[Sality- Not curable] HELP with Bluescreen and Malware Sality

By ramneetneet
Jun 23, 2011
Topic Status:
Not open for further replies.
  1. Hi All

    I got a blue screen which had a stop code:

    STOP 0x0000050

    The computer wentoff and restarted this kept happening and couldnt go onto safe mode.
    In here it showed me different blue screen.


    STOP 0x000007B

    I removed evrything and did a Flea Power

    It started fine then but there were a lot of other troubles with my computer:


    1. Cannot copy any files

    I thought I would copy some of the important files to external drive. There is a message

    "File Integrity violated"

    2. Cannot Unhide Hidden files and folders

    I was trying to locate rouge files in AppData. But i show hidden files through folder options, it disappears again.
    The same trhough Control Panel.

    3. Get an error while opening most programs

    Microsoft Visual C++ Error
    R6002
    floating point support not loaded

    4. Cannot update malware bytes after installing

    5. Downloads get redirected.

    6. Task manager is disabled. Get a message "It is disabled by your admin"

    7. Same with Regedit "Registery editing disabled by your admin"


    Here are the logs of progrms that I ran:


    (1)

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 06/23/2011 at 04:14 PM

    Application Version : 4.49.1000

    Core Rules Database Version : 7313
    Trace Rules Database Version: 5125

    Scan type : Complete Scan
    Total Scan Time : 00:31:07

    Memory items scanned : 443
    Memory threats detected : 1
    Registry items scanned : 6530
    Registry threats detected : 32
    File items scanned : 17000
    File threats detected : 6

    Disabled.RegistryEditor
    HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System#DisableRegistryTools

    Disabled.TaskManager
    HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System#DisableTaskMgr
    HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM#DISABLETASKMGR
    HKU\S-1-5-21-842925246-287218729-1177238915-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM#DISABLETASKMGR
    HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM#DISABLETASKMGR

    Trojan.Agent/Gen-MailDrop/Spammer
    C:\DOCUME~1\RAMMY\LOCALS~1\TEMP\FEFOR.EXE
    C:\DOCUME~1\RAMMY\LOCALS~1\TEMP\FEFOR.EXE
    C:\DOCUMENTS AND SETTINGS\RAMMY\LOCAL SETTINGS\TEMP\FEFOR.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP15\A0033436.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP15\A0033437.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP16\A0033565.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP16\A0033708.EXE

    Disabled.SecurityCenterOption
    HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#ANTIVIRUSDISABLENOTIFY
    HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#FIREWALLDISABLENOTIFY
    HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#UPDATESDISABLENOTIFY

    Malware.Sality
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32#Type
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32#Start
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32#ErrorControl
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32#ImagePath
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32#DisplayName
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Security
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Security#Security
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum#0
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum#Count
    HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Service
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Legacy
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#ConfigFlags
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Class
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#ClassGUID
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#DeviceDesc
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Capabilities
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000\Control
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000\Control#ActiveService


    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


    (2)

    Malwarebytes' Anti-Malware 1.51.0.1200
    www.malwarebytes.org

    Database version: 6923

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    23/06/2011 16:58:53
    mbam-log-2011-06-23 (16-58-53).txt

    Scan type: Full scan (C:\|D:\|E:\|G:\|)
    Objects scanned: 246654
    Time elapsed: 26 minute(s), 11 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 2
    Registry Values Infected: 0
    Registry Data Items Infected: 5
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32 (Virus.Sality) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 (Virus.Sality) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DISABLETASKMGR (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


    (3)

    ComboFix 11-06-22.03 - Rammy 23/06/2011 17:24:41.1.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1575 [GMT 5.5:30]
    Running from: c:\documents and settings\Rammy\Desktop\ComboFix.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\windows\ALCMTR.EXE
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Legacy_AMSINT32
    -------\Service_amsint32
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))
    .
    .
    2011-06-23 10:47 . 2011-06-23 10:52 -------- d-----w- c:\windows\system32\wbem\Logs
    2011-06-22 17:47 . 2011-06-22 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2011-06-22 17:45 . 2011-06-22 17:46 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
    2011-06-22 17:24 . 2011-06-22 18:11 -------- d-----w- c:\program files\Temp File Cleaner DB Toolbar
    2011-06-22 17:22 . 2011-06-22 17:22 -------- d-----w- c:\program files\Temp File Cleaner
    2011-06-22 16:18 . 2011-06-22 17:29 -------- d-----w- c:\documents and settings\JUST DO IT
    2011-06-22 16:11 . 2011-06-22 16:11 -------- d-----w- c:\program files\Avira
    2011-06-22 15:11 . 2011-06-22 15:11 -------- d-----w- c:\program files\Common Files\ParetoLogic
    2011-06-22 15:11 . 2011-06-22 15:11 -------- d-----w- c:\program files\ParetoLogic
    2011-06-22 14:13 . 2011-06-22 14:13 -------- d-----w- c:\documents and settings\Rammy\Application Data\DriverCure
    2011-06-22 14:13 . 2011-06-22 14:13 -------- d-----w- c:\documents and settings\Rammy\Application Data\ParetoLogic
    2011-06-22 14:13 . 2011-06-22 15:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
    2011-06-22 13:51 . 2008-04-13 17:45 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
    2011-06-22 13:50 . 2008-04-13 23:12 73832 -c--a-w- c:\windows\system32\dllcache\slcoinst.dll
    2011-06-22 13:49 . 2001-08-17 07:37 19840 -c--a-w- c:\windows\system32\dllcache\philtune.sys
    2011-06-22 13:48 . 2001-08-17 07:22 17280 -c--a-w- c:\windows\system32\dllcache\mraid35x.sys
    2011-06-22 13:47 . 2001-08-17 16:06 372824 -c--a-w- c:\windows\system32\dllcache\iconf32.dll
    2011-06-22 13:46 . 2001-08-17 05:50 334208 -c--a-w- c:\windows\system32\dllcache\ds1wdm.sys
    2011-06-22 13:45 . 2008-04-13 17:46 36480 -c--a-w- c:\windows\system32\dllcache\bthprint.sys
    2011-06-22 13:44 . 2008-04-13 17:36 43008 -c--a-w- c:\windows\system32\dllcache\amdagp.sys
    2011-06-22 10:53 . 2011-06-22 10:53 -------- d-----w- c:\program files\Common Files\Java
    2011-06-22 10:48 . 2011-06-22 10:48 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    2011-06-22 10:48 . 2011-06-22 10:48 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-06-22 10:48 . 2011-06-22 10:48 -------- d-----w- c:\program files\Java
    2011-06-22 03:43 . 2011-06-22 03:43 -------- d-----w- c:\windows\BUVC_AP
    2011-06-22 03:43 . 2011-06-22 03:43 -------- d-----w- c:\documents and settings\Rammy\Application Data\InstallShield
    2011-06-21 20:21 . 2011-06-22 13:00 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\FLVService
    2011-06-21 20:21 . 2011-06-21 20:21 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
    2011-06-21 17:35 . 2011-06-21 17:35 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\Mozilla
    2011-06-21 17:32 . 2011-06-21 12:15 -------- d-----w- c:\windows\SHELLNEW
    2011-06-21 17:32 . 2011-06-21 17:32 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\Microsoft Help
    2011-06-21 17:31 . 2011-06-21 13:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
    2011-06-21 17:31 . 2011-06-21 17:31 -------- d-----r- C:\MSOCache
    2011-06-21 17:26 . 2011-06-21 17:27 -------- d-----w- c:\program files\Common Files\Adobe
    2011-06-21 17:25 . 2011-06-21 14:51 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-06-21 17:25 . 2011-06-22 10:48 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-06-21 14:44 . 2011-06-21 14:44 -------- d-----w- c:\documents and settings\Rammy\AppData
    2011-06-21 14:38 . 2011-06-22 12:15 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\FLVService
    2011-06-21 14:38 . 2011-06-21 14:38 -------- d-----w- c:\windows\Freecorder
    2011-06-21 14:31 . 2011-06-22 03:46 -------- d-----w- c:\documents and settings\Rammy\Application Data\BitComet
    2011-06-21 14:08 . 2011-06-21 14:08 -------- d-----w- c:\windows\Sun
    2011-06-21 14:04 . 2011-06-22 17:39 -------- d-----w- C:\Downloads
    2011-06-21 13:33 . 2011-06-22 03:43 -------- d-----w- c:\program files\InstallShield Installation Information
    2011-06-21 13:33 . 2011-06-21 13:33 -------- d-----w- c:\program files\Seagate
    2011-06-21 13:33 . 2011-06-21 13:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Seagate
    2011-06-21 13:32 . 2011-06-21 13:32 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\Downloaded Installations
    2011-06-21 13:32 . 2011-06-21 13:32 -------- d-sh--w- c:\windows\ftpcache
    2011-06-21 13:30 . 2011-06-22 17:17 -------- d-----w- c:\program files\BitComet
    2011-06-21 13:29 . 2011-06-21 13:35 -------- d-----w- c:\documents and settings\Rammy\Application Data\TeraCopy
    2011-06-21 13:29 . 2011-06-21 13:29 -------- d-----w- c:\program files\TeraCopy
    2011-06-21 12:45 . 2011-06-22 07:58 -------- d-----w- c:\documents and settings\Rammy\Application Data\vlc
    2011-06-21 12:38 . 2011-06-21 13:22 -------- d-----w- c:\program files\XP Disk Cleaner
    2011-06-21 12:38 . 2011-06-21 12:38 -------- d-----w- c:\windows\system32\XPToolsLicenseComponent
    2011-06-21 12:17 . 2006-10-26 14:26 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
    2011-06-21 12:17 . 2006-10-26 14:26 32592 ----a-w- c:\windows\system32\msonpmon.dll
    2011-06-21 12:16 . 2011-06-21 12:16 -------- d-----w- c:\program files\Microsoft Works
    2011-06-21 12:15 . 2011-06-21 12:15 -------- d-----w- c:\program files\MSBuild
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-04-27 16:00 . 2007-04-27 16:00 1275455 ----a-w- c:\program files\Common Files\unins000.exe
    2011-04-28 18:01 . 2011-06-22 09:57 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ------- Sigcheck -------
    Note: Unsigned files aren't necessarily malware.
    .
    [-] 2009-09-23 . 9425B72F40257B45D45D24773273DAD0 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
    .
    [-] 2009-09-23 . 5A8E28037289FCCBF7AD3FC57DF7048F . 502272 . . [1.0626.6002.18005] . . c:\windows\system32\usp10.dll
    .
    [-] 2009-09-23 . 87F6E1E3202E85AC083AC64D84115C44 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
    .
    [-] 2009-09-23 . 24D516507C5DD80F2A3F7BF28B931141 . 2163712 . . [5.1.2600.5755] . . c:\windows\system32\ntkrnlpa.exe
    .
    .
    [-] 2009-09-23 . 0DB420DBBAC999ED43DE0162FBA07269 . 2285056 . . [5.1.2600.5755] . . c:\windows\system32\ntoskrnl.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 332520]
    "MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-05-01 263464]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-21 212480]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-21 240640]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-21 216576]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "_nltide_3"="advpack.dll" [2009-09-09 128512]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableTaskMgr"= 1 (0x1)
    "DisableRegistryTools"= 1 (0x1)
    .
    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^Rammy^Start Menu^Programs^Startup^Seagate Product Registration.lnk]
    path=c:\documents and settings\Rammy\Start Menu\Programs\Startup\Seagate Product Registration.lnk
    backup=c:\windows\pss\Seagate Product Registration.lnkStartup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2010-11-10 07:19 1001920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2011-01-30 15:45 113560 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
    2008-04-14 03:42 15360 ----a-w- c:\windows\system32\ctfmon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    2006-10-26 19:17 100648 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
    2008-04-10 14:52 16940032 ----a-w- c:\windows\RTHDCPL.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "WMPNetworkSvc"=3 (0x3)
    "ose"=3 (0x3)
    "odserv"=3 (0x3)
    "Microsoft Office Groove Audit Service"=3 (0x3)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "AntiVirusOverride"=dword:00000001
    "AntiVirusDisableNotify"=dword:00000001
    "FirewallDisableNotify"=dword:00000001
    "FirewallOverride"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001
    "UacDisableNotify"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    "DisableNotifications"= 1 (0x1)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\BitComet\\BitComet.exe"=
    "c:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Reader_sl.exe"=
    "c:\\Program Files\\Seagate\\SeagateManager\\FreeAgent Status\\StxMenuMgr.exe"=
    "c:\\Program Files\\Seagate\\SeagateManager\\Backup\\MaxBackServiceInt.exe"=
    "c:\\WINDOWS\\system32\\igfxtray.exe"=
    "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
    "c:\\WINDOWS\\system32\\hkcmd.exe"=
    "c:\\Program Files\\Windows Media Player\\wmdbexport.exe"=
    "c:\\WINDOWS\\system32\\igfxpers.exe"=
    "c:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe"=
    "c:\\Program Files\\MBlaze UI\\bin\\App.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\POWERPNT.EXE"=
    "c:\\WINDOWS\\system32\\igfxsrvc.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "18803:TCP"= 18803:TCP:BitComet 18803 TCP
    "18803:UDP"= 18803:UDP:BitComet 18803 UDP
    .
    R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [23/09/2009 18:14 308248]
    R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [01/05/2009 14:35 181544]
    R2 UDisk Monitor;UDisk Monitor;c:\program files\MBlaze UI\bin\MonServiceUDisk.exe [27/04/2007 21:51 512000]
    R3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [27/04/2007 21:51 104704]
    S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - AMSINT32
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-06-22 c:\windows\Tasks\ParetoLogic Registration3.job
    - c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2011-03-29 23:17]
    .
    2011-06-22 c:\windows\Tasks\ParetoLogic Update Version3.job
    - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-29 23:17]
    .
    2011-06-22 c:\windows\Tasks\PC Health Advisor Defrag.job
    - c:\program files\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
    .
    2011-06-22 c:\windows\Tasks\PC Health Advisor.job
    - c:\program files\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
    mStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
    IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
    IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    TCP: Interfaces\{AB31D87D-B04D-43A7-903C-29E2E158B0E4}: NameServer = 10.216.254.140 10.216.254.141
    FF - ProfilePath - c:\documents and settings\Rammy\Application Data\Mozilla\Firefox\Profiles\xaevdg6j.default\
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-10 - (no file)
    MSConfigStartUp-Alcmtr - ALCMTR.EXE
    MSConfigStartUp-DATAMNGR - c:\progra~1\WI0498~1\Datamngr\DATAMN~1.EXE
    MSConfigStartUp-Freecorder FLV Service - c:\program files\Freecorder\FLVSrvc.exe
    MSConfigStartUp-Google Update - c:\documents and settings\Rammy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-06-23 17:28
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'explorer.exe'(1872)
    c:\windows\system32\WININET.dll
    c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4028_x-ww_e69378d1\MSVCR80.dll
    c:\windows\system32\msi.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\igfxsrvc.exe
    .
    **************************************************************************
    .
    Completion time: 2011-06-23 17:31:06 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-06-23 12:01
    .
    Pre-Run: 14,317,383,680 bytes free
    Post-Run: 14,243,508,224 bytes free
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    .
    - - End Of File - - DDB7C020C5C70856D49188A21436E7FB


    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


    (4)

    I ram GMER. It didn't show anything under Rootkit-Malware. So I disabled devices, no go.
    Ran it in safe mode.

    Got BLUE SCREEN STOP ERROR 0x000007B
    So I restarted in normal mode.

    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    (5)
    .
    DDS (Ver_2011-06-12.02) - NTFSx86
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26
    Run by Rammy at 17:47:16 on 2011-06-23
    Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1571 [GMT 5.5:30]
    .
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost.exe -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\MBlaze UI\bin\MonServiceUDisk.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\MBlaze UI\bin\App.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
    mStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.5.4.11.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\temp file cleaner db toolbar\tbcore3.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
    uPolicies-system: DisableTaskMgr = 1 (0x1)
    uPolicies-system: DisableRegistryTools = 1 (0x1)
    mPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
    mPolicies-system: EnableLUA = 0 (0x0)
    dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
    dPolicies-system: DisableTaskMgr = 1 (0x1)
    dPolicies-system: DisableRegistryTools = 1 (0x1)
    IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
    IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.5.4.11.dll/206
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
    TCP: Interfaces\{AB31D87D-B04D-43A7-903C-29E2E158B0E4} : NameServer = 10.216.254.140 10.216.254.141
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\documents and settings\rammy\application data\mozilla\firefox\profiles\xaevdg6j.default\
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [2009-9-23 308248]
    R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-5-1 181544]
    R2 UDisk Monitor;UDisk Monitor;c:\program files\mblaze ui\bin\MonServiceUDisk.exe [2007-4-27 512000]
    R3 amsint32;amsint32;\??\c:\windows\system32\drivers\rpggk.sys --> c:\windows\system32\drivers\rpggk.sys [?]
    R3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [2007-4-27 104704]
    S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
    .
    =============== Created Last 30 ================
    .
    2011-06-23 12:04:41 -------- d-----w- c:\documents and settings\rammy\application data\Toolbar4
    2011-06-23 11:54:07 -------- d-sha-r- C:\cmdcons
    2011-06-23 11:48:10 98816 ----a-w- c:\windows\sed.exe
    2011-06-23 11:48:10 518144 ----a-w- c:\windows\SWREG.exe
    2011-06-23 11:48:10 256512 ----a-w- c:\windows\PEV.exe
    2011-06-23 11:48:10 208896 ----a-w- c:\windows\MBR.exe
    2011-06-23 10:47:59 -------- d-----w- c:\windows\system32\wbem\Logs
    2011-06-22 17:47:28 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
    2011-06-22 17:24:20 -------- d-----w- c:\program files\Temp File Cleaner DB Toolbar
    2011-06-22 17:22:15 -------- d-----w- c:\program files\Temp File Cleaner
    2011-06-22 16:11:00 -------- d-----w- c:\program files\Avira
    2011-06-22 15:11:24 -------- d-----w- c:\program files\common files\ParetoLogic
    2011-06-22 15:11:23 -------- d-----w- c:\program files\ParetoLogic
    2011-06-22 14:13:42 -------- d-----w- c:\documents and settings\rammy\application data\DriverCure
    2011-06-22 14:13:41 -------- d-----w- c:\documents and settings\rammy\application data\ParetoLogic
    2011-06-22 14:13:30 -------- d-----w- c:\documents and settings\all users\application data\ParetoLogic
    2011-06-22 13:51:59 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
    2011-06-22 13:50:59 73832 -c--a-w- c:\windows\system32\dllcache\slcoinst.dll
    2011-06-22 13:49:59 92416 -c--a-w- c:\windows\system32\dllcache\phildec.sys
    2011-06-22 13:48:57 17280 -c--a-w- c:\windows\system32\dllcache\mraid35x.sys
    2011-06-22 13:47:58 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys
    2011-06-22 13:46:58 334208 -c--a-w- c:\windows\system32\dllcache\ds1wdm.sys
    2011-06-22 13:45:56 36480 -c--a-w- c:\windows\system32\dllcache\bthprint.sys
    2011-06-22 13:44:59 5248 -c--a-w- c:\windows\system32\dllcache\aliide.sys
    2011-06-22 10:48:38 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-06-22 10:48:38 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    2011-06-22 10:11:39 -------- d-----w- c:\windows\system32\appmgmt
    2011-06-22 03:43:37 -------- d-----w- c:\windows\BUVC_AP
    2011-06-21 17:35:11 -------- d-----w- c:\documents and settings\rammy\local settings\application data\Mozilla
    2011-06-21 17:32:50 -------- d-----w- c:\windows\SHELLNEW
    2011-06-21 17:32:12 -------- d-----w- c:\documents and settings\rammy\local settings\application data\Microsoft Help
    2011-06-21 17:25:47 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-06-21 17:25:28 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-06-21 14:44:19 -------- d-----w- c:\documents and settings\rammy\AppData
    2011-06-21 14:38:40 -------- d-----w- c:\documents and settings\rammy\local settings\application data\FLVService
    2011-06-21 14:38:37 -------- d-----w- c:\windows\Freecorder
    2011-06-21 14:31:20 -------- d-----w- c:\documents and settings\rammy\application data\BitComet
    2011-06-21 14:04:44 -------- d-----w- C:\Downloads
    2011-06-21 13:33:40 -------- d-----w- c:\program files\Seagate
    2011-06-21 13:33:40 -------- d-----w- c:\documents and settings\all users\application data\Seagate
    2011-06-21 13:32:37 -------- d-----w- c:\documents and settings\rammy\local settings\application data\Downloaded Installations
    2011-06-21 13:32:03 -------- d-sh--w- c:\windows\ftpcache
    2011-06-21 13:30:06 -------- d-----w- c:\program files\BitComet
    2011-06-21 13:29:31 -------- d-----w- c:\documents and settings\rammy\application data\TeraCopy
    2011-06-21 13:29:28 -------- d-----w- c:\program files\TeraCopy
    2011-06-21 12:38:28 -------- d-----w- c:\windows\system32\XPToolsLicenseComponent
    2011-06-21 12:38:28 -------- d-----w- c:\program files\XP Disk Cleaner
    2011-06-21 12:17:59 33104 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll
    2011-06-21 12:17:59 32592 ----a-w- c:\windows\system32\msonpmon.dll
    .
    ==================== Find3M ====================
    .
    2007-04-27 16:00:03 1275455 ----a-w- c:\program files\common files\unins000.exe
    .
    ============= FINISH: 17:47:49.93 ===============


    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

    (6)

    DDS ATTACH (Ver_2011-06-12.02)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 27/04/2007 21:32:07
    System Uptime: 23/06/2011 17:44:28 (0 hours ago)
    .
    Motherboard: Acer, Inc. | | Nestos
    Processor: Intel(R) Core(TM)2 Duo CPU T5250 @ 1.50GHz | U2E1 | 1499/166mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 24 GiB total, 13.262 GiB free.
    D: is FIXED (NTFS) - 59 GiB total, 28.898 GiB free.
    E: is FIXED (NTFS) - 66 GiB total, 37.211 GiB free.
    F: is CDROM ()
    G: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Modem Device on High Definition Audio Bus
    Device ID: HDAUDIO\FUNC_02&VEN_11C1&DEV_1040&SUBSYS_1025011D&REV_1002\4&23A3DF2F&0&0101
    Manufacturer:
    Name: Modem Device on High Definition Audio Bus
    PNP Device ID: HDAUDIO\FUNC_02&VEN_11C1&DEV_1040&SUBSYS_1025011D&REV_1002\4&23A3DF2F&0&0101
    Service:
    .
    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Base System Device
    Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4AF0
    Manufacturer:
    Name: Base System Device
    PNP Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4AF0
    Service:
    .
    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Base System Device
    Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4BF0
    Manufacturer:
    Name: Base System Device
    PNP Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4BF0
    Service:
    .
    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Base System Device
    Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4CF0
    Manufacturer:
    Name: Base System Device
    PNP Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4CF0
    Service:
    .
    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description:
    Device ID: ACPI\WEC1023\4&2FFE84EA&0
    Manufacturer:
    Name:
    PNP Device ID: ACPI\WEC1023\4&2FFE84EA&0
    Service:
    .
    ==== System Restore Points ===================
    .
    RP12: 22/06/2011 16:18:19 - Installed Java(TM) 6 Update 26
    RP13: 22/06/2011 20:43:53 - PC Health Advisor Backup
    RP14: 22/06/2011 22:51:30 - Removed Microsoft Visual C++ 2005 Redistributable
    RP15: 22/06/2011 23:15:52 - Installed WinZip 15.5
    RP16: 23/06/2011 00:23:35 - Removed Kaspersky Security Scan
    .
    ==== Installed Programs ======================
    .
    Acer Crystal Eye Webcam
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader X (10.0.1)
    Adobe Shockwave Player 11.5
    BitComet 1.27
    CCleaner
    DirectX 10 NE (New Edition)
    Intel(R) Graphics Media Accelerator Driver
    Java Auto Updater
    Java(TM) 6 Update 26
    MBlaze UI
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Software Update for Web Folders (English) 12
    Mozilla Firefox 5.0 (x86 en-US)
    ParetoLogic PC Health Advisor
    Realtek High Definition Audio Driver
    Seagate Manager Installer
    Temp File Cleaner
    Temp File Cleaner DB Toolbar
    TeraCopy 2.0 beta 4
    VLC media player 1.1.10
    WebFldrs XP
    WinZip 15.5
    XP Disk Cleaner 2.0
    .
    ==== Event Viewer Messages From Past Week ========
    .
    23/06/2011 17:24:34, error: Service Control Manager [7034] - The UDisk Monitor service terminated unexpectedly. It has done this 1 time(s).
    23/06/2011 16:11:39, error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
    22/06/2011 23:42:38, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible.
    22/06/2011 21:41:46, error: Service Control Manager [7034] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 3 time(s).
    22/06/2011 21:41:38, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    22/06/2011 21:41:30, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    22/06/2011 19:02:45, error: ztemtusbser [43] -
    22/06/2011 18:53:41, error: Service Control Manager [7000] - The amsint32 service failed to start due to the following error: The system cannot find the file specified.
    22/06/2011 18:48:23, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    22/06/2011 15:34:37, error: PlugPlayManager [11] - The device Root\LEGACY_AMSINT32\0000 disappeared from the system without first being prepared for removal.
    22/06/2011 09:17:48, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
    22/06/2011 09:17:44, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: iastor78
    21/06/2011 18:46:13, error: LDMS [3023] - The Logical Disk Manager Service failed while registering for device handle notifications on device \\?\usbstor#cdrom&ven_zte&prod_usb_storage_fff1&rev_2.31#000000000002&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}. Win32 Error: 2.
    21/06/2011 18:46:12, error: LDMS [3023] - The Logical Disk Manager Service failed while registering for device handle notifications on device \\?\storage#removablemedia#7&242f9386&0&rm#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}. Win32 Error: 2.
    .
    ==== End Of File ===========================

    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Unfortunately, with a confirmed Sality malware infection, I am recommending a reformat/reinstall.

    What the Sality malware is:
    This is the one exploiting the LNK Vulnerability- "currently unpatched Windows shortcut vulnerability". Microsoft reports a surge in related attack traffic generated by threats from the Sality family of malware.

    The virus also includes an autorun worm component that allows it to spread to any removable or discoverable drive. In addition, Sality includes a downloader Trojan component that installs additional malware via the Web.

    =====================================
    Why we recommend the reformat/reinstall:
    (Attributes for Bold text and color are mine)

    You will find excellent reformat/reinstall instructions here:
    http://www.tech-101.com/tutorials/356-tutorial-windows-install-repair-xp-vista.html
  3. ramneetneet

    ramneetneet Newcomer, in training Topic Starter

    Thanks Bobbye!

    I took your suggestion and re-installed windows today (had to get it first as my bootable CD wouldn't work). Although I didn't do a clean format because i had work files on my pc...and the mess wouldn't allow me to copy those to my external HDD.

    Now i have scanned the system with avira, mbam, superantispyware and removed the detected infections.

    Do you think i should some use other tools just to make sure things are okay?

    PS Couldn't find the log files.
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    You made a wise choice. However, if you want me to review the current entries, You're going to have to run the scans and leave the logs> I would suggest at least Malwarebytes, Eset onlin virus scan and Combofix as follows:

    [​IMG]
    Malwarebytes' Anti-Malware
    • Please download Malwarebytes' Anti-Malware from from HERE
    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to
      [o] Update Malwarebytes' Anti-Malware
      [o] and Launch Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform Quick scan, then click Scan.
      * When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please attach this log with your reply
      [o] If you accidentally close it, the log file is saved here and will be named like this:
      [o] C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    ========================
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESETOnlineScan
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      [o] Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
      [o] Double click on the [​IMG]on your desktop.
    • Check 'Yes I accept terms of use.'
    • Click Start button
    • Accept any security warnings from your browser.
      [​IMG]
    • Uncheck 'Remove found threats'
    • Check 'Scan archives/
    • Leave remaining settings as is.
    • Press the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    • When the scan completes, press List of found threats
    • Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    • Push the Back button
    • Push Finish

    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
    ==================================
    Please note: If you have Combofix on the desktop already, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    --------------------------------------
    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe & follow the prompts.
    • ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.

    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2: ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    Note 3: Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    Note 4: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    Note 5: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart computer to fix the issue.
    ===============================
    Please paste the 3 logs into your next reply.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.