octoshape Streaming Services"="c:\documents and settings\Family52\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-21 137752]
    "TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2010-12-10 274608]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2008-04-14 53760]
    "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
    .
    c:\documents and settings\Family52\Start Menu\Programs\Startup\
    Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-6-1 2746104]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
    2010-10-20 19:47 136176 -c--atw- c:\documents and settings\Family52\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    2004-08-03 21:32 208952 -c--a-w- c:\windows\ime\imjp8_1\imjpmig.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    2004-08-03 21:31 59392 -c--a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
    2006-09-19 08:07 827392 -c--a-w- c:\windows\vsnpstd3.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "gupdate1c9b23e86bfd82"=2 (0x2)
    "NVSvc"=2 (0x2)
    "NAV"=2 (0x2)
    "Themes"=2 (0x2)
    "aawservice"=2 (0x2)
    "TapiSrv"=3 (0x3)
    "RemoteRegistry"=2 (0x2)
    "RDSessMgr"=3 (0x3)
    "RasMan"=3 (0x3)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Thunder Network\\Thunder\\Program\\Thunder5.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Thunder Network\\Xmp\\ThunderLiveUD.exe"=
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderService.exe"=
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderLiveUD.exe"=
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\XLBugReport.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
    .
    R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [30/03/2011 19:27 13496]
    R1 RapportCerberus_25973;RapportCerberus_25973;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\25973\RapportCerberus_25973.sys [13/04/2011 10:59 57144]
    R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [04/10/2010 00:43 169320]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [17/04/2011 11:42 135336]
    R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [04/10/2010 00:43 767208]
    R3 genmcmnUSB;USB Scroll Mouse Driver;c:\windows\system32\drivers\gflmouhid.sys [07/08/2003 16:42 6528]
    R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [21/06/2008 16:17 44664]
    R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [25/09/2009 14:45 1425280]
    S1 RapportKELL;RapportKELL;\??\c:\program files\Trusteer\Rapport\bin\RapportKELL.sys --> c:\program files\Trusteer\Rapport\bin\RapportKELL.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]
    S3 Micorsoft Windows Service;Micorsoft Windows Service;\??\c:\docume~1\Family52\LOCALS~1\Temp\ernjagwk.sys --> c:\docume~1\Family52\LOCALS~1\Temp\ernjagwk.sys [?]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 00:56 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    getPlusHelper REG_MULTI_SZ getPlusHelper
    WINRM REG_MULTI_SZ WINRM
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-04-16 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
    .
    2011-04-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1343024091-839522115-1003Core.job
    - c:\documents and settings\Family52\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-20 19:47]
    .
    2011-04-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1343024091-839522115-1003UA.job
    - c:\documents and settings\Family52\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-20 19:47]
    .
    2011-04-18 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 14:07]
    .
    2011-04-18 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-776561741-1343024091-839522115-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    .
    2011-04-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-776561741-1343024091-839522115-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    .
    2011-04-18 c:\windows\Tasks\User_Feed_Synchronization-{EC378D39-9E34-4E43-B026-544AD0229CE2}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.rthk.org.hk/rthk/news/summary/index_news.htm?summary
    uInternet Settings,ProxyOverride = local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: ?????? - c:\program files\Thunder Network\Thunder\Program\GetUrl.htm
    IE: ?????????? - c:\program files\Thunder Network\Thunder\Program\GetAllUrl.htm
    IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\Thunder Network\Thunder\Thunder.exe
    IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\Thunder Network\Thunder\Thunder.exe
    Trusted Zone: com.tw\asia.msi
    Trusted Zone: com.tw\global.msi
    Trusted Zone: com.tw\www.msi
    TCP: {7760638E-8E4F-4FED-83EE-C5C00DC1B488} = 192.168.2.1,4.2.2.1
    TCP: {E82868EA-1B57-49CF-AB22-5B9405787DD8} = 192.168.2.1
    FF - ProfilePath - c:\documents and settings\Family52\Application Data\Mozilla\Firefox\Profiles\8nb0w21p.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.singtao.com|http://www.google.com/ig
    FF - prefs.js: network.proxy.type - 4
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF - user.js: network.cookie.cookieBehavior - 0
    FF - user.js: privacy.clearOnShutdown.cookies - false
    FF - user.js: security.warn_viewing_mixed - false
    FF - user.js: security.warn_viewing_mixed.show_once - false
    FF - user.js: security.warn_submit_insecure - false
    FF - user.js: security.warn_submit_insecure.show_once - false
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-04-18 19:01
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-776561741-1343024091-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\½Z *½Z]
    "Order"=hex:08,00,00,00,02,00,00,00,a4,0a,00,00,01,00,00,00,19,00,00,00,5a,00,
    00,00,00,00,00,00,4c,00,32,00,c4,00,00,00,48,30,ab,80,20,00,41,72,63,6f,66,\
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @DACL=(02 0010)
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @DACL=(02 0010)
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @DACL=(02 0010)
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(660)
    c:\windows\system32\wbem\wbemcomn.dll
    .
    - - - - - - - > 'explorer.exe'(3316)
    c:\windows\system32\WININET.dll
    c:\program files\Stardock\ObjectDock\DockShellHook.dll
    c:\program files\Trusteer\Rapport\bin\rooksbas.dll
    c:\progra~1\WINDOW~2\wmpband.dll
    c:\windows\system32\msi.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2011-04-18 19:03:20
    ComboFix-quarantined-files.txt 2011-04-18 18:03
    .
    Pre-Run: 413,174,169,600 bytes free
    Post-Run: 413,175,332,864 bytes free
    .
    - - End Of File - - 883861365EDF04B1CD7E8EE1A6C488D8
     
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    All of these type of programs work from a database. And the programs themselves occasionally have to be revised for some reason. These scans that we use are for free versions, meant only to be used here and later removed. We also advise, as does the author of the program and all the download sites that a user not use Combofix on their own. It's not a 'keep on the system for security' program. It has a specific use, for specific problems. IT makes backups. These are all good reasons not to keep it on a system.
    When we have you unintal it at the end, it removes the program, the backups it created and the logs.
    ==============================
    Question please before I start on the script. There are several of these entries: They are same date and time and all tmp files, all FOT, just different numerical string:
    2011-02-11 21:58 1409 -c--a-w- c:\windows\system32\tmpE4214.FOT

    Possible help with type of file here: http://en.wikipedia.org/wiki/FOT
    I can't identify these. Since I know that other languages are on the system, will you check Properties and let me know what they are and if you added them?

    I can remove the Usenet.nl. Anything else that's obsolete?
     
  9. acslo

    acslo TS Rookie Topic Starter

    Checking the properties of the FOT files doesn't give me any information at all. All the properties were blank. And I don't know where the files came from. After looking in the system32 folder, I can see that there are more of these FOT files than listed in the ComboFix log. Is this significant at all?

    Usenet.nl is the only obsolete program on this computer at the moment.
     
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Regarding the .FOT file extension:
    So it appears that on 2011-02-11 21:58 , these 7 files each of thee same size, 1409, someone added these fonts. Since they are all tmp files, I am putting them in the script for removal. Note please> while you may be seeing additional .FOT files on the system, I can only act on what I see
    ============================================
    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
    Code:
    File::
    c:\windows\system32\tmpE4214.FOT
    c:\windows\system32\tmpCB214.FOT
    c:\windows\system32\tmpA1314.FOT
    c:\windows\system32\tmp93314.FOT
    c:\windows\system32\tmp85314.FOT
    c:\windows\system32\tmp77314.FOT
    c:\windows\system32\tmp2C114.FOT
    c:\docume~1\Family52\LOCALS~1\Temp\ernjagwk.sys
    c:\docume~1\family52\locals~1\temp\cpuz132\cpuz132_x32. sys
    DDS::
    IE: ?????? - c:\program files\thunder network\thunder\program\GetUrl.htm
    IE: ?????????? - c:\program files\thunder network\thunder\program\GetAllUrl.htm
    IE: {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\thunder network\thunder\Thunder.exe
    IE: {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\thunder network\thunder\Thunder.exe
    Extra::
    File::
    c:\program files\common files\thunder network\kankan\npDapCtrlFirefox.2.0.5901.12.(961).dll
    Firefox::
    Firefox-: - Profile - c:\docume~1\family52\applic~1\mozilla\firefox\profiles\8nb0w21p.default\
    Folder::
    c:\documents and settings\Family52\Application Data\Usenet.nl
    c:\program files\Usenet.nl
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=-
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Thunder Network\\Thunder\\Program\\Thunder5.exe"=-
    "c:\\Program Files\\Thunder Network\\Xmp\\ThunderLiveUD.exe"=-
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderService.exe"=-
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderLiveUD.exe"=-
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\XLBugReport.exe"=-
    RegLock::
    [HKEY_USERS\S-1-5-21-776561741-1343024091-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites \½Z *½Z]
    Driver::
    Micorsoft Windows Service
    cpuz132
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
    ====================
    Repeating: Advise remove from Trusted Zone:
    Trusted Zone: com.tw\asia.msi
    Trusted Zone: com.tw\global.msi
    Trusted Zone: com.tw\www.msi
     
  11. acslo

    acslo TS Rookie Topic Starter

    I've run the script, and here's the ComboFix log:

    ComboFix 11-04-21.03 - Family52 22/04/2011 10:59:43.6.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1414 [GMT 1:00]
    Running from: c:\documents and settings\Family52\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Family52\Desktop\CFScript.txt
    AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
    FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    .
    FILE ::
    "c:\docume~1\family52\locals~1\temp\cpuz132\cpuz132_x32. sys"
    "c:\docume~1\Family52\LOCALS~1\Temp\ernjagwk.sys"
    "c:\program files\common files\thunder network\kankan\npDapCtrlFirefox.2.0.5901.12.(961).dll"
    "c:\windows\system32\tmp2C114.FOT"
    "c:\windows\system32\tmp77314.FOT"
    "c:\windows\system32\tmp85314.FOT"
    "c:\windows\system32\tmp93314.FOT"
    "c:\windows\system32\tmpA1314.FOT"
    "c:\windows\system32\tmpCB214.FOT"
    "c:\windows\system32\tmpE4214.FOT"
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Family52\Application Data\Usenet.nl
    c:\documents and settings\Family52\Application Data\Usenet.nl\articlestatus.dat
    c:\documents and settings\Family52\Application Data\Usenet.nl\articlestatus.dat.bak
    c:\documents and settings\Family52\Application Data\Usenet.nl\config.dat
    c:\documents and settings\Family52\Application Data\Usenet.nl\config.dat.bak
    c:\documents and settings\Family52\Application Data\Usenet.nl\downloadqueue.dat
    c:\documents and settings\Family52\Application Data\Usenet.nl\downloadqueue.dat.bak
    c:\documents and settings\Family52\Application Data\Usenet.nl\log.txt
    c:\documents and settings\Family52\Application Data\Usenet.nl\port.dat
    c:\documents and settings\Family52\Application Data\Usenet.nl\subscribed.dat
    c:\documents and settings\Family52\Application Data\Usenet.nl\subscribed.dat.bak
    c:\documents and settings\Family52\Application Data\Usenet.nl\wizard.dat
    c:\documents and settings\Family52\Application Data\Usenet.nl\wizard.dat.bak
    c:\program files\common files\thunder network\kankan\npDapCtrlFirefox.2.0.5901.12.(961).dll
    c:\program files\thunder network\thunder\Thunder.exe
    c:\program files\Usenet.nl
    c:\program files\Usenet.nl\App.ico
    c:\program files\Usenet.nl\Ionic.Zlib.dll
    c:\program files\Usenet.nl\Resources.res
    c:\program files\Usenet.nl\setup_config.dat
    c:\program files\Usenet.nl\unins000.dat
    c:\program files\Usenet.nl\unins000.exe
    c:\program files\Usenet.nl\unrar.dll
    c:\program files\Usenet.nl\Usenet.nl.exe
    c:\windows\system32\tmp2C114.FOT
    c:\windows\system32\tmp77314.FOT
    c:\windows\system32\tmp85314.FOT
    c:\windows\system32\tmp93314.FOT
    c:\windows\system32\tmpA1314.FOT
    c:\windows\system32\tmpCB214.FOT
    c:\windows\system32\tmpE4214.FOT
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Legacy_CPUZ132
    -------\Service_cpuz132
    -------\Service_Micorsoft Windows Service
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-03-22 to 2011-04-22 )))))))))))))))))))))))))))))))
    .
    .
    2011-04-17 10:46 . 2011-04-17 10:46 -------- dc----w- c:\documents and settings\Family52\Application Data\Avira
    2011-04-17 10:42 . 2011-03-04 15:11 137656 -c--a-w- c:\windows\system32\drivers\avipbb.sys
    2011-04-17 10:42 . 2011-03-04 13:37 61960 -c--a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-04-17 10:42 . 2010-06-17 13:27 45416 -c--a-w- c:\windows\system32\drivers\avgntdd.sys
    2011-04-17 10:42 . 2010-06-17 13:27 22360 -c--a-w- c:\windows\system32\drivers\avgntmgr.sys
    2011-04-17 10:42 . 2011-04-17 10:42 -------- dc----w- c:\program files\Avira
    2011-04-17 10:42 . 2011-04-17 10:42 -------- dc----w- c:\documents and settings\All Users\Application Data\Avira
    2011-04-15 21:44 . 2011-04-15 22:19 -------- dc----w- c:\program files\oaupmguh
    2011-04-15 14:18 . 2011-04-15 14:18 -------- dc----w- c:\documents and settings\Family52\Local Settings\Application Data\Trusteer
    2011-04-10 09:54 . 2011-03-18 00:24 104448 -c--a-w- c:\windows\system32\zlcommdb.dll
    2011-04-10 09:54 . 2011-03-18 00:24 69120 -c--a-w- c:\windows\system32\zlcomm.dll
    2011-04-10 09:54 . 2011-04-10 09:54 -------- dc----w- c:\windows\system32\ZoneLabs
    2011-04-10 09:54 . 2011-03-18 00:24 1238528 -c--a-w- c:\windows\system32\zpeng25.dll
    2011-04-10 09:54 . 2011-04-10 09:54 -------- dc----w- c:\program files\Zone Labs
    2011-04-10 09:47 . 2011-04-22 10:05 -------- dc----w- c:\windows\Internet Logs
    2011-03-30 18:27 . 2011-02-23 16:04 13496 -c--a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
    2011-03-30 18:27 . 2011-02-23 15:54 29520 -c--a-w- c:\windows\system32\SmartDefragBootTime.exe
    2011-03-27 14:38 . 2011-03-27 14:52 -------- dc----w- c:\documents and settings\Family52\Application Data\ArcSoft
    2011-03-27 14:36 . 2011-03-27 14:36 -------- dc----w- c:\program files\ArcSoft
    2011-03-27 14:36 . 2011-03-27 14:37 -------- dc----w- c:\program files\Common Files\ArcSoft
    2011-03-27 14:35 . 2001-09-05 03:18 77824 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
    2011-03-27 14:35 . 2001-09-05 03:18 225280 -c--a-w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
    2011-03-27 14:35 . 2001-09-05 03:14 176128 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
    2011-03-27 14:35 . 2001-09-05 03:13 32768 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
    2011-03-27 14:35 . 2002-07-25 08:07 614532 -c--a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
    2011-03-27 14:32 . 2008-04-14 00:12 20992 -c--a-w- c:\windows\system32\dshowext.ax
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-03-07 05:33 . 2008-05-27 15:57 692736 -c--a-w- c:\windows\system32\inetcomm.dll
    2011-03-04 06:37 . 2004-08-03 23:56 420864 -c--a-w- c:\windows\system32\vbscript.dll
    2011-03-03 13:21 . 2004-08-03 22:17 1857920 -c--a-w- c:\windows\system32\win32k.sys
    2011-02-22 23:06 . 2004-08-03 23:56 1469440 -c----w- c:\windows\system32\inetcpl.cpl
    2011-02-22 23:06 . 2004-08-03 23:56 916480 -c--a-w- c:\windows\system32\wininet.dll
    2011-02-22 23:06 . 2004-08-03 23:56 43520 -c--a-w- c:\windows\system32\licmgr10.dll
    2011-02-22 11:41 . 2004-08-03 21:59 385024 -c--a-w- c:\windows\system32\html.iec
    2011-02-17 13:18 . 2004-08-03 22:15 455936 -c--a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-02-17 13:18 . 2004-08-03 22:14 357888 -c--a-w- c:\windows\system32\drivers\srv.sys
    2011-02-17 12:32 . 2009-04-16 12:48 5120 -c--a-w- c:\windows\system32\xpsp4res.dll
    2011-02-15 12:56 . 2004-08-03 23:56 290432 -c--a-w- c:\windows\system32\atmfd.dll
    2011-02-09 13:53 . 2004-08-03 23:56 270848 -c--a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53 . 2004-08-03 23:56 186880 -c--a-w- c:\windows\system32\encdec.dll
    2011-02-08 13:33 . 2004-08-03 23:56 978944 -c--a-w- c:\windows\system32\mfc42.dll
    2011-02-08 13:33 . 2004-08-03 23:56 974848 -c--a-w- c:\windows\system32\mfc42u.dll
    2011-02-02 07:58 . 2008-05-27 15:56 2067456 -c--a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57 . 2008-05-27 15:56 677888 -c--a-w- c:\windows\system32\mstsc.exe
    2007-11-19 12:31 . 2009-08-21 09:23 3686400 -c--a-w- c:\program files\Shortcut to IKEA Home Planner.lnk
    2008-02-07 21:46 . 2010-10-12 21:03 13624 -c--a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2008-02-07 21:46 . 2010-10-12 21:03 87360 -c--a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2008-02-07 21:46 . 2010-10-12 21:03 91448 -c--a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2008-02-07 21:46 . 2010-10-12 21:03 21824 -c--a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2008-02-07 21:46 . 2010-10-12 21:03 206136 -c--a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2008-02-07 21:46 . 2010-10-12 21:03 31544 -c--a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2008-02-07 21:46 . 2010-10-12 21:03 40248 -c--a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2007-03-16 17:27 . 2010-10-12 21:03 479232 -c--a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
    2007-03-16 17:27 . 2010-10-12 21:03 548864 -c--a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
    2007-03-16 17:27 . 2010-10-12 21:03 626688 -c--a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
    2007-07-20 12:47 . 2010-10-12 21:03 981170 -c--a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2008-02-07 21:46 . 2010-10-12 21:03 24384 -c--a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Octoshape Streaming Services"="c:\documents and settings\Family52\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-21 137752]
    "TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2010-12-10 274608]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2008-04-14 53760]
    "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
    .
    c:\documents and settings\Family52\Start Menu\Programs\Startup\
    Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2010-10-27 912344]
    Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-6-1 2746104]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
    2010-10-20 19:47 136176 -c--atw- c:\documents and settings\Family52\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    2004-08-03 21:32 208952 -c--a-w- c:\windows\ime\imjp8_1\imjpmig.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    2004-08-03 21:31 59392 -c--a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd3]
    2006-09-19 08:07 827392 -c--a-w- c:\windows\vsnpstd3.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "gupdate1c9b23e86bfd82"=2 (0x2)
    "NVSvc"=2 (0x2)
    "NAV"=2 (0x2)
    "Themes"=2 (0x2)
    "aawservice"=2 (0x2)
    "TapiSrv"=3 (0x3)
    "RemoteRegistry"=2 (0x2)
    "RDSessMgr"=3 (0x3)
    "RasMan"=3 (0x3)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Thunder Network\\Thunder\\Program\\Thunder5.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Thunder Network\\Xmp\\ThunderLiveUD.exe"=
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderService.exe"=
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderLiveUD.exe"=
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\XLBugReport.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
    .
    R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [30/03/2011 19:27 13496]
    R1 RapportCerberus_25973;RapportCerberus_25973;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\25973\RapportCerberus_25973.sys [13/04/2011 10:59 57144]
    R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [04/10/2010 00:43 169320]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [17/04/2011 11:42 135336]
    R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [04/10/2010 00:43 767208]
    R3 genmcmnUSB;USB Scroll Mouse Driver;c:\windows\system32\drivers\gflmouhid.sys [07/08/2003 16:42 6528]
    R3 Net6IM;Net6;c:\windows\system32\drivers\net6im51.sys [21/06/2008 16:17 44664]
    R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [25/09/2009 14:45 1425280]
    S1 RapportKELL;RapportKELL;\??\c:\program files\Trusteer\Rapport\bin\RapportKELL.sys --> c:\program files\Trusteer\Rapport\bin\RapportKELL.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]
    S3 CFcatchme;CFcatchme;\??\c:\docume~1\Family52\LOCALS~1\Temp\CFcatchme.sys --> c:\docume~1\Family52\LOCALS~1\Temp\CFcatchme.sys [?]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 00:56 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    getPlusHelper REG_MULTI_SZ getPlusHelper
    WINRM REG_MULTI_SZ WINRM
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-04-16 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
    .
    2011-04-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1343024091-839522115-1003Core.job
    - c:\documents and settings\Family52\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-20 19:47]
    .
    2011-04-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-776561741-1343024091-839522115-1003UA.job
    - c:\documents and settings\Family52\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-20 19:47]
    .
    2011-04-22 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 14:07]
    .
    2011-04-22 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-776561741-1343024091-839522115-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    .
    2011-04-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-776561741-1343024091-839522115-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    .
    2011-04-22 c:\windows\Tasks\User_Feed_Synchronization-{EC378D39-9E34-4E43-B026-544AD0229CE2}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.rthk.org.hk/rthk/news/summary/index_news.htm?summary
    uInternet Settings,ProxyOverride = local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: ?????? - c:\program files\Thunder Network\Thunder\Program\GetUrl.htm
    IE: ?????????? - c:\program files\Thunder Network\Thunder\Program\GetAllUrl.htm
    IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\Thunder Network\Thunder\Thunder.exe
    Trusted Zone: com.tw\asia.msi
    Trusted Zone: com.tw\global.msi
    Trusted Zone: com.tw\www.msi
    TCP: {7760638E-8E4F-4FED-83EE-C5C00DC1B488} = 192.168.2.1,4.2.2.1
    TCP: {E82868EA-1B57-49CF-AB22-5B9405787DD8} = 192.168.2.1
    FF - ProfilePath - c:\documents and settings\Family52\Application Data\Mozilla\Firefox\Profiles\8nb0w21p.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.singtao.com|http://www.google.com/ig
    FF - prefs.js: network.proxy.type - 4
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF - user.js: network.cookie.cookieBehavior - 0
    FF - user.js: privacy.clearOnShutdown.cookies - false
    FF - user.js: security.warn_viewing_mixed - false
    FF - user.js: security.warn_viewing_mixed.show_once - false
    FF - user.js: security.warn_submit_insecure - false
    FF - user.js: security.warn_submit_insecure.show_once - false
    .
    - - - - ORPHANS REMOVED - - - -
    .
    AddRemove-Usenet.nl_is1 - c:\program files\Usenet.nl\unins000.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-04-22 11:07
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-776561741-1343024091-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\½Z *½Z]
    "Order"=hex:08,00,00,00,02,00,00,00,a4,0a,00,00,01,00,00,00,19,00,00,00,5a,00,
    00,00,00,00,00,00,4c,00,32,00,c4,00,00,00,48,30,ab,80,20,00,41,72,63,6f,66,\
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @DACL=(02 0010)
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @DACL=(02 0010)
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @DACL=(02 0010)
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'explorer.exe'(124)
    c:\windows\system32\WININET.dll
    c:\program files\Stardock\ObjectDock\DockShellHook.dll
    c:\program files\Trusteer\Rapport\bin\rooksbas.dll
    c:\progra~1\WINDOW~2\wmpband.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\msi.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Avira\AntiVir Desktop\avguard.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\program files\Avira\AntiVir Desktop\avshadow.exe
    c:\windows\system32\igfxsrvc.exe
    .
    **************************************************************************
    .
    Completion time: 2011-04-22 11:11:15 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-04-22 10:11
    ComboFix2.txt 2011-04-18 18:03
    .
    Pre-Run: 412,851,367,936 bytes free
    Post-Run: 412,775,530,496 bytes free
    .
    - - End Of File - - 36F4E51CA3FE180DD64E31493438BC3D

    I've made a screenshot of the other FOT files I mentioned in a previous post, which you can see below. I've highlighted them so you can see them better.
    [​IMG]
    Would you advise removing these files too?
     
     
  12. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    If you want to remove the other FOT entries, that's up to you. No more screen shots please.

    I note that some of the entries I had in the script are still on the system. There are numerous entries for the Thunder Network for instance. And I have advised twice before to remove the entries from the Trusted Zone.

    Are you copying the entire contents of the code box with the script?
     
  13. acslo

    acslo TS Rookie Topic Starter

    Hi Bobbye,

    I've removed those 3 sites from the trusted zone now. It doesn't look like you mentioned removing them until your post with the script.

    I definitely copy and pasted the entirety of the script into the text file. Do you want me to run the script again?
     
  14. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    All but one of the Web Thunder entries I had in the script all still on the system. I'll set up new script based on what is in the current log:

    Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap> and copy/paste the text in the code below into it:
    Code:
    File::
    c:\windows\system32\SmartDefragBootTime.exe
    Registry::
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=-
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Thunder Network\\Thunder\\Program\\Thunder5.exe"=-
    "c:\\Program Files\\Thunder Network\\Xmp\\ThunderLiveUD.exe"=-
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderService.exe"=-
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\ThunderLiveUD.exe"=-
    "c:\\Program Files\\Common Files\\Thunder Network\\DS\\Ver1\\1.0.2.73\\XLBugReport.exe"=-
    DDS::
    IE: ?????? - c:\program files\Thunder Network\Thunder\Program\GetUrl.htm
    IE: ?????????? - c:\program files\Thunder Network\Thunder\Program\GetAllUrl.htm
    IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\program files\Thunder Network\Thunder\Thunder.exe
    Extra::
    File::
    c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    Firefox:: 
    Firefox-: -Profile- c:\documents and settings\Family52\Application Data\Mozilla\Firefox\Profiles\8nb0w21p.default\
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste into to your next reply.
    ====================
    Advise you take this off of startup: SmartDefragBootTime
     
  15. acslo

    acslo TS Rookie Topic Starter

    The antivirus program (Avira AntiVir) has popped up while my father was using the computer, and it said that a virus had been found. So I had AntiVir remove the virus, and it did a quick system scan, but this just caused more viruses to be found. I repeatedly had the program remove the viruses, and more viruses were detected every time. In the end there were over 2000 infected files found by AntiVir, before I decided to reboot the computer into safe mode and do a full system scan.

    Here's a list of the virus names I could get from the scan logs (when it did its quick system scans): W32/Ramnit.C, GEN/PwdZIP, HTML/Drop.Agent.AB, TR/Rootkit.Gen, TR/Trash.Gen. I noticed most of the infected files were either DLL, EXE, or HTML files. Most of the DLL files were from legitimate programs such as the Java Runtime Environment and QuickTime. I've seen the same problem on the PC before a while ago, which I thought I'd fixed, but it looks like it's come back again...

    Before rebooting to do the full system scan, I took a quick look at the list of running processes to see if there was anything out of place. I saw that there were a number of iexplore.exe processes running, but there were no Internet Explorer windows open. I did a quick search on Google, and this seems to match the behaviour of the W32/Ramnit.C virus.

    So I'm putting off running the ComboFix script until the system's been scanned. Do you have any advice on what else I should do? Or should I just run the script so that you can get more information?
     
  16. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Sorry- internet was down.

    I am very sorry to have to inform you the you will have to reformat/reinstall the OS. We consider Ramnit an incurable file infector. Here is some information on it for you:

    Win32/Ramnit.A is a file infector with IRCBot functionality which infects .exe, and .HTML/HTM files, and opens a back door that compromises your computer. Using this backdoor, a remote attacker can access and instruct the infected computer to download and execute more malicious files.

    The infected .HTML or .HTM files may be detected as Virus:VBS/Ramnit.A. Win32/Ramnit.A!dll is a related file infector often seen with this infection. It too has IRCBot functionality which infects .exe, .dll and .HTML/HTM files and opens a back door that compromises your computer. This component is injected into the default web browser by Worm:Win32/Ramnit.A which is dropped by a Ramnit infected executable file.

    With this particular infection the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

    Why? The malware injects code in legitimate files similar to the Virut virus and in many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files often become corrupted and the system may become unstable or irreparable. The longer Ramnit.A remains on a computer, the more files it infects and corrupts so the degree of infection can vary.
    *********************************************************************
    Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies Worm:Win32/Ramnit.A with a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and a major source of system infection.
    ************************************************************************
    In my opinion, Ramnit.A is not effectively disinfectable, so your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. Further, your machine has likely been compromised by the backdoor Trojan and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if your anti-virus reports that the malware appears to have been removed.

    Important Note:: If your computer was used for online banking, has credit card information or other sensitive data on it, you should disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to to include those used for banking, email, eBay, paypal and any online activities which require a username and password. You should consider them to be compromised. You should change each password using a clean computer and not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach. Failure to notify your financial institution and local law enforcement can result in refusal to reimburse funds lost due to fraud or similar criminal activity.

    You will find excellent reformat/reinstall instructions here:
    http://www.tech-101.com/tutorials/356-tutorial-windows-install-repair-xp-vista.html
     
  17. acslo

    acslo TS Rookie Topic Starter

    Hi Bobbye,

    Shortly after scanning the system and finding that the system was still being continuously infected, we decided to reformat the PC, so its no problem :) I'll make sure to tell my father changes all his passwords (I don't use the computer as I have my own). Thank you for all your help Bobbye, and I'll try to make sure my parents don't mess up the computer again!
     
  18. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    I'm glad you went ahead with the reformat/reinstall. Tell you dad that he needs to monitor any online financial transactions as there is no way to know how much the system was compromised.

    Sorry to have had to deliver bad news, but you did the right thing. Here are some tips to help keep the system clean:
    Tips for added security and safer browsing: (Links are in Bold Blue)
    1. Browser Security
      [o] Safe Settings
      [o] ZonedOut. This manages the Zones in Internet Explorer. (For IE7 and IE8, Windows 2000 thru Vista. No Windows 7)
      [o] Replace the Host Files
      [o] Google Toolbar Pop Up Blocker
      [o]Web of Trust (WOT) Site Advisor. Traffic-light rating symbols show which rate the site for Trustworthiness, Vendor Reliability, Privacy, Child Safety.
    2. Have layered Security:
      [o]Antivirus :(only one):Both of the following programs are free and known to be good:
      [o]Avira-AntiVir-Personal-Free-Antivirus
      [o]Avast Free Version
      [o]Firewall (only one): Use bi-directional firewall. Both of the following programs are free and known to be good:
      [o]Comodo
      [o]Zone Alarm
    3. Antimalware: I recommend all of the following:
      [o]Spywareblaster: SpywareBlaster protects against bad ActiveX.
      [o]Spybot Search & Destroy
    4. Updates: Stay current:
      [o] the Microsoft Download Sitefrequently. All updates marked Critical and the current SP updates.
      [o]Adobe Reader Install current, uninstall old.
      [o]Java Updates Install current, uninstall old.
    5. Tracking Cookies
      Reset Cookie:
      [o]For Internet Explorer: Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> check 'override automatic Cookie handling'> check 'accept first party Cookies'> check 'Block third party Cookies'> check 'allow per session Cookies'> Apply> OK.
      [o]For Firefox: Tools> Options> Privacy> Cookies> check ‘accept Cookies from Sites’> Uncheck 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others. (Note: for Firefox v3.5, after Privacy click on 'use custom settings for History.')
      I suggest using the following two add-on for Firefox. They will prevent the Tracking Cookies that come from ads and banners and other sources:
      AdBlock Plus
      Easy List
      [o]For Chrome: Tools> Options> Under The Hood> Privacy Section> CHECK 'Restrict how third party Cookies can be used'> Close.
    6. Do regular Maintenance
      [o] Temporary File Cleaner
    7. Restore Points:
      [o]See System Restore Guide
    8. Safe Email Handling
      [o] Don't open email from anyone you don't know.
      [o] Don't open Attachments in the email. Safe to your desktop and scan for viruses using a right click
      [o] Don't leave your personal email address on the internet. Have a separate email account at one of the free web-based emails like Yahoo.
    Please let me know if you find any bad link.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.