TechSpot

Virus problem - logonui.exe, problems with logging on, freezing, browser not working

By gotheswannies
Mar 12, 2011
  1. I believe I have a virus, initially a pop up came up saying I had a virus and that I should instal their virus "protection" program. This was followed by being unable to log on without going in safe mode. My computer was continually freezing, I can't get onto the internet, I have a connection, I can download updates etc but my browser isn't working.

    •Malwarebytes Anti-Malware log


    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6032

    Windows 6.1.7600
    Internet Explorer 8.0.7600.16385

    12/03/2011 9:08:18 PM
    mbam-log-2011-03-12 (21-08-18).txt

    Scan type: Quick scan
    Objects scanned: 166175
    Time elapsed: 2 minute(s), 0 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 4
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\g043oqxanu (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\JRMX9X1GML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\ZE18MW23GY (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    ----------------------------------------------

    •GMER log

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit scan 2011-03-12 22:16:45
    Windows 6.1.7600
    Running: gmerrrrrr.exe


    ---- Registry - GMER 1.0.15 ----

    Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@F:\Appz\CloneDVD\x2122 2\SetupCloneDVD2922Slysoft.exe 1
    Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@F:\Appz\CloneDVD\x2122 2\DVD43 Might be needed, so DL also\DVD43_4-4-1_Setup.exe 1

    ---- EOF - GMER 1.0.15 ----

    --------------------------------------------------


    •DDS logs:
    DDS.txt


    .
    DDS (Ver_11-03-05.01) - NTFS_AMD64
    Run by Danny at 22:18:35.40 on Sat 12/03/2011
    Internet Explorer: 8.0.7600.16385
    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.61.1033.18.4091.2701 [GMT 11:00]
    .
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\atieclxx.exe
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
    C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
    C:\Program Files (x86)\Eset\nod32krn.exe
    C:\Windows\SysWOW64\WinService.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files (x86)\Canon\CAL\CALMAIN.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Users\Danny\Program Files (x86)\DNA\btdna.exe
    C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files (x86)\Eset\nod32kui.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files (x86)\NETGEAR\WG111v2\WG111v2.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\system32\svchost.exe -k SDRSVC
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Users\Danny\Desktop\dds.scr
    C:\Windows\system32\conhost.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.smh.com.au/
    uInternet Settings,ProxyOverride = <local>
    uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
    mWinlogon: Userinit=userinit.exe,
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    BHO: MediaBar: {0974ba1e-64ec-11de-b2a5-e43756d89593} - C:\PROGRA~2\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
    BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.7.16.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
    BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB: MediaBar: {0974ba1e-64ec-11de-b2a5-e43756d89593} - C:\PROGRA~2\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
    TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
    TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
    uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
    uRun: [BitTorrent DNA] "C:\Users\Danny\Program Files (x86)\DNA\btdna.exe"
    mRun: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
    mRun: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
    mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
    mRun: [dvd43] C:\Program Files (x86)\dvd43\dvd43_tray.exe
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [nod32kui] "C:\Program Files (x86)\Eset\nod32kui.exe" /WAITSERVICE
    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NETGEA~1.LNK - C:\Program Files (x86)\NETGEAR\WG111v2\WG111v2.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: &D&ownload &with BitComet - C:\Program Files (x86)\BitComet\BitComet.exe/AddLink.htm
    IE: &D&ownload all video with BitComet - C:\Program Files (x86)\BitComet\BitComet.exe/AddVideo.htm
    IE: &D&ownload all with BitComet - C:\Program Files (x86)\BitComet\BitComet.exe/AddAllLink.htm
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
    IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.7.16.dll/206
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
    LSP: C:\Windows\system32\imon.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
    BHO-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    TB-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    TB-X64: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
    TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
    mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 SCMNdisP;General NDIS Protocol Driver;C:\Windows\System32\drivers\SCMNdisP.sys [2009-12-5 25312]
    R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-3-4 505176]
    R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2011-3-4 280408]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-9-20 203264]
    R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2011-3-4 22360]
    R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2011-3-4 64344]
    R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-3-4 42184]
    R2 BCUService;Browser Configuration Utility Service;C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-11-30 219360]
    R2 NOD32krn;NOD32 Kernel Service;C:\Program Files (x86)\ESET\nod32krn.exe [2011-2-14 552064]
    R2 SCM_Service;SCM_Service;C:\Windows\SysWOW64\WinService.exe [2009-12-5 180224]
    R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2010-9-20 7195648]
    R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2010-9-20 265728]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-11-30 236544]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-2-17 48488]
    S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
    S3 nmwcdx64;Nokia USB Phone Parent;C:\Windows\System32\drivers\ccdcmbx64.sys [2008-5-2 18432]
    S3 RTL8187;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter Vista Driver;C:\Windows\System32\drivers\wg111v2.sys [2007-12-26 340992]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-9-28 51712]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-3-6 1255736]
    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
    .
    =============== Created Last 30 ================
    .
    2011-03-12 09:56:30 -------- d-----w- C:\Users\Danny\AppData\Roaming\Malwarebytes
    2011-03-12 09:55:53 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-03-12 09:55:52 -------- d-----w- C:\PROGRA~3\Malwarebytes
    2011-03-12 09:55:48 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2011-03-12 09:55:48 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-03-12 06:52:51 -------- d-----w- C:\Users\Danny\AppData\Local\Threat Expert
    2011-03-12 06:32:44 -------- d-----w- C:\PROGRA~3\PC Tools
    2011-03-04 04:27:28 505176 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
    2011-03-04 04:27:27 64344 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
    2011-03-04 04:27:22 40648 ----a-w- C:\Windows\avastSS.scr
    2011-03-04 04:27:21 -------- d-----w- C:\Program Files\AVAST Software
    2011-03-04 04:27:21 -------- d-----w- C:\PROGRA~3\AVAST Software
    2011-03-03 08:00:49 -------- d--h--w- C:\$AVG
    2011-03-03 07:13:38 -------- d-----w- C:\Users\Danny\AppData\Roaming\AVG10
    2011-03-03 07:12:29 -------- d--h--w- C:\PROGRA~3\Common Files
    2011-03-03 07:11:21 -------- d-----w- C:\Windows\System32\drivers\AVG
    2011-03-03 07:11:21 -------- d-----w- C:\PROGRA~3\AVG10
    2011-03-03 07:10:54 -------- d-----w- C:\Program Files (x86)\AVG
    2011-03-03 07:06:32 -------- d-----w- C:\PROGRA~3\MFAData
    2011-03-03 06:31:25 7947600 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{46BEF5C1-41A8-4F08-A201-D17F9C130023}\mpengine.dll
    2011-02-23 16:01:02 367104 ----a-w- C:\Windows\System32\wcncsvc.dll
    2011-02-23 16:01:02 276992 ----a-w- C:\Windows\SysWow64\wcncsvc.dll
    2011-02-23 12:32:33 662528 ----a-w- C:\Windows\System32\XpsPrint.dll
    2011-02-23 12:32:33 475648 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
    2011-02-23 12:32:33 442880 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
    2011-02-23 12:32:33 288256 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
    2011-02-19 16:01:07 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%
    2011-02-17 12:55:09 -------- d-----w- C:\Windows\en
    2011-02-17 12:54:21 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
    2011-02-17 12:52:59 48488 ----a-w- C:\Windows\System32\drivers\fssfltr.sys
    2011-02-17 12:52:03 69464 ----a-w- C:\Windows\SysWow64\XAPOFX1_3.dll
    2011-02-17 12:52:03 523088 ----a-w- C:\Windows\System32\d3dx10_42.dll
    2011-02-17 12:52:03 515416 ----a-w- C:\Windows\SysWow64\XAudio2_5.dll
    2011-02-17 12:52:03 453456 ----a-w- C:\Windows\SysWow64\d3dx10_42.dll
    2011-02-17 12:51:58 4398360 ----a-w- C:\Windows\System32\d3dx9_32.dll
    2011-02-17 12:51:58 3426072 ----a-w- C:\Windows\SysWow64\d3dx9_32.dll
    2011-02-17 12:21:19 469256 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\2ce2edf11cbce9d2f\InstallManager_WLE_WLE.exe
    2011-02-17 12:21:00 15712 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\22c88fa41cbce9d24\MeshBetaRemover.exe
    2011-02-17 12:20:45 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\193f26c41cbce9d1c\DXSETUP.exe
    2011-02-17 12:20:44 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\193f26c41cbce9d1c\DSETUP.dll
    2011-02-17 12:20:44 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\193f26c41cbce9d1c\dsetup32.dll
    2011-02-17 12:20:43 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\184c894e1cbce9d1b\DSETUP.dll
    2011-02-17 12:20:43 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\184c894e1cbce9d1b\DXSETUP.exe
    2011-02-17 12:20:43 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\184c894e1cbce9d1b\dsetup32.dll
    2011-02-17 12:20:16 6260088 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\85947571cbce9d0f\Silverlight.4.0.exe
    2011-02-17 12:19:48 -------- d-----w- C:\Users\Danny\AppData\Local\Windows Live
    2011-02-15 07:25:03 -------- d-----w- C:\PROGRA~3\DivX
    2011-02-14 10:39:59 468024 ----a-w- C:\Windows\System32\imon.dll
    2011-02-14 10:39:59 298104 ----a-w- C:\Windows\SysWow64\imon.dll
    2011-02-14 10:39:59 146704 ----a-w- C:\Windows\System32\drivers\amon.sys
    2011-02-14 09:57:07 -------- d-----w- C:\Users\Danny\AppData\Local\ElevatedDiagnostics
    2011-02-13 11:34:22 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
    2011-02-13 11:34:22 -------- d-----w- C:\PROGRA~3\Spybot - Search & Destroy
    .
    ==================== Find3M ====================
    .
    2011-02-02 06:11:20 270720 ------w- C:\Windows\System32\MpSigStub.exe
    2011-01-26 06:53:10 982912 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
    2011-01-26 06:53:10 265088 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys
    2011-01-26 06:31:20 144384 ----a-w- C:\Windows\System32\cdd.dll
    2011-01-07 08:06:50 46080 ----a-w- C:\Windows\System32\atmlib.dll
    2011-01-07 07:27:11 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
    2011-01-07 05:49:20 366080 ----a-w- C:\Windows\System32\atmfd.dll
    2011-01-07 05:33:11 294400 ----a-w- C:\Windows\SysWow64\atmfd.dll
    2011-01-05 06:20:30 612352 ----a-w- C:\Windows\System32\vbscript.dll
    2011-01-05 05:37:33 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2011-01-05 04:00:16 3127808 ----a-w- C:\Windows\System32\win32k.sys
    2010-12-21 06:16:27 97280 ----a-w- C:\Windows\System32\wscsvc.dll
    2010-12-21 06:16:27 62976 ----a-w- C:\Windows\System32\wscapi.dll
    2010-12-21 06:16:16 214016 ----a-w- C:\Windows\System32\winsrv.dll
    2010-12-21 06:16:14 442880 ----a-w- C:\Windows\System32\winhttp.dll
    2010-12-21 06:16:14 1197056 ----a-w- C:\Windows\System32\wininet.dll
    2010-12-21 06:16:09 258048 ----a-w- C:\Windows\System32\WebClnt.dll
    2010-12-21 06:15:55 264192 ----a-w- C:\Windows\System32\upnp.dll
    2010-12-21 06:15:31 15360 ----a-w- C:\Windows\System32\slwga.dll
    2010-12-21 06:13:03 2003968 ----a-w- C:\Windows\System32\msxml6.dll
    2010-12-21 06:13:03 1880576 ----a-w- C:\Windows\System32\msxml3.dll
    2010-12-21 06:10:22 100864 ----a-w- C:\Windows\System32\davclnt.dll
    2010-12-21 05:38:24 51200 ----a-w- C:\Windows\SysWow64\wscapi.dll
    2010-12-21 05:38:22 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
    2010-12-21 05:38:22 350720 ----a-w- C:\Windows\SysWow64\winhttp.dll
    2010-12-21 05:38:21 204800 ----a-w- C:\Windows\SysWow64\WebClnt.dll
    2010-12-21 05:38:19 204288 ----a-w- C:\Windows\SysWow64\upnp.dll
    2010-12-21 05:38:16 14336 ----a-w- C:\Windows\SysWow64\slwga.dll
    2010-12-21 05:36:17 1389568 ----a-w- C:\Windows\SysWow64\msxml6.dll
    2010-12-21 05:36:16 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll
    2010-12-21 05:34:12 80384 ----a-w- C:\Windows\SysWow64\davclnt.dll
    2010-12-18 06:11:41 57856 ----a-w- C:\Windows\System32\licmgr10.dll
    2010-12-18 06:11:34 714752 ----a-w- C:\Windows\System32\kerberos.dll
    2010-12-18 05:29:40 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
    2010-12-18 05:29:31 541184 ----a-w- C:\Windows\SysWow64\kerberos.dll
    2010-12-18 04:55:03 482816 ----a-w- C:\Windows\System32\html.iec
    2010-12-18 04:20:55 386048 ----a-w- C:\Windows\SysWow64\html.iec
    2010-12-18 04:13:40 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
    2010-12-18 03:47:59 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    .
    ============= FINISH: 22:20:31.63 ===============


    Attach.txt

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_11-03-05.01)
    .
    Microsoft Windows 7 Ultimate
    Boot Device: \Device\HarddiskVolume1
    Install Date: 30/11/2009 6:45:23 PM
    System Uptime: 12/03/2011 8:33:21 PM (2 hours ago)
    .
    Motherboard: Gigabyte Technology Co., Ltd. | | P55-UD3R
    Processor: Intel(R) Core(TM) i7 CPU 860 @ 2.80GHz | Socket 1156 | 2926/133mhz
    .
    ==== Disk Partitions =========================
    .
    A: is Removable
    C: is FIXED (NTFS) - 98 GiB total, 15.349 GiB free.
    D: is FIXED (NTFS) - 834 GiB total, 35.815 GiB free.
    E: is CDROM ()
    F: is CDROM (CDFS)
    G: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP228: 12/03/2011 5:41:22 PM - Windows Update
    RP229: 12/03/2011 5:56:35 PM - Removed AVG 2011
    RP230: 12/03/2011 5:58:01 PM - Removed AVG 2011
    .
    ==== Installed Programs ======================
    .
    "Nero SoundTrax Help
    AAC Decoder
    AC3Filter (remove only)
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Photoshop 7.0
    Adobe Reader 8.1.0
    Advertising Center
    Apple Application Support
    Apple Software Update
    ASUS VGA Driver
    AutoUpdate
    avast! Free Antivirus
    Axara Video Converter 3.5.4
    BitComet 1.16
    Browser Configuration Utility
    Canon Camera Access Library
    Canon Camera Support Core Library
    Canon Camera Window DC_DV 5 for ZoomBrowser EX
    Canon Camera Window DC_DV 6 for ZoomBrowser EX
    Canon Camera Window MC 6 for ZoomBrowser EX
    Canon G.726 WMP-Decoder
    Canon MovieEdit Task for ZoomBrowser EX
    Canon RAW Image Task for ZoomBrowser EX
    Canon RemoteCapture Task for ZoomBrowser EX
    Canon Utilities EOS Utility
    Canon Utilities PhotoStitch
    Canon Utilities ZoomBrowser EX
    Catalyst Control Center - Branding
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    CloneDVD2
    Combined Community Codec Pack 2007-02-22
    D3DX10
    DivX Codec
    DivX Converter
    DivX Player
    DivX Plus DirectShow Filters
    DivX Version Checker
    DNA
    DolbyFiles
    DVD43 v4.4.1
    FrostWire 4.21.1
    Gigabyte Raid Configurer
    GOM Player
    H.264 Decoder
    ImagXpress
    Java Auto Updater
    Java(TM) 6 Update 22
    Junk Mail filter update
    Malwarebytes' Anti-Malware
    MediaBar
    Menu Templates - Starter Kit
    Mesh Runtime
    Messenger Companion
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook Connector
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    MKV Splitter
    Movie Templates - Starter Kit
    MSVCRT
    MSVCRT_amd64
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Nero 9
    Nero BurningROM
    Nero BurnRights
    Nero ControlCenter
    Nero CoverDesigner
    Nero CoverDesigner Help
    Nero Disc Copy Gadget
    Nero Disc Copy Gadget Help
    Nero DiscSpeed
    Nero DriveSpeed
    Nero Express
    Nero InfoTool
    Nero Installer
    Nero PhotoSnap
    Nero PhotoSnap Help
    Nero Recode
    Nero Recode Help
    Nero Rescue Agent
    Nero RescueAgent Help
    Nero ShowTime
    Nero StartSmart
    Nero StartSmart Help
    Nero Vision
    Nero WaveEditor
    Nero WaveEditor Help
    NeroBurningROM
    NeroExpress
    neroxml
    NETGEAR WG111v2 wireless USB 2.0 adapter
    NOD32 antivirus system
    NOD32 FiX
    Opera 10.53
    QuickTime
    Realtek Ethernet Controller Driver
    Realtek High Definition Audio Driver
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2289158)
    Security Update for 2007 Microsoft Office System (KB2344875)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB2345035)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office PowerPoint 2007 (KB982158)
    Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
    Security Update for Microsoft Office Publisher 2007 (KB2284697)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    SoundTrax
    StarCraft II
    Update for 2007 Microsoft Office System (KB2284654)
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Access 2007 Help (KB963663)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office Infopath 2007 Help (KB963662)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Outlook 2007 (KB2412171)
    Update for Microsoft Office Outlook 2007 Help (KB963677)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Publisher 2007 Help (KB963667)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Update for Outlook 2007 Junk Email Filter (KB2492475)
    VC80CRTRedist - 8.0.50727.762
    Visual Studio 2008 x64 Redistributables
    VobSub v2.23 (Remove Only)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    WinRAR archiver
    .
    ==== Event Viewer Messages From Past Week ========
    .
    9/03/2011 5:36:35 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the AVGIDSAgent service to connect.
    9/03/2011 5:36:35 PM, Error: Service Control Manager [7000] - The AVGIDSAgent service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/03/2011 5:31:19 PM, Error: Service Control Manager [7022] - The Background Intelligent Transfer Service service hung on starting.
    9/03/2011 11:04:40 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
    7/03/2011 9:27:55 PM, Error: Service Control Manager [7034] - The Canon Camera Access Library 8 service terminated unexpectedly. It has done this 1 time(s).
    7/03/2011 8:22:12 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X64 service to connect.
    7/03/2011 7:42:37 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
    12/03/2011 8:34:02 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ASPI32
    12/03/2011 8:33:31 PM, Error: Application Popup [1060] - \SystemRoot\SysWow64\Drivers\ASPI32.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
    12/03/2011 8:08:11 PM, Error: Microsoft-Windows-HAL [12] - The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system.
    12/03/2011 5:35:53 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    12/03/2011 5:34:57 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    12/03/2011 4:03:51 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    12/03/2011 4:03:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    12/03/2011 4:03:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    12/03/2011 4:03:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    12/03/2011 4:03:13 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ASPI32 aswSnx aswSP aswTdi Avgldx64 Avgmfx64 discache ElbyCDIO spldr Wanarpv6
    12/03/2011 3:55:22 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume2.
    12/03/2011 3:53:11 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
    12/03/2011 3:50:16 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Spooler service.
    .
    ==== End Of File ===========================
     
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Welcome to TechSpot! I'll help you sort things out.

    1. One of the malware entries was for a Trojan.FakeAlert, so it's important you don't act on any infection alerts that come up.
    2. Another significant problem involves a bad proxy.
    3. Another risk is the file sharing programs you're running: I notice at least 4:
    BitComent
    Frostwire
    Bearshare MediaBar> C:\PROGRA~2\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
    [BitTorrent DNA]


    P2P or 'file sharing' Warning:
    Note: Even if you are using a "safe" P2P program, it is only the program that is safe. Please uninstall or disable all entries for BitComet,BitTorrent, Bearshare abd FrostWire while I am helping you clean the system. I advise this for the following reasons:
    1. As long as you are using file sharing networks and programs which are from sources that are not documented, you cannot verity that a download is legitimate.
    2. Malware writers use these program to include malicious content.
    3. File sharing is usually unmonitored and there is a danger that your private files might be accessed.
    4. The 'sharing' also includes malware that the shared system has on it.
    5. Files that are illegal can be spread through file sharing.

    Please read the information on P2P Warning to help you better understand these dangers.

    4. I note you are running VM Browser Configuration. This is related to DeviceVM, Inc. Browser Configuration Utility for Splashtop. Is this the only browser you use and the one that is not working?

    5. You have multiple antivirus programs running:
    Avast> C:\Program Files\AVAST Software\Avast\AvastUI.exe
    Eset Nod32> C:\Program Files (x86)\Eset\nod32kui.exe
    AVG: >C:\Program Files (x86)\AVG

    I thought I saw an entry for Panda Security but I can't find it now.
    This presents a vulnerability to the system. Please decide which you want to keep and uninstall the others: The following tools will help
    Avast Removal
    Eset Nod32 Uninstall
    I don't have a tool for Panda.
    Please reboot the system when the AV uninstalls are complete.
    =====================================
    Please let me know when you have finished the above.
     
  3. gotheswannies

    gotheswannies TS Rookie Topic Starter

    Hey Bobbye, thanks for helping me out.

    I've uninstalled all p2p programs except for BitComet, I'm not sure what you mean by disabling all entries. The program isn't currently running, but I have a few files that I am mid-way through downloading and I would like to continue to download in future.

    As for browsers, I'm not sure what you meant by running "VM Browser Configuration". The only browsers that I'm aware of are internet explorer and opera (which I haven't used in months). Initiatlly internet explorer was not working, after running several scans I logged on this morning and was able to use explorer once again.

    I've uninstalled the other anti virus programs and only have Avast atm. I've never heard of Panda and don't think it was installed.

    I've completed what you've asked me to (to the best of my abilities). If you need me to do anything further please let me know.

    Thanks
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Note entries found:DDS log:
    ============== Running Processes ===============
    C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
    uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll

    Browser Configuration Utility Service (BCUService) BCUService.exe Related to DeviceVM, Inc. Browser Configuration Utility for Splashtop. Note: Located in \%Program Files%\DeviceVM\Browser Configuration Utility\
    Please see http://www.splashtop.com/remote
    ==========================================
    You mentioned that your browser wasn't working. I found these entries in the logs and brought them to your attention.
    ===========================================
    Regarding BitComet: ============= Running Processes
    C:\Users\Danny\Program Files (x86)\DNA\btdna.exe
    BHO: MediaBar: {0974ba1e-64ec-11de-b2a5-e43756d89593} - C:\PROGRA~2\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
    BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.7.16.dll
    IE: &D&ownload &with BitComet - C:\Program Files (x86)\BitComet\BitComet.exe/AddLink.htm
    IE: &D&ownload all video with BitComet - C:\Program Files (x86)\BitComet\BitComet.exe/AddVideo.htm
    IE: &D&ownload all with BitComet - C:\Program Files (x86)\BitComet\BitComet.exe/AddAllLink.htm
    ============================================
    Run Eset NOD32 Online AntiVirus scan HERE
    1. Tick the box next to YES, I accept the Terms of Use.
    2. Click Start
    3. When asked, allow the Active X control to install
    4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    5. Click Start
    6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    7. Click Scan
    8. Wait for the scan to finish
    9. Click on "Copy to Clipboard"> (you won't see the 'clipboard')
    10. Click anywhere in the post where you want the logs to go, the do Ctrl V. The log will be sent from the clipboard and pasted in the post.
    11. Re-enable your Antivirus software.
      NOTE: If you forget to copy to the clipboard you can find the log here:
      C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.
    =======================================
    Download Combofix to your desktop from one of these locations:
    Link 1
    Link 2
    • Double click combofix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Query- Recovery Console image
      [​IMG]
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.
    Notes:
    1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    =====================================
    I can remove some of the entries with script you'll run through Combofix.
     
  5. gotheswannies

    gotheswannies TS Rookie Topic Starter

    ESET Online Scanner log:

    ESETSmartInstaller@High as CAB hook log:
    OnlineScanner64.ocx - registred OK
    OnlineScanner.ocx - registred OK

    Combofix log:

    ComboFix 11-03-12.01 - Danny 14/03/2011 14:58:09.1.8 - x64
    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.61.1033.18.4091.2103 [GMT 11:00]
    Running from: c:\users\Danny\Desktop\ComboFix.exe
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Danny\AppData\Local\Temp\FC77.tmp
    c:\windows\7Loader.TAG
    c:\windows\SysWow64\winservice.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Service_SCM_Service
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-02-14 to 2011-03-14 )))))))))))))))))))))))))))))))
    .
    .
    2011-03-13 00:58 . 2011-03-13 00:58 -------- d-----w- c:\windows\Sun
    2011-03-13 00:57 . 2011-03-13 00:57 -------- d-----w- c:\program files (x86)\Common Files\Java
    2011-03-13 00:55 . 2011-03-13 00:55 -------- d-----w- c:\programdata\McAfee
    2011-03-13 00:43 . 2011-02-11 07:30 7947600 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{81FABD2B-CAF2-499D-A729-258271D7FE48}\mpengine.dll
    2011-03-12 09:56 . 2011-03-12 09:56 -------- d-----w- c:\users\Danny\AppData\Roaming\Malwarebytes
    2011-03-12 09:55 . 2011-03-12 09:55 -------- d-----w- c:\programdata\Malwarebytes
    2011-03-12 09:55 . 2010-12-20 07:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-03-12 06:52 . 2011-03-12 06:52 -------- d-----w- c:\users\Danny\AppData\Local\Threat Expert
    2011-03-12 06:44 . 2010-12-23 06:07 961024 ----a-w- c:\windows\system32\CPFilters.dll
    2011-03-12 06:44 . 2010-12-23 06:07 723968 ----a-w- c:\windows\system32\EncDec.dll
    2011-03-12 06:44 . 2010-12-23 05:28 642048 ----a-w- c:\windows\SysWow64\CPFilters.dll
    2011-03-12 06:44 . 2010-12-23 05:28 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
    2011-03-12 06:44 . 2010-12-23 06:07 1118720 ----a-w- c:\windows\system32\sbe.dll
    2011-03-12 06:44 . 2010-12-23 06:02 259072 ----a-w- c:\windows\system32\mpg2splt.ax
    2011-03-12 06:44 . 2010-12-23 05:28 850432 ----a-w- c:\windows\SysWow64\sbe.dll
    2011-03-12 06:44 . 2010-12-23 05:24 199680 ----a-w- c:\windows\SysWow64\mpg2splt.ax
    2011-03-12 06:43 . 2010-12-18 06:12 3138048 ----a-w- c:\windows\system32\mstscax.dll
    2011-03-12 06:43 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\SysWow64\mstscax.dll
    2011-03-12 06:43 . 2010-12-18 06:08 1097216 ----a-w- c:\windows\system32\mstsc.exe
    2011-03-12 06:43 . 2010-12-18 05:26 1034240 ----a-w- c:\windows\SysWow64\mstsc.exe
    2011-03-12 06:32 . 2011-03-12 06:53 -------- d-----w- c:\programdata\PC Tools
    2011-03-04 04:27 . 2011-02-23 14:54 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2011-03-04 04:27 . 2011-02-23 14:57 280408 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2011-03-04 04:27 . 2011-02-23 14:57 505176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2011-03-04 04:27 . 2011-02-23 14:55 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2011-03-04 04:27 . 2011-02-23 14:55 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2011-03-04 04:27 . 2011-02-23 15:04 238968 ----a-w- c:\windows\system32\aswBoot.exe
    2011-03-04 04:27 . 2011-02-23 14:55 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2011-03-04 04:27 . 2011-02-23 15:04 40648 ----a-w- c:\windows\avastSS.scr
    2011-03-04 04:27 . 2011-02-23 15:04 190016 ----a-w- c:\windows\SysWow64\aswBoot.exe
    2011-03-04 04:27 . 2011-03-04 04:27 -------- d-----w- c:\programdata\AVAST Software
    2011-03-04 04:27 . 2011-03-04 04:27 -------- d-----w- c:\program files\AVAST Software
    2011-03-03 08:00 . 2011-03-03 08:00 -------- d-----w- C:\$AVG
    2011-03-03 07:13 . 2011-03-03 07:13 -------- d-----w- c:\users\Danny\AppData\Roaming\AVG10
    2011-03-03 07:12 . 2011-03-03 07:12 -------- d--h--w- c:\programdata\Common Files
    2011-03-03 07:11 . 2011-03-12 07:09 -------- d-----w- c:\programdata\AVG10
    2011-03-03 07:11 . 2011-03-12 06:57 -------- d-----w- c:\windows\system32\drivers\AVG
    2011-03-03 07:06 . 2011-03-03 07:11 -------- d-----w- c:\programdata\MFAData
    2011-02-23 16:01 . 2010-09-14 06:45 367104 ----a-w- c:\windows\system32\wcncsvc.dll
    2011-02-23 16:01 . 2010-09-14 06:07 276992 ----a-w- c:\windows\SysWow64\wcncsvc.dll
    2011-02-23 12:32 . 2011-01-07 08:07 662528 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-02-23 12:32 . 2011-01-07 08:07 475648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-02-23 12:32 . 2011-01-07 07:31 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll
    2011-02-23 12:32 . 2011-01-07 07:31 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
    2011-02-19 16:01 . 2011-02-19 16:01 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%
    2011-02-17 12:55 . 2011-02-17 12:55 -------- d-----w- c:\windows\en
    2011-02-17 12:54 . 2011-02-17 12:54 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
    2011-02-17 12:52 . 2010-09-22 13:36 48488 ----a-w- c:\windows\system32\drivers\fssfltr.sys
    2011-02-17 12:52 . 2011-02-17 12:52 -------- d-----w- c:\program files\Windows Live
    2011-02-17 12:52 . 2009-09-04 06:44 69464 ----a-w- c:\windows\SysWow64\XAPOFX1_3.dll
    2011-02-17 12:52 . 2009-09-04 06:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll
    2011-02-17 12:52 . 2009-09-04 06:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll
    2011-02-17 12:52 . 2009-09-04 06:29 523088 ----a-w- c:\windows\system32\d3dx10_42.dll
    2011-02-17 12:51 . 2006-11-29 02:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll
    2011-02-17 12:51 . 2006-11-29 02:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll
    2011-02-17 12:51 . 2011-03-12 06:54 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
    2011-02-17 12:21 . 2011-02-17 12:21 469256 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\2ce2edf11cbce9d2f\InstallManager_WLE_WLE.exe
    2011-02-17 12:21 . 2011-02-17 12:21 15712 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\22c88fa41cbce9d24\MeshBetaRemover.exe
    2011-02-17 12:20 . 2011-02-17 12:20 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\193f26c41cbce9d1c\DXSETUP.exe
    2011-02-17 12:20 . 2011-02-17 12:20 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\193f26c41cbce9d1c\dsetup32.dll
    2011-02-17 12:20 . 2011-02-17 12:20 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\193f26c41cbce9d1c\DSETUP.dll
    2011-02-17 12:20 . 2011-02-17 12:20 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\184c894e1cbce9d1b\DSETUP.dll
    2011-02-17 12:20 . 2011-02-17 12:20 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\184c894e1cbce9d1b\DXSETUP.exe
    2011-02-17 12:20 . 2011-02-17 12:20 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\184c894e1cbce9d1b\dsetup32.dll
    2011-02-17 12:20 . 2011-02-17 12:20 6260088 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\85947571cbce9d0f\Silverlight.4.0.exe
    2011-02-17 12:19 . 2011-03-13 00:48 -------- d-----w- c:\users\Danny\AppData\Local\Windows Live
    2011-02-15 07:25 . 2011-02-15 07:25 -------- d-----w- c:\programdata\DivX
    2011-02-14 09:57 . 2011-03-03 13:07 -------- d-----w- c:\users\Danny\AppData\Local\ElevatedDiagnostics
    2011-02-13 11:34 . 2011-03-12 06:54 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
    2011-02-13 11:34 . 2011-03-12 06:52 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-02-02 10:40 . 2010-07-29 08:36 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2011-02-02 06:11 . 2009-12-04 12:01 270720 ------w- c:\windows\system32\MpSigStub.exe
    2011-01-26 06:53 . 2011-02-09 15:45 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
    2011-01-26 06:53 . 2011-02-09 15:45 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
    2011-01-26 06:31 . 2011-02-09 15:45 144384 ----a-w- c:\windows\system32\cdd.dll
    2011-01-07 08:06 . 2011-02-09 15:42 46080 ----a-w- c:\windows\system32\atmlib.dll
    2011-01-07 07:27 . 2011-02-09 15:42 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
    2011-01-07 05:49 . 2011-02-09 15:42 366080 ----a-w- c:\windows\system32\atmfd.dll
    2011-01-07 05:33 . 2011-02-09 15:42 294400 ----a-w- c:\windows\SysWow64\atmfd.dll
    2011-01-05 06:20 . 2011-02-09 15:45 612352 ----a-w- c:\windows\system32\vbscript.dll
    2011-01-05 05:37 . 2011-02-09 15:45 428032 ----a-w- c:\windows\SysWow64\vbscript.dll
    2011-01-05 04:00 . 2011-02-09 15:46 3127808 ----a-w- c:\windows\system32\win32k.sys
    2010-12-21 06:16 . 2011-02-09 15:46 97280 ----a-w- c:\windows\system32\wscsvc.dll
    2010-12-21 06:16 . 2011-02-09 15:46 62976 ----a-w- c:\windows\system32\wscapi.dll
    2010-12-21 06:16 . 2011-02-09 15:35 214016 ----a-w- c:\windows\system32\winsrv.dll
    2010-12-21 06:16 . 2011-02-09 15:46 442880 ----a-w- c:\windows\system32\winhttp.dll
    2010-12-21 06:16 . 2011-02-09 15:46 1197056 ----a-w- c:\windows\system32\wininet.dll
    2010-12-21 06:16 . 2011-02-09 15:46 258048 ----a-w- c:\windows\system32\WebClnt.dll
    2010-12-21 06:15 . 2011-02-09 15:46 264192 ----a-w- c:\windows\system32\upnp.dll
    2010-12-21 06:15 . 2011-02-09 15:46 15360 ----a-w- c:\windows\system32\slwga.dll
    2010-12-21 06:13 . 2011-02-09 15:46 2003968 ----a-w- c:\windows\system32\msxml6.dll
    2010-12-21 06:13 . 2011-02-09 15:46 1880576 ----a-w- c:\windows\system32\msxml3.dll
    2010-12-21 06:10 . 2011-02-09 15:46 100864 ----a-w- c:\windows\system32\davclnt.dll
    2010-12-21 05:38 . 2011-02-09 15:46 51200 ----a-w- c:\windows\SysWow64\wscapi.dll
    2010-12-21 05:38 . 2011-02-09 15:46 981504 ----a-w- c:\windows\SysWow64\wininet.dll
    2010-12-21 05:38 . 2011-02-09 15:46 350720 ----a-w- c:\windows\SysWow64\winhttp.dll
    2010-12-21 05:38 . 2011-02-09 15:46 204800 ----a-w- c:\windows\SysWow64\WebClnt.dll
    2010-12-21 05:38 . 2011-02-09 15:46 204288 ----a-w- c:\windows\SysWow64\upnp.dll
    2010-12-21 05:38 . 2011-02-09 15:46 14336 ----a-w- c:\windows\SysWow64\slwga.dll
    2010-12-21 05:36 . 2011-02-09 15:46 1389568 ----a-w- c:\windows\SysWow64\msxml6.dll
    2010-12-21 05:36 . 2011-02-09 15:46 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll
    2010-12-21 05:34 . 2011-02-09 15:46 80384 ----a-w- c:\windows\SysWow64\davclnt.dll
    2010-12-18 06:11 . 2011-02-09 15:47 57856 ----a-w- c:\windows\system32\licmgr10.dll
    2010-12-18 06:11 . 2011-02-09 15:46 714752 ----a-w- c:\windows\system32\kerberos.dll
    2010-12-18 05:29 . 2011-02-09 15:47 44544 ----a-w- c:\windows\SysWow64\licmgr10.dll
    2010-12-18 05:29 . 2011-02-09 15:46 541184 ----a-w- c:\windows\SysWow64\kerberos.dll
    2010-12-18 04:55 . 2011-02-09 15:47 482816 ----a-w- c:\windows\system32\html.iec
    2010-12-18 04:20 . 2011-02-09 15:47 386048 ----a-w- c:\windows\SysWow64\html.iec
    2010-12-18 04:13 . 2011-02-09 15:47 1638912 ----a-w- c:\windows\system32\mshtml.tlb
    2010-12-18 03:47 . 2011-02-09 15:47 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-09-22 4240760]
    "BitTorrent DNA"="c:\users\Danny\Program Files (x86)\DNA\btdna.exe" [2010-09-20 323392]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-08-04 346320]
    "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
    "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-10 40048]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-06-22 98304]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-13 421160]
    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-8-7 113664]
    NETGEAR WG111v2 Smart Wizard.lnk - c:\program files (x86)\NETGEAR\WG111v2\WG111v2.exe [2009-12-5 1261568]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R3 nmwcdx64;Nokia USB Phone Parent;c:\windows\system32\drivers\ccdcmbx64.sys [x]
    R3 RTL8187;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\DRIVERS\wg111v2.sys [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
    S0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\DRIVERS\scmndisp.sys [x]
    S1 aswSnx;aswSnx; [x]
    S1 aswSP;aswSP; [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 aswFsBlk;aswFsBlk; [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
    S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-08-04 219360]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    .
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2011-02-23 15:04 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "combofix"="c:\combofix\CF10181.cfxxe" [X]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-25 8084000]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.smh.com.au/
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = <local>
    IE: &D&ownload &with BitComet - c:\program files (x86)\BitComet\BitComet.exe/AddLink.htm
    IE: &D&ownload all video with BitComet - c:\program files (x86)\BitComet\BitComet.exe/AddVideo.htm
    IE: &D&ownload all with BitComet - c:\program files (x86)\BitComet\BitComet.exe/AddAllLink.htm
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Wow6432Node-HKLM-Run-dvd43 - c:\program files (x86)\dvd43\dvd43_tray.exe
    AddRemove-DVD43_is1 - c:\program files (x86)\dvd43\unins000.exe
    AddRemove-{4102037D-E8E0-48E0-B203-E521D194FB71} - c:\program files (x86)\InstallShield Installation Information\{4102037D-E8E0-48E0-B203-E521D194FB71}\setup.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    @="Microsoft Windows Media Player"
    "Version"="12,0,7600,16667"
    "IsInstalled"=dword:00000000
    "ComponentID"="WMPACCESS"
    "LocalizedName"=expand:"@%SystemRoot%\\system32\\wmploc.dll,-128"
    "StubPath"=expand:"%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"
    "DontAsk"=dword:00000002
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    @="Internet Explorer"
    "Version"="8,0,7600,17136"
    "IsInstalled"=dword:00000001
    "ComponentID"="IEACCESS"
    "LocalizedName"="@c:\\Windows\\System32\\ie4uinit.exe,-21"
    "StubPath"="c:\\Windows\\System32\\ie4uinit.exe -UserIconConfig"
    "Dontask"=dword:00000002
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    @="Browser Customizations"
    "IsInstalled"=dword:00000001
    "Version"="8,0,7100,0"
    "ComponentiD"="BRANDING.CAB"
    "LocalizedName"="@c:\\Windows\\System32\\iedkcs32.dll,-3052"
    "StubPath"="\"c:\\Windows\\System32\\rundll32.exe\" \"c:\\Windows\\System32\\iedkcs32.dll\",BrandIEActiveSetup SIGNUP"
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    @="Microsoft Windows Media Player 12.0"
    "IsInstalled"=dword:00000001
    "Version"="12,0,7600,16667"
    "DontAsk"=dword:00000002
    "Locale"="EN"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}]
    @="Offline Browsing Pack"
    "IsInstalled"=dword:00000001
    "Version"="8,0,7600,16385"
    "ComponentID"="MobilePk"
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
    @="Internet Explorer Help"
    "IsInstalled"=dword:00000001
    "Version"="8,0,7600,16385"
    "ComponentID"="HelpCont"
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
    @="Internet Explorer Setup Tools"
    "IsInstalled"=dword:00000001
    "Version"="8,0,7600,16385"
    "ComponentID"="GenSetup"
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    @="Microsoft Windows Media Player"
    "IsInstalled"=dword:00000001
    "Version"="12,0,7600,16667"
    "ComponentID"="Microsoft Windows Media Player"
    "LocalizedName"=expand:"@%SystemRoot%\\system32\\wmploc.dll,-128"
    "StubPath"=expand:"%SystemRoot%\\system32\\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI"
    "DontAsk"=dword:00000002
    "Locale"="EN"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
    @="MSN Site Access"
    "IsInstalled"=dword:00000001
    "Version"="4,9,9,2"
    "ComponentID"="MSN_Auth"
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
    @="Web Platform Customizations"
    "IsInstalled"=dword:00000001
    "Version"="8,0,7600,17136"
    "ComponentID"="BASEIE40_W2K"
    "LocalizedName"="@c:\\Windows\\System32\\ie4uinit.exe,-2000"
    "StubPath"="c:\\Windows\\System32\\ie4uinit.exe -BaseSettings"
    "Locale"="en"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
    @="Dynamic HTML Data Binding"
    "IsInstalled"=dword:00000001
    "Version"="8,0,7600,16385"
    "ComponentID"="Tridata"
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}]
    @="Internet Explorer Core Fonts"
    "IsInstalled"=dword:00000001
    "Version"="8,0,7600,17136"
    "ComponentID"="Fontcore"
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
    @="HTML Help"
    "IsInstalled"=dword:00000001
    "Version"="6,1,7600,16385"
    "ComponentID"="HTMLHelp"
    "Locale"="*"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}]
    "Locale"=""
    "Version"="4,0,30319,0"
    "ComponentID"=".NETFramework"
    @=".NET Framework"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\AVAST Software\Avast\AvastSvc.exe
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files (x86)\Bonjour\mDNSResponder.exe
    c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
    c:\program files (x86)\Canon\CAL\CALMAIN.exe
    .
    **************************************************************************
    .
    Completion time: 2011-03-14 15:14:54 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-03-14 04:14
    .
    Pre-Run: 12,564,586,496 bytes free
    Post-Run: 11,979,661,312 bytes free
    .
    - - End Of File - - FD028DB252CD2D568A2F777817E8287B
     
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Please run the following scan and paste log in next reply:

    Download CKScanner and save to your desktop.
    • Doubleclick CKScanner.exe and click Search For Files.
    • When the cursor hourglass disappears, click Save List To File.
    • A message box will verify that the file is saved.
    • Double-click the CKFiles.txt icon on your desktop and copy/paste the contents
      in your next reply.
     
  7. gotheswannies

    gotheswannies TS Rookie Topic Starter

    CKScanner - Additional Security Risks - These are not necessarily bad
    scanner sequence 3.RP.11
    ----- EOF -----
     
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    The reason I asked you about the OS is because there is a large number of drivers or Services indicating their corresponding programs are not on the system or that there is some problem with them. I want you to play detective and check them out: I am giving you the name, the status and where possible, what it belongs to. If you have removed the associated programs or apps, they should not still be on the system. IF you are still using them, there is a problem: It is highly unusual to have so many 'non-working' or 'lwefdt-over' drivers on a system.

    R3>> Running, Demand (Running now as you have it's associated program or app running.
    nmwcdx64>> Nokia USB Phone Parent
    RTL8187>> Netgear 54mbps Wireless USB Adapter Vista Driver
    USBAAPL64> Apple Mobile USB Driver
    WatAdminSvc> Windows Activation Technologies Service

    S0> Stopped
    SCMNdisP> General NDIS Protocol Driver

    S1> Stopped, System
    aswSnx>> avast! Virtualization Driver
    aswSP>> Avast! antivirus self protection system driver file.

    S2> Stopped, Auto (Not running now but will automatically start when needed)
    aswFsBlk>> Avast! antivirus system system driver file.
    AMD External Events Utility
    aswMonFlt>> Avast! antivirus system system driver file.
    BCUService

    S3> Stopped, Demand (Stopped now. Will start when user invoked for it's associated program or app)
    amdkmdag
    amdkmdap
    RTL8167> Realtek 8167 NT Driver

    Note: A part of the heading in Combofix should show the antivirus program and it's status> such a "Avast Antivirus Disabled. Your does not. So I don't know if the X I'm seeing on the Avast drivers is because you disabled it or if the program is not on the system.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...