TechSpot

Trojan problems

By dfmaus
Feb 15, 2011
  1. Hi,

    My antivirus scanner found a trojan on my computer. Here are my logs.

    Thanks for your help!

    ---------
    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5767

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18975

    15/02/2011 7:33:09 AM
    mbam-log-2011-02-15 (07-33-09).txt

    Scan type: Full scan (C:\|D:\|)
    Objects scanned: 378209
    Time elapsed: 2 hour(s), 4 minute(s), 25 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 2
    Registry Keys Infected: 0
    Registry Values Infected: 2
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 4

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    c:\Users\Diane\AppData\Local\dbinc3.dll (Trojan.Hiloti.Gen) -> Delete on reboot.
    c:\Users\Diane\AppData\Local\ujehunir.dll (Trojan.Agent.U) -> Delete on reboot.

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uziqazuko (Trojan.Hiloti.Gen) -> Value: Uziqazuko -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mreboza (Trojan.Agent.U) -> Value: Mreboza -> Delete on reboot.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\Users\Diane\AppData\Local\dbinc3.dll (Trojan.Hiloti.Gen) -> Delete on reboot.
    c:\Users\Diane\documents\my documents\my received files\downloads\adobe indesign cs2\keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
    c:\Users\Diane\documents\my documents\my received files\mathematicav5.2.0keygenagain\Keymaker.exe (Malware.Gen) -> Quarantined and deleted successfully.
    c:\Users\Diane\AppData\Local\ujehunir.dll (Trojan.Agent.U) -> Delete on reboot.


    ---------
    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2011-02-15 07:53:20
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.BBFO
    Running: u00e7mll.exe; Driver: C:\Users\Diane\AppData\Local\Temp\kxroiuoc.sys


    ---- Devices - GMER 1.0.15 ----

    Device \Driver\iaStor \Device\Ide\iaStor0 [8AA4BEB0] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\iaStor \Device\Ide\IAAStorageDevice-0 [8AA4BEB0] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\iaStor \Device\Ide\IAAStorageDevice-1 [8AA4BEB0] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
    Device \Driver\anoqt778 \Device\Scsi\anoqt7781 87893500
    Device \Driver\anoqt778 \Device\Scsi\anoqt7781Port2Path0Target0Lun0 87893500
    Device 85EE31F8
    Device Ntfs.sys (NT File System Driver/Microsoft Corporation)

    AttachedDevice \Driver\tdx \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
    AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
    AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----


    DDS (Ver_10-12-12.02) - NTFSx86
    Run by Diane at 7:53:37.28 on 15/02/2011
    Internet Explorer: 8.0.6001.18975 BrowserJavaVersion: 1.6.0_17
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3002.1404 [GMT -7:00]

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e2247046\STacSV.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\Hpservice.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Windows\system32\WLANExt.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e2247046\aestsrv.exe
    C:\Windows\system32\agrsmsvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
    C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
    C:\Windows\SMINST\BLService.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\VMware\VMware VDM\Client\bin\wsnm.exe
    C:\Windows\system32\taskeng.exe
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Symantec AntiVirus\VPTray.exe
    C:\Program Files\IDT\WDM\sttray.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Windows\explorer.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\system32\vssvc.exe
    C:\Windows\System32\svchost.exe -k swprv
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Users\Diane\Desktop\dds.scr
    C:\Windows\system32\conime.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=83&bd=Pavilion&pf=cnnb
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=83&bd=Pavilion&pf=cnnb
    uInternet Settings,ProxyOverride = *.local
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
    uRun: [Google Update] "c:\users\diane\appdata\local\google\update\GoogleUpdate.exe" /c
    uRun: [googletalk] c:\users\diane\appdata\roaming\google\google talk\googletalk.exe /autostart
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    uRun: [Mreboza] rundll32.exe "c:\users\diane\appdata\local\ujehunir.dll",Startup
    uRun: [Uziqazuko] rundll32.exe "c:\users\diane\appdata\local\dbinc3.dll",Startup
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
    mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" update "software\cyberlink\youcam\2.0"
    mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
    mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
    mRun: [OnScreenDisplay] c:\program files\hewlett-packard\hp quicktouch\HPKBDAPP.exe
    mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
    mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
    mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
    mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
    mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
    mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
    mRun: [SysTrayApp] c:\program files\idt\wdm\sttray.exe
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [IJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.EXE
    mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
    IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
    IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
    IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
    DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: igfxcui - igfxdev.dll
    mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\diane\appdata\roaming\mozilla\firefox\profiles\7g11ue1l.default\
    FF - plugin: c:\programdata\realarcade\npraclient.dll
    FF - plugin: c:\users\diane\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\users\diane\appdata\roaming\mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\users\diane\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: oldbar: {46868735-c3fa-47ce-8ce7-cce51a66aceb} - %profile%\extensions\{46868735-c3fa-47ce-8ce7-cce51a66aceb}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: XULRunner: {9199B4A3-54DC-40E6-8E36-F25C69C4CA28} - c:\users\diane\appdata\local\{9199B4A3-54DC-40E6-8E36-F25C69C4CA28}

    ============= SERVICES / DRIVERS ===============

    R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_e2247046\AEstSrv.exe [2009-3-2 81920]
    R2 hpsrv;HP Service;c:\windows\system32\hpservice.exe [2008-3-18 24880]
    R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\sminst\BLService.exe [2008-7-2 341328]
    R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-11-28 1962136]
    R2 wsnm;VMware VDM Client Service;c:\program files\vmware\vmware vdm\client\bin\wsnm.exe [2008-10-24 147456]
    R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-7-2 193840]
    R3 enecir;ENE CIR Receiver;c:\windows\system32\drivers\enecir.sys [2008-1-24 52736]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-6-2 102448]
    R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-6-4 113664]
    R3 WSUSBDMAN;VMware VDM Virtual Client USB Manager;c:\windows\system32\drivers\WSUSBDMAN.sys [2008-10-24 21504]
    S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
    S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-11-28 122008]
    S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-1-20 16896]

    =============== Created Last 30 ================

    2011-02-15 09:05:08 0 ----a-w- c:\users\diane\appdata\local\Llaci.bin
    2011-02-15 09:05:05 -------- d-----w- c:\users\diane\appdata\local\{9199B4A3-54DC-40E6-8E36-F25C69C4CA28}
    2011-02-15 08:42:05 5890896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{ce8d39d1-fea5-4185-b41d-2196ed971d8a}\mpengine.dll
    2011-01-17 07:08:29 -------- d-----w- c:\program files\Westward Kingdoms
    2011-01-17 06:57:44 -------- d-----w- c:\program files\bfgclient
    2011-01-17 06:54:28 -------- d-----w- C:\BigFishGamesCache

    ==================== Find3M ====================


    ============= FINISH: 7:54:08.97 ===============


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-12.02)

    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 01/08/2008 2:11:44 AM
    System Uptime: 15/02/2011 7:34:47 AM (0 hours ago)

    Motherboard: Quanta | | 3602
    Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz | CPU | 2267/1066mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 223 GiB total, 63.487 GiB free.
    D: is FIXED (NTFS) - 10 GiB total, 1.699 GiB free.
    E: is CDROM ()
    G: is CDROM ()

    ==== Disabled Device Manager Items =============

    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Microsoft ISATAP Adapter
    Device ID: ROOT\*ISATAP\0002
    Manufacturer: Microsoft
    Name: isatap.{03C8E499-89F5-4149-BF42-567814140F18}
    PNP Device ID: ROOT\*ISATAP\0002
    Service: tunnel

    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Microsoft ISATAP Adapter
    Device ID: ROOT\*ISATAP\0003
    Manufacturer: Microsoft
    Name: isatap.{03C8E499-89F5-4149-BF42-567814140F18}
    PNP Device ID: ROOT\*ISATAP\0003
    Service: tunnel

    ==== System Restore Points ===================


    ==== Installed Programs ======================

    Activation Assistant for the 2007 Microsoft Office suites
    Adobe Flash Player 10 Plugin
    Adobe Flash Player ActiveX
    Adobe InDesign CS2
    Adobe Photoshop 7.0
    Adobe Reader 9.4.0
    Adobe Shockwave Player
    Adobe Shockwave Player 11.5
    Age of Empires II - the Conquerors WideScreen Patcher
    Agere Systems HDA Modem
    AP Tuner 3.08
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Avanquest update
    Big Fish Games: Game Manager
    Bonjour
    BrettspielWelt
    Broadcom 802.11 Wireless LAN Adapter
    Canon IJ Network Scan Utility
    Canon IJ Network Tool
    Canon MP Navigator EX 2.0
    Canon MP620 series MP Drivers
    Canon Utilities Easy-PhotoPrint EX
    Canon Utilities My Printer
    Canon Utilities Solution Menu
    Cards_Calendar_OrderGift_DoMorePlugout
    CCleaner (remove only)
    Compatibility Pack for the 2007 Office system
    CyberLink DVD Suite
    CyberLink YouCam
    Derive 5
    DivX Codec
    DivX Version Checker
    Google Talk (remove only)
    Google Talk Plugin
    GPL Ghostscript 8.63
    Hewlett-Packard Active Check for Health Check
    Hewlett-Packard Asset Agent for Health Check
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    HP Active Support Library
    HP Customer Experience Enhancements
    HP Doc Viewer
    HP Easy Setup - Frontend
    HP Help and Support
    HP Integrated Module with Bluetooth wireless technology 6.0.1.6200
    HP MULTIPLE MODEM INSTALLER for VISTA
    HP Photosmart Essential 2.5
    HP Quick Launch Buttons 6.40 D1
    HP QuickPlay 3.7
    HP QuickTouch 1.00 D2
    HP Total Care Advisor
    HP Update
    HP User Guides 0102
    HP Wireless Assistant
    HPNetworkAssistant
    HPPhotoSmartDiscLabel_PaperLabel
    HPPhotoSmartDiscLabel_PrintOnDisc
    HPPhotoSmartDiscLabel_Tattoo
    HPPhotoSmartDiscLabelContent1
    hpphotosmartdisclabelplugin
    HPPhotoSmartPhotobookHolidayPack1
    HPPhotoSmartPhotobookModernPack1
    HPPhotoSmartPhotobookPlayfulPack1
    HPPhotoSmartPhotobookScrapbookPack1
    HPPhotoSmartPhotobookWebPack1
    IDT Audio
    iGadget 4.2.1.0
    ImageRescue3
    Intel(R) Graphics Media Accelerator Driver
    Intel® Matrix Storage Manager
    iTunes
    Java(TM) 6 Update 17
    Java(TM) 6 Update 5
    LabelPrint
    LightScribe System Software 1.12.33.2
    LiveUpdate 3.2 (Symantec Corporation)
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 3.5 SP1
    Microsoft Age of Empires II
    Microsoft Age of Empires II: The Conquerors Expansion
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Standard Edition 2003
    Microsoft Silverlight
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    MiKTeX 2.8
    mIRC
    Motorola Driver Installation 3.4.0
    Motorola Phone Tools
    Mozilla Firefox (3.6.13)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    My HP Games
    Network Viewer v2.2 (002)
    Power2Go
    PowerDirector
    ProtectSmart Hard Drive Protection
    PSSWCORE
    QuickPlay SlingPlayer 0.4.6
    QuickTime
    RealArcade
    Realtek 8169 8168 8101E 8102E Ethernet Driver
    Realtek USB 2.0 Card Reader
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    SightSpeed
    Skype Toolbars
    Skype™ 4.2
    Spelling Dictionaries Support For Adobe Reader 8
    Starcraft
    Symantec AntiVirus
    Synaptics Pointing Device Driver
    TeXnicCenter Version 1.0 Stable RC1
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    VideoToolkit01
    VLC media player 1.0.5
    VMware VDM Client
    Westward Kingdoms
    Windows Media Player Firefox Plugin
    WinRAR archiver
    WinZip

    ==== End Of File ===========================
     
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Welcome to TechSpot!
    Adobe InDesign cs2 and Mathematica v5.2.0 were pirated. They will have to be uninstalled to continue support. But before you do that, please run the following scan:.

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2

    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      :dir
      %programfiles% /n*keygen*
      &programfiles% /n*crack*
      %userprofile%\My Documents /s /n*keygen*
      &userprofile%\My Documents /s /n*crack*
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
  3. dfmaus

    dfmaus TS Rookie Topic Starter

    Hi,

    Here is my log:

    SystemLook 04.09.10 by jpshortstuff
    Log created at 19:26 on 15/02/2011 by Diane
    Administrator - Elevation successful

    ========== dir ==========

    C:\Program Files - Parameters: "/n*keygen*"

    ---Files---
    None found.

    ---Folders---
    Activation Assistant for the 2007 Microsoft Office suites d------ [20:46 30/12/2008]
    Adobe d------ [20:43 30/12/2008]
    AP Tuner d------ [01:43 07/09/2009]
    Apple Software Update d------ [00:24 31/12/2008]
    Avanquest update d------ [03:30 31/03/2009]
    AWS d------ [18:22 02/07/2008]
    bfgclient d------ [06:57 17/01/2011]
    Bonjour d------ [17:22 09/10/2010]
    Broadcom d------ [08:19 01/08/2008]
    BSW d------ [18:22 28/08/2010]
    Canon d------ [02:17 31/12/2008]
    CanonBJ d--h--- [02:17 31/12/2008]
    CCleaner d------ [23:14 02/06/2009]
    Common Files d------ [11:18 02/11/2006]
    CyberLink d------ [18:13 02/07/2008]
    DAEMON Tools Lite d------ [03:16 31/03/2009]
    DfW5Trial d------ [17:09 29/03/2010]
    DivX d------ [06:49 25/01/2009]
    DOSBox-0.72 d------ [13:32 01/09/2009]
    gs d------ [17:36 12/01/2009]
    Hewlett-Packard d------ [16:39 02/07/2008]
    HP d------ [17:00 02/07/2008]
    HP Games d------ [17:26 02/07/2008]
    IDT d------ [08:17 01/08/2008]
    InstallShield Installation Information d--h--- [16:43 02/07/2008]
    Intel d------ [08:20 01/08/2008]
    Internet Explorer d------ [11:18 02/11/2006]
    iPod d------ [07:00 14/11/2010]
    iTunes d------ [07:00 14/11/2010]
    Java d------ [18:30 02/07/2008]
    LexarMedia d------ [23:54 02/01/2009]
    LSI SoftModem d------ [17:07 22/05/2009]
    Malwarebytes' Anti-Malware d------ [16:14 06/01/2009]
    Microsoft ActiveSync d------ [22:56 30/12/2008]
    Microsoft Games d------ [12:37 02/11/2006]
    Microsoft Office d------ [20:44 30/12/2008]
    Microsoft Silverlight d------ [17:52 15/02/2010]
    Microsoft Works d------ [20:44 30/12/2008]
    Microsoft.NET d------ [22:56 30/12/2008]
    MiKTeX 2.8 d------ [00:55 13/04/2010]
    mIRC d------ [19:55 08/03/2010]
    Motorola Phone Tools d------ [03:24 31/03/2009]
    Movie Maker d------ [12:37 02/11/2006]
    Mozilla Firefox d------ [21:18 30/12/2008]
    MSBuild d------ [12:37 02/11/2006]
    MSXML 4.0 d------ [21:26 30/12/2008]
    NetworkViewer d------ [02:50 18/07/2009]
    Online Services dr----- [17:26 02/07/2008]
    Purple Ghost d------ [01:07 31/12/2008]
    QuickTime d------ [17:24 09/10/2010]
    RealArcade d------ [18:25 22/05/2009]
    Realtek d------ [08:19 01/08/2008]
    Reference Assemblies d------ [12:37 02/11/2006]
    ReflexiveArcade d------ [19:04 28/05/2009]
    SightSpeed d------ [00:36 31/12/2008]
    Skype dr----- [21:43 30/12/2008]
    Starcraft d------ [01:21 27/03/2010]
    Symantec d------ [00:47 30/05/2009]
    Symantec AntiVirus d------ [00:46 30/05/2009]
    Synaptics d------ [08:15 01/08/2008]
    TeXnicCenter d------ [00:27 02/09/2010]
    The Island - Castaway d------ [21:47 23/10/2010]
    Trend Micro d------ [01:22 03/06/2009]
    Uninstall Information d--h--- [13:01 02/11/2006]
    VideoLAN d------ [03:57 28/03/2010]
    VMware d------ [23:38 14/03/2010]
    Westward Kingdoms d------ [07:08 17/01/2011]
    WIDCOMM d------ [08:22 01/08/2008]
    Windows Calendar d------ [12:37 02/11/2006]
    Windows Collaboration d------ [12:37 02/11/2006]
    Windows Defender d------ [12:37 02/11/2006]
    Windows Journal d------ [12:37 02/11/2006]
    Windows Mail d------ [11:18 02/11/2006]
    Windows Media Player d------ [12:37 02/11/2006]
    Windows NT d------ [11:18 02/11/2006]
    Windows Photo Gallery d------ [12:37 02/11/2006]
    Windows Portable Devices d------ [20:05 20/02/2010]
    Windows Sidebar d------ [12:37 02/11/2006]
    WinRAR d------ [21:11 23/02/2009]
    WinZip d------ [00:50 31/12/2008]
    Yahoo! d------ [18:22 02/07/2008]

    &programfiles% - Unable to find folder.

    C:\Users\Diane\My Documents - Parameters: "/s /n*keygen*"

    ---Files---
    None found.

    No folders found.

    &userprofile%\My Documents - Unable to find folder.

    -= EOF =-
     
  4. dfmaus

    dfmaus TS Rookie Topic Starter

    Sorry, did you want me to uninstall the programs before further help?
     
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Yes, please do this:
    ======================================
    After the uninstalls above:
    Download Combofix to your desktop from one of these locations:
    Link 1
    Link 2
    • Double click combofix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Query- Recovery Console image
      [​IMG]
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes it will open a text window. Please paste that log in your next reply.
    Re-enable your Antivirus software.
    Notes:
    1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
     
  6. dfmaus

    dfmaus TS Rookie Topic Starter

    It didn't prompt me about the recovery console at all. I hope that's not a problem.

    Here is the log:

    ComboFix 11-02-19.02 - Diane 19/02/2011 22:04:44.2.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3002.1510 [GMT -7:00]
    Running from: c:\users\Diane\Desktop\ComboFix.exe
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\users\Diane\AppData\Local\{9199B4A3-54DC-40E6-8E36-F25C69C4CA28}
    c:\users\Diane\AppData\Local\{9199B4A3-54DC-40E6-8E36-F25C69C4CA28}\chrome.manifest
    c:\users\Diane\AppData\Local\{9199B4A3-54DC-40E6-8E36-F25C69C4CA28}\chrome\content\_cfg.js
    c:\users\Diane\AppData\Local\{9199B4A3-54DC-40E6-8E36-F25C69C4CA28}\chrome\content\overlay.xul
    c:\users\Diane\AppData\Local\{9199B4A3-54DC-40E6-8E36-F25C69C4CA28}\install.rdf
    c:\windows\system32\gxvxccount

    .
    ((((((((((((((((((((((((( Files Created from 2011-01-20 to 2011-02-20 )))))))))))))))))))))))))))))))
    .

    2011-02-20 05:09 . 2011-02-20 05:09 -------- d-----w- c:\users\Don\AppData\Local\temp
    2011-02-20 05:09 . 2011-02-20 05:09 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-02-15 09:05 . 2011-02-15 09:05 0 ----a-w- c:\users\Diane\AppData\Local\Llaci.bin
    2011-02-15 08:42 . 2011-01-13 09:41 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CE8D39D1-FEA5-4185-B41D-2196ED971D8A}\mpengine.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-21 01:09 . 2009-01-06 16:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-21 01:08 . 2009-01-06 16:14 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
    "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
    "Google Update"="c:\users\Diane\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-09-22 133104]
    "googletalk"="c:\users\Diane\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-18 150040]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-18 170520]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-18 145944]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
    "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-04-24 468264]
    "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]
    "OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-02 554288]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
    "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
    "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
    "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752]
    "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
    "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-22 107112]
    "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-11-28 134808]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-07-22 458844]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-10 421160]
    "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-21 124512]
    "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-21 963976]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-6 113664]
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-03-26 341328]
    R3 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-11-28 122008]
    R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
    S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-03-31 717296]
    S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_e2247046\aestsrv.exe [2009-03-03 81920]
    S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-08-07 24880]
    S2 wsnm;VMware VDM Client Service;c:\program files\VMware\VMware VDM\Client\bin\wsnm.exe [2008-10-24 147456]
    S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-02-07 193840]
    S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-01-24 52736]
    S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-06-01 102448]
    S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-06-04 113664]
    S3 WSUSBDMAN;VMware VDM Virtual Client USB Manager;c:\windows\system32\DRIVERS\WSUSBDMAN.sys [2008-10-24 21504]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2008-02-26 21:06 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-99673210-879210644-3032756696-1000Core.job
    - c:\users\Diane\AppData\Local\Google\Update\GoogleUpdate.exe [2009-09-22 04:09]

    2011-02-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-99673210-879210644-3032756696-1000UA.job
    - c:\users\Diane\AppData\Local\Google\Update\GoogleUpdate.exe [2009-09-22 04:09]

    2011-02-20 c:\windows\Tasks\User_Feed_Synchronization-{C204FA55-91A9-4AC3-AE43-DB5883BF6D97}.job
    - c:\windows\system32\msfeedssync.exe [2010-10-13 04:25]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=83&bd=Pavilion&pf=cnnb
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=83&bd=Pavilion&pf=cnnb
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    FF - ProfilePath - c:\users\Diane\AppData\Roaming\Mozilla\Firefox\Profiles\7g11ue1l.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: oldbar: {46868735-c3fa-47ce-8ce7-cce51a66aceb} - %profile%\extensions\{46868735-c3fa-47ce-8ce7-cce51a66aceb}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-Mreboza - c:\users\Diane\AppData\Local\ujehunir.dll
    HKCU-Run-Uziqazuko - c:\users\Diane\AppData\Local\dbinc3.dll
    AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel
    AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-19 22:09
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2011-02-19 22:10:58
    ComboFix-quarantined-files.txt 2011-02-20 05:10
    ComboFix2.txt 2009-06-03 15:53

    Pre-Run: 69,397,262,336 bytes free
    Post-Run: 69,679,271,936 bytes free

    - - End Of File - - 1F6CE33A0E0261A93A4BFB9769E1117A
     
  7. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Combofix won't ask if you already have the Windows Recovery Console installed

    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
    Code:
    File::
    Extra::
    File::
    c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    Firefox::
    Firefox-: - Profile- c:\users\diane\appdata\roaming\mozilla\firefox\profiles\7g11ue1l.default\
    DDS::
    uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=83&bd=Pavilion&pf=cnnb
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=83&bd=Pavilion&pf=cnnb
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=-
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=-
    
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
    ====================
    Please update the Java to current v6u23: Check this site .Java Updates Uninstall any earlier versions in Add/Remove Programs as they are vulnerabilities for the system. I see v6u5, u13, u17. Remove any other older versions also if any.

    Note: You do not need to add a separate extension for Java in Firefox.
    =====================
    Please repeat the Eset scan.
     
  8. dfmaus

    dfmaus TS Rookie Topic Starter

    The first time I ran this script, I accidentally closed the log file before copying it, and I couldn't find it saved anywhere. I ran it again, which is what this log file is from.

    I updated Java, but only u5 was in my Add/Remove Programs. I uninstalled that though.

    What is Eset? I don't think I've run that.

    Thanks

    -----------------
    ComboFix 11-02-20.01 - Diane 20/02/2011 12:58:07.5.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3002.1459 [GMT -7:00]
    Running from: c:\users\Diane\Desktop\ComboFix.exe
    Command switches used :: c:\users\Diane\Desktop\CFScript.txt
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    FILE ::
    "c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}"
    "c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}"
    .

    ((((((((((((((((((((((((( Files Created from 2011-01-20 to 2011-02-20 )))))))))))))))))))))))))))))))
    .

    2011-02-20 20:01 . 2011-02-20 20:01 -------- d-----w- c:\users\Don\AppData\Local\temp
    2011-02-20 20:01 . 2011-02-20 20:01 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-02-15 09:05 . 2011-02-15 09:05 0 ----a-w- c:\users\Diane\AppData\Local\Llaci.bin
    2011-02-15 08:42 . 2011-01-13 09:41 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CE8D39D1-FEA5-4185-B41D-2196ED971D8A}\mpengine.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-21 01:09 . 2009-01-06 16:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-21 01:08 . 2009-01-06 16:14 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
    "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
    "Google Update"="c:\users\Diane\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-09-22 133104]
    "googletalk"="c:\users\Diane\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-18 150040]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-18 170520]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-18 145944]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
    "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-04-24 468264]
    "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]
    "OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-02 554288]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
    "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
    "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
    "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752]
    "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
    "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-22 107112]
    "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-11-28 134808]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-07-22 458844]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-10 421160]
    "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-21 124512]
    "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-21 963976]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-6 113664]
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-03-26 341328]
    R3 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-11-28 122008]
    R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
    S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-03-31 717296]
    S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_e2247046\aestsrv.exe [2009-03-03 81920]
    S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-08-07 24880]
    S2 wsnm;VMware VDM Client Service;c:\program files\VMware\VMware VDM\Client\bin\wsnm.exe [2008-10-24 147456]
    S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-02-07 193840]
    S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-01-24 52736]
    S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-06-01 102448]
    S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-06-04 113664]
    S3 WSUSBDMAN;VMware VDM Virtual Client USB Manager;c:\windows\system32\DRIVERS\WSUSBDMAN.sys [2008-10-24 21504]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2008-02-26 21:06 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-99673210-879210644-3032756696-1000Core.job
    - c:\users\Diane\AppData\Local\Google\Update\GoogleUpdate.exe [2009-09-22 04:09]

    2011-02-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-99673210-879210644-3032756696-1000UA.job
    - c:\users\Diane\AppData\Local\Google\Update\GoogleUpdate.exe [2009-09-22 04:09]

    2011-02-20 c:\windows\Tasks\User_Feed_Synchronization-{C204FA55-91A9-4AC3-AE43-DB5883BF6D97}.job
    - c:\windows\system32\msfeedssync.exe [2010-10-13 04:25]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    FF - ProfilePath - c:\users\Diane\AppData\Roaming\Mozilla\Firefox\Profiles\7g11ue1l.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: oldbar: {46868735-c3fa-47ce-8ce7-cce51a66aceb} - %profile%\extensions\{46868735-c3fa-47ce-8ce7-cce51a66aceb}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-20 13:02
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'Explorer.exe'(5684)
    c:\windows\system32\btmmhook.dll
    .
    Completion time: 2011-02-20 13:03:17
    ComboFix-quarantined-files.txt 2011-02-20 20:03
    ComboFix2.txt 2011-02-20 19:47
    ComboFix3.txt 2011-02-20 05:10
    ComboFix4.txt 2009-06-03 15:53

    Pre-Run: 69,183,426,560 bytes free
    Post-Run: 69,148,487,680 bytes free

    - - End Of File - - 4683D6CE84FA426DD697BC6B0B5DB4AB
     
  9. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    No, you haven't run the Eset Online Virus scan. Sorry- I was thinking about the keygen entry but it was in Mbam.

    Run Eset NOD32 Online AntiVirus scan HERE
    1. Tick the box next to YES, I accept the Terms of Use.
    2. Click Start
    3. When asked, allow the Active X control to install
    4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    5. Click Start
    6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    7. Click Scan
    8. Wait for the scan to finish
    9. Click on "Copy to Clipboard"> (you won't see the 'clipboard)
    10. Click anywhere in the post where you want the logs to go, the do Ctrl V. The log will be sent from the clipboard and pasted in the post.
    11. Re-enable your Antivirus software.
      NOTE: If you forget to copy to the clipboard, you can find the log here:
      C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

    Go ahead and run that. I'm going to take a dinner break, then I'll review Combofix and the Eset log too if you've had time to run it.
     
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    I'm going to wait for the log from the Eset scan. Hopefully I can finish you up.

    When you ran the Norton scan and it found the Trojan, what did you do?
     
  11. dfmaus

    dfmaus TS Rookie Topic Starter

    Norton quarantined the Trojan, but didn't delete it or anything. I personally didn't do anything.

    Here is the Eset log

    Thanks as always!

    ----------------------
    ESETSmartInstaller@High as downloader log:
    all ok
    # version=7
    # OnlineScannerApp.exe=1.0.0.1
    # OnlineScanner.ocx=1.0.0.6419
    # api_version=3.0.2
    # EOSSerial=7d5c435df6a8f541837c88245b013ee9
    # end=finished
    # remove_checked=false
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=false
    # antistealth_checked=true
    # utc_time=2011-02-21 01:52:12
    # local_time=2011-02-20 06:52:12 (-0700, Mountain Standard Time)
    # country="Canada"
    # lang=1033
    # osver=6.0.6002 NT Service Pack 2
    # compatibility_mode=512 16777215 100 0 53334858 53334858 0 0
    # compatibility_mode=5892 16776637 100 100 0 134856146 0 0
    # compatibility_mode=8192 67108863 100 0 0 0 0 0
    # scanned=229657
    # found=0
    # cleaned=0
    # scan_time=4514
    ESETSmartInstaller@High as downloader log:
    all ok
    esets_scanner_update returned -1 esets_gle=53251
     
  12. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    When Norton quarantines an entry, it is no longer active in the system. The Eset scan is clean.

    You have an antivirus program to do just what Norton did. That alone is not a reason to think you have other malware- especially in the absense of any problems.

    I'd like you to run this Security Check> Download Security Check by screen317 from HERE or HERE .
    • Save it to your Desktop.
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
     
  13. dfmaus

    dfmaus TS Rookie Topic Starter

    Okay, thanks for checking. So in the future, I shouldn't be worried unless my computer is acting up?

    Here is the log.

    --------
    Results of screen317's Security Check version 0.99.8
    Windows Vista Service Pack 2 (UAC is enabled)
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    ESET Online Scanner v3
    Symantec AntiVirus
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    CCleaner (remove only)
    Java(TM) 6 Update 24
    Out of date Java installed!
    Adobe Flash Player 10.1.102.64
    Adobe Reader 9.4.0
    Out of date Adobe Reader installed!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Norton ccSvcHst.exe
    Symantec AntiVirus DefWatch.exe
    Symantec AntiVirus Rtvscan.exe
    Symantec AntiVirus VPTray.exe
    ``````````End of Log````````````
     
  14. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    If your AV program finds malware and quarantines it, it is doing what it's suppose to do. Ideally, an AV would also prevent some malware from getting into a system, but sometimes malware will be bundled in a program you download or you go to a site that has script that could infect the system.

    Once in Quaratine, the file or folder can be deleted and it's a good idea to follow that up with a new AV scan. But if you are not experiencing any problems, you should have confidnce that the AV is doing it's job. If you ever have doubts, come over and let us check the scans for you.

    I am confident that you got the malware from pirating. You want something free that is suppose to be paid for and you get a license number from a torrent site>>> count on getting malware every time!
    Removing all of the tools we used and the files and folders they created
    • Uninstall ComboFix and all Backups of the files it deleted
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [​IMG]
    • Download OTCleanIt by OldTimer and save it to your Desktop.
    • Double click OTCleanIt.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.
    Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.
    • You should now set a new Restore Point and remove the old restore points to prevent infection from any previous Restore Points.
    • Go to Start > All Programs > Accessories > System Tools
    • Click "System Restore".
    • Choose "Create a Restore Point" on the first screen then click "Next".
    • Give the Restore Point a name> click "Create".
    • Go back and follow the path to > System Tools.
      [*]Choose Disc Cleanup
      [*]Click "OK" to select the partition or drive you want.
      [*]Click the "More Options" Tab.
      [*]Click "Clean Up" in the System Restore section to remove all previous Restore Points except the newly created one.

    Empty the Recycle Bin
    ==========================================
    You also need more and better security:
    Tips for added security and safer browsing:
    1. Browser Security Settings: Custom is fine if the user did the settings. Mine are Custom. Default is okay too, but sometimes too restrictive.
      This Tutorial will help guide you through Configuring Security Settings, Managing Active X Controls and other safety features: Make Internet Explorer safer.
    2. Have layered Security:
      • Antivirus Software(only one):Both of the following programs are free and known to be good:
        [o]Avira-AntiVir-Personal-Free-Antivirus
        [o]Avast Free Version

        [o]Avira Free
        [o]Avast Home
      • Firewall (only one): Use bi-directional firewall. Both of the following programs are free and known to be good:
        [o]Comodo
        [o]Zone Alarm
      • Antispyware: I recommend all of the following:
        [o]Spywareblaster: SpywareBlaster protects against bad ActiveX. It places kill bits to stop bad Active X controls from being installed. Remember to update it regularly.
      [o]Download ZonedOut and save to your desktop. this replaces IE/Spyad and manages the Zones in Internet explorer. This places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
      For IE7 and IE8, Windows 2000 thru Vista. No Windows 7 yet.
      IE/Spyad is not longer being supported. If you have this on your system, you should replace it with the following program. Make sure your IE8 is Up-to-date before adding sites to your restricted zone.
      Known issue: If you have "immunized" your computer with Spybot Search and Destroy, and use ZonedOut to "Remove All" restricted sites - ZonedOut will remove your trusted sites as well. Note that if you remove Spybot Search and Destroys Immunization the problem goes away...
      [o]Replace the Host Files
      MVPS Hosts files This replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
      [o]Google Toolbar Get the free google toolbar to help stop pop up windows.
    3. Stay current on updates:
      [o] Visit the Microsoft Download Sitefrequently. You should get All updates marked Critical and the current SP updates.
      [o]Visit this Adobe Reader site often and make sure you have the most current update. Uninstall any earlier updates as they are vulnerabilities.
      [o]Check this site .Java Updates Stay current as most updates are for security. Uninstall any earlier versions in Add/Remove Programs.
    4. Reset Cookies to prevent Tracking Cookies:
      [o]For Internet Explorer: Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> check 'override automatic Cookie handling'> check 'accept first party Cookies'> check 'Block third party Cookies'> check 'allow per session Cookies'> Apply> OK.
      [o]For Firefox: Tools> Options> Privacy> Cookies> check ‘accept Cookies from Sites’> Uncheck 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others. (Note: for Firefox v3.5, after Privacy click on 'use custom settings for History.')
      I suggest using the following two add-on for Firefox. They will prevent the Tracking Cookies that come from ads and banners and other sources:
      AdBlock Plus
      Easy List
    5. Do regular Maintenance
      Remove Temporary Internet Files regularly:
      [o]ATF Cleaner by Atribune
      OR
      [o]TFC
      Disable and Enable System Restore:
      [o]See System Restore Guide This will help you understand what this is, why you need to clean and set restore points and what information is in them.
    6. Practice Safe Email Handling
      [o] Don't open email from anyone you don't know.
      [o] Don't open Attachments in the email. Safe to your desktop and scan for viruses using a right click
      [o] Don't leave your personal email address on the internet. Have a separate email account at one of the free web-based emails like Yahoo.
    Use a Site Advisor: Choose only the Green!
    The Web of Trust (WOT) add-on is a safe surfing tool for your browser. Traffic-light rating symbols show which rate the site for Trustworthiness, Vendor Reliability, Privacy, Child Safety.Your online email account – Google Mail, Yahoo! Mail and Hotmail is also protected.http://www.mywot.com/en/download
     
  15. dfmaus

    dfmaus TS Rookie Topic Starter

    Ok, thanks very much for all your help!
     
  16. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    You're very welcome!
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...