Inactive AVG free version detects "IDP.Trojan.2428539A

[Mitch Flander]

Please, I need some guidance here. AVG reports this virus as "misleading" and as rouge spyware and also calls it "rcpnetp". After reading your cautions about whether it's a good idea to reformat and reinstall or to clean, I wonder what course of action this infection warrants. AVG reports that its moving it to the vault, but it returns on each reboot and it doesn't show up in the vault. Malwarebytes Anti-malware doesn't report a threat at all. I'm just not sure how to continue. Any help would be appreciated.
thanks....

 

[Jay Pfoutz]

Hello, and welcome to TechSpot.

Please see here for the board rules and other FAQ.

Please feel free to introduce yourself, after you follow the steps below to get started.

Information

• From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a malware removal helper.
• Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
• If you have already asked for help somewhere, please post the link to the topic you were helped.
• We try our best to reply quickly, but for any reason we do not reply in two days, please reply to this topic with the word BUMP!
• Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

Please review the 5-Step removal instructions and post the logs back here for my review.

 

[Mitch Flander]

Hey DragonMaster,

This is the reply with a paste of the requested logs. I believe it's requested that I give you my system specs and some info on how I use my PC. I thank you heartily in advance for any help at all. I think you saw in my original post that I was unsure based on what I was seeing if I should clean or reformat/reinstall. I'm hoping based on what YOU see that you can provide some insight into that. I sure hope to go with the "clean" option if it at all seems sensible. Thanks again....

Laptop: Dell Lattitude E6500 running Windows 7 Professional
Processor: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz 2.54 GHz

Installed memory (RAM): 4.00 GB (3.49 GB usable)

System type: 32-bit Operation System

This is a laptop provided for me by my employer, but it's for personal use as well (online bill pay, gaming, etc).

The following is a paste of the logs you requested:


Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.12.05

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Mitch :: MITCH-PC [limited]

8/12/2012 5:58:54 PM
mbam-log-2012-08-12 (17-58-54).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 231827
Time elapsed: 4 minute(s), 15 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

******************************
************************************************************************

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-08-12 19:25:37
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 rev.
Running: gq3mdkkb.exe; Driver: C:\Users\Mitch\AppData\Local\Temp\kgloypog.sys


---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs avgidsfilterx.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat avgidsfilterx.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\tdx \Device\Ip nmdrv.sys
AttachedDevice \Driver\tdx \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Tcp nmdrv.sys
AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Udp nmdrv.sys
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp nmdrv.sys

---- EOF - GMER 1.0.15 ----


*******************************************************************************************************
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_20
Run by Mitch at 22:10:13 on 2012-08-12
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3572.1988 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NetMotion Client\messerv.exe
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\NetMotion Client\nomtray.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\AVG\AVG2012\avgcfgex.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe
C:\Windows\system32\conhost.exe
C:\Users\Mitch\AppData\Local\Temp\nsp3981.tmp\MBR.DAT
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://foxnews.com/
mURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Do Not Track: {31332eef-cb9f-458f-afeb-d30e9a66b6ba} - c:\program files\avg\avg2012\avgdtiex.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: LLIEHlprObj Class: {f757fbbf-10e5-4dda-bbea-2357e54bea2b} - c:\program files\open text\livelink explorer\LLBHO3.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
mRun: [nomtray] c:\program files\netmotion client\nomtray.exe
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:\program files\avg\avg2012\avgdtiex.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL
Trusted Zone: dwm-cipapps
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA} - hxxp://cmg.atlantawatershed.org:81/jre-6u3-windows-i586-p.exe
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://cmg.atlantawatershed.org:81/jre-6u20-windows-i586.exe
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F5131C24-E56D-11CF-B78A-444553540000} - hxxp://dwm-cipapps/cipr/activex/ikcntrls.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\24F6E6573727F6F6D6D275962756C6563737 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\3557276635166716E6E61686 : DhcpNameServer = 172.16.4.1 209.221.63.10 8.8.4.4
TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\35F6574786561637470234F6D607F657E646 : DhcpNameServer = 66.180.96.12 64.238.96.12
TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\35F6574786561637470234F6D607F657E646D27657563747 : DhcpNameServer = 66.180.96.12 64.238.96.12
TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\74F6E646F6C6965627 : DhcpNameServer = 192.168.20.1
TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\D69647368637F51696273707163656 : DhcpNameServer = 68.87.68.166 68.87.74.166
TCP: Interfaces\{6C9313BB-2269-4F98-BC23-ECE726417E8F}\E45402E4564777F627B6 : DhcpNameServer = 64.238.96.12 66.180.96.12
TCP: Interfaces\{CCC3F12C-6E77-47E9-A35D-28B08E5562AD} : DhcpNameServer = 10.11.2.199 10.11.2.200 10.25.10.53 10.11.50.110
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\mitch\appdata\roaming\mozilla\firefox\profiles\0ng2lj8a.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.foxnews.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q=
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\users\mitch\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\users\mitch\appdata\roaming\mozilla\firefox\profiles\0ng2lj8a.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\plugins\np-mswmp.dll
FF - plugin: c:\users\mitch\appdata\roaming\mozilla\plugins\npicaN.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_270.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-1-31 31952]
R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [2011-6-30 41912]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-2-22 235216]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-12-23 41040]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2012-3-19 301248]
R1 fsclm;FIPS Encryption Driver;c:\windows\system32\drivers\Fsclm.sys [2010-2-6 97760]
R1 NMDRV;NetMotion Client Driver;c:\program files\netmotion client\nmdrv.sys [2010-2-6 780888]
R1 NMRoam;NetMotion Roaming Detection Daemon;c:\windows\system32\drivers\nmroam.sys [2010-2-6 27736]
R1 NMutilnt;NetMotion Utility Driver;c:\windows\system32\drivers\nmutilnt.sys [2010-2-6 20568]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 193288]
R2 MESSERV;NetMotion Client;c:\program files\netmotion client\messerv.exe [2010-2-6 1395800]
R2 mrtRate;mrtRate;c:\windows\system32\drivers\MrtRate.sys [2010-3-27 34712]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 139856]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [2011-12-23 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 17232]
R3 cvusbdrv;Dell ControlVault;c:\windows\system32\drivers\cvusbdrv.sys [2010-3-2 33832]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y6232.sys [2011-9-14 223960]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
R3 nmvnic;NMVNIC Network Adapter;c:\windows\system32\drivers\nmvnic.sys [2010-2-6 55896]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\avgidsagent.exe [2012-7-4 5160568]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-29 136176]
S3 acpials;ALS Sensor Filter;c:\windows\system32\drivers\acpials.sys [2009-7-14 7680]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-5-3 250056]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\drivers\BrSerIb.sys [2009-7-13 265088]
S3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\drivers\BrUsbSIb.sys [2009-7-13 11904]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2008-7-25 42280]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-3-29 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-24 113120]
S3 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-10-16 369256]
S3 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2012-2-7 3027840]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-7 1343400]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2009-7-13 17920]
S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2009-7-13 20480]
S4 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
SUnknown rpcnetp;rpcnetp; [x]
.
=============== Created Last 30 ================
.
2012-08-12 04:04:28 -------- d-sh--w- C:\$RECYCLE.BIN
2012-08-12 03:51:16 -------- d-----w- C:\ComboFix
2012-08-12 02:16:47 -------- d-----w- c:\users\mitch\appdata\local\temp
2012-08-12 01:54:06 98816 ----a-w- c:\windows\sed.exe
2012-08-12 01:54:06 518144 ----a-w- c:\windows\SWREG.exe
2012-08-12 01:54:06 256000 ----a-w- c:\windows\PEV.exe
2012-08-12 01:54:06 208896 ----a-w- c:\windows\MBR.exe
2012-08-10 18:25:37 17920 ------w- c:\windows\system32\rpcnetp.dll
.
==================== Find3M ====================
.
2012-08-03 13:09:20 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-03 13:09:20 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-03 17:46:44 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-03 02:14:36 499712 ----a-w- c:\windows\system32\msvcp71.dll
2012-06-03 02:14:36 348160 ----a-w- c:\windows\system32\msvcr71.dll
2012-05-28 02:55:36 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-05-28 02:55:24 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-05-28 02:55:24 103736 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-05-18 03:07:30 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-05-18 03:07:21 282296 ----a-w- c:\windows\system32\PnkBstrB.xtr
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStorV.sys halmacpi.dll
c:\windows\system32\drivers\iaStorV.sys Intel Corporation Intel Matrix Storage Manager driver
1 ntkrnlpa!IofCallDriver[0x82E7A448] -> \Device\Harddisk0\DR0[0x8767B030]
3 CLASSPNP[0x8CFB059E] -> ntkrnlpa!IofCallDriver[0x82E7A448] -> \Device\Ide\IAAStorageDevice-1[0x86427028]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0; }
user != kernel MBR !!!
copy of MBR has been found in sector 61 !
copy of MBR has been found in sector 62 !
.
============= FINISH: 22:10:33.56 ===============

***********************************************************************************************************************
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Professional
Boot Device: \Device\HarddiskVolume3
Install Date: 3/22/2010 10:41:20 PM
System Uptime: 8/12/2012 12:11:31 AM (22 hours ago)
.
Motherboard: Dell Inc. | |
Processor: Intel(R) Core(TM)2 Duo CPU P8700 @ 2.53GHz | Microprocessor | 2535/266mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 223 GiB total, 107.096 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 3.371 GiB free.
E: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP929: 8/11/2012 10:43:22 PM - Windows Update
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
2007 Microsoft Office system
Abacus Flight Deck 4
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.5.1
Adobe Shockwave Player 11.6
Apple Software Update
AVG 2012
Battlefield: Bad Company™ 2
Brother MFL-Pro Suite MFC-9840CDW
Call of Duty(R) 2
Call of Duty(R) 4 - Modern Warfare(TM)
Call of Duty: Black Ops
Call of Duty: Black Ops - Multiplayer
Carbonite
CCleaner
Citrix Presentation Server Client - Web Only
Citrix XenApp Web Plugin
Dell Resource CD
Desktop Restore
Driving Speed 2.0
Eagle Lander
Eagle Lander 3D v212
Free Audio CD Burner version 1.4.7
Free Audio CD to MP3 Converter version 1.3.12.1228
Free Audio Converter version 5.0.10.423
Free Disc Burner version 3.0.6.920
Free M4a to MP3 Converter 6.2
Free YouTube Download version 3.0.815
Free YouTube to MP3 Converter version 3.10.815
FreeRIP v3.40
Google Chrome
Google Earth
Google Update Helper
Intel(R) Network Connections 14.1.111.0
Java Auto Updater
Java(TM) 6 Update 20
Java(TM) 6 Update 3
Joobers TV
Livelink Explorer Professional 4.8.3
Lock On: Modern Air Combat
Malwarebytes Anti-Malware version 1.62.0.1300
Microsoft Combat Flight Simulator 2
Microsoft Flight Simulator 2004 A Century of Flight
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
Microsoft WorldWide Telescope
Moffsoft FreeCalc
Moonbase Alpha
Mozilla Firefox 14.0.1 (x86 en-US)
Mozilla Maintenance Service
My Lockbox 2.8.2
NetMotion Mobility XE Client
NVIDIA 3D Vision Driver 260.99
NVIDIA Control Panel 260.99
NVIDIA Graphics Driver 260.99
NVIDIA Install Application
NVIDIA nView Desktop Manager
NVIDIA PhysX
NVIDIA PhysX System Software 260.99
NVIDIA Stereoscopic 3D Driver
OGA Notifier 2.0.0048.0
Orbiter 2010-P1
PunkBuster Services
Quicken 2002 Deluxe
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
RealUpgrade 1.1
Red Baron II
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
Sierra Utilities
Steam
Stellarium 0.11.0
swMSM
System Requirements Lab CYRI
TeamViewer 7
TmNationsForever
Unifier File Transfer Application (remove only)
Uninstall 1.0.0.1
Unity Web Player
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687267) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Word 2007 Help (KB963665)
Windows Media Player Firefox Plugin
.
==== Event Viewer Messages From Past Week ========
.
8/8/2012 12:34:43 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070050: Security Update for Windows 7 (KB977165).
8/7/2012 8:46:52 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume OS.
8/12/2012 9:58:08 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
8/12/2012 5:56:40 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Windows\System32\config\COMPONENTS' was corrupted and it has been recovered. Some data might have been lost.
8/12/2012 2:08:47 AM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\Volume{c86edfbd-363b-11df-bbb9-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{4F1E2135-DD6F-4C2E-88E8-A5046353E6F9}' was corrupted and it has been recovered. Some data might have been lost.
8/12/2012 12:16:27 AM, Error: Service Control Manager [7034] - The rpcnetp service terminated unexpectedly. It has done this 1 time(s).
8/12/2012 12:13:37 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
8/12/2012 12:03:41 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
8/11/2012 9:00:06 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer LASALLE-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6C9313BB-2269-4F98-BC23-ECE7264. The master browser is stopping or an election is being forced.
8/11/2012 8:47:59 PM, Error: Service Control Manager [7000] - The rpcnetp service failed to start due to the following error: The system cannot find the file specified.
8/11/2012 8:22:54 PM, Error: Service Control Manager [7023] - The Windows Update service terminated with the following error: %%-2147467243
8/11/2012 10:44:27 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package (KB2538243).
8/11/2012 10:05:33 PM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
8/11/2012 1:32:16 PM, Error: Application Popup [877] - There was error [DATABASE OPEN FAILED] processing the driver database.
8/10/2012 8:26:54 AM, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 10.23.98.72. The computer with the IP address 10.23.98.73 did not allow the name to be claimed by this computer.
8/10/2012 12:03:08 PM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
8/10/2012 12:01:29 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
8/10/2012 12:01:28 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service CarboniteService with arguments "" in order to run the server: {36471C67-6A93-4434-92CC-4C614CD06666}
8/10/2012 12:01:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
8/10/2012 12:01:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
8/10/2012 12:01:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/10/2012 12:01:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
8/10/2012 12:01:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
8/10/2012 12:01:08 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgldx86 Avgmfx86 Avgtdix CSC DfsC discache fsclm NetBIOS NetBT NMDRV NMRoam NMutilnt nsiproxy Psched rdbss spldr tdx Wanarpv6 WfpLwf
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The NetMotion Client service depends on the NetMotion Client Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/10/2012 12:01:08 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
.
==== End Of File ===========================

 

[Jay Pfoutz]

It should be able to be cleaned up!

Please download and run TDSSKiller to your desktop as outlined below:

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

For Windows XP, double-click to start.
For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

-------------------------

Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

------------------------

Click the Start Scan button.

-----------------------

If a suspicious object is detected, the default action will be Skip, click on Continue
If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

----------------------

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

--------------------

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.
Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

-------------------

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue
If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

 

[Mitch Flander]

Hey DragonMaster. Seriously want to thank you again for your help. Ran the TDSSkiller. Returned 2 objects. Medium risk. No "cure" option. I rebooted to see if AVG would report the virus again. It did. Just FYI.... Sorry if I wasn't supposed to do that and I hope I didn't mess up the process. I won't jump the gun again, if that was a screw-up.

I could paste the log file so I did the "upload file" option.

Awaiting your next instructions!

Mitch

 

[Jay Pfoutz]

Please download OTL to your Desktop. (If you already have it downloaded, then just follow the instructions below).

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in
  
  msconfig
  safebootminimal
  activex
  drivers32
  netsvcs
  CreateRestorePoint
  %AppData%\Roaming\Mozilla\Firefox\Profiles\*.default\extensions\ /s /md5
  %AppData%\Local\
  %systemroot%\system32\sysprep
  *.xpi /md5
  %systemroot%\Downloaded Program Files\
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
  hklm\software\clients\startmenuinternet|command /rs
  hklm\software\clients\startmenuinternet|command /64 /rs
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\system32\drivers\*.sys /90
  %systemroot%\System32\config\*.sav
  %SYSTEMDRIVE%\*.exe /md5
  "%WinDir%\$NtUninstallKB*$." /30
  %systemdrive%\Program Files\Common Files\ComObjects\*.* /s
  %systemroot%\*. /mp /s
  %systemroot%\*. /rp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\Installer\ /s
  %systemroot%\system32\Cache\ /s
  %systemroot%\system32\config\systemprofile\Application Data /s
  %PROGRAMFILES%\*.
  %appdata%\*.*
  /md5start
  volsnap.sys
  services.exe
  userinit.exe
  afd.sys
  tcpip.sys
  netbt.sys
  ipsec.sys
  dnsrslvr.dll
  ipnathlp.dll
  netman.dll
  WMIsvc.dll
  srsvc.dll
  sr.sys
  wscsvc.dll
  wuauserv.dll
  qmgr.dll
  es.dll
  cryptsvc.dll
  svchost.exe
  rpcss.dll
  tdx.sys
  wininit.exe
  winlogon.exe
  atapi.sys
  explorer.exe
  /md5stop
• Click the Run Scanbutton. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) and paste (Edit->Paste) the contents of these files, one at a time

Note: in the event that OTL fails to run, please use alternate download links to try again:

http://oldtimer.geekstogo.com/OTL.com
http://oldtimer.geekstogo.com/OTL.scr

 

[Mitch Flander]

DragaonMaster,

OTL logs as requested. Got the error indicating they were too large to paste. I uploaded them both as zip files. Thank you!

 

[Jay Pfoutz]

Please run OTL

• Under the Custom Scans/Fixes box at the bottom, copy and paste in the following:
  
  :OTL
  FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q="
  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
  O16 - DPF: {CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA} http://cmg.atlantawatershed.org:81/jre-6u3-windows-i586-p.exe (Java Plug-in 1.5.0_13)
  O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
  O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://cmg.atlantawatershed.org:81/jre-6u20-windows-i586.exe (Java Plug-in 1.6.0_20)
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
  @Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:0B4227B4
  
  :commands
  [emptytemp]
  [reboot]
  
• Then click the Run Fix button at the top.
• Note: The fix for OTL automatically hides your Desktop and Start menu so the fix can be completed. Do not be alerted, this is normal.
• Please do not exit the program. It might take a while to fix, but allow it to run. If it asks to reboot the computer, allow it to reboot. If the program freezes, and the computer fails to reboot - let me know.
  Lastly, post the contents of the log. (Located at C:\_OTL\Moved Files)

 

[Mitch Flander]

DragonMaster,

OTL runfix ran fine. As soon as it rebooted I got the same AVG threat report (File name: C:\windows\system32\rpcnetp.exe Threat name: IDP.Trojan2428359A. Just FYI....

Post of requested log:

All processes killed
========== OTL ==========
Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
ADS C:\ProgramData\TEMP:0B4227B4 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

 

[Jay Pfoutz]

AVG keeps detecting LoJack for laptop, that's what this is:
SUnknown rpcnetp;rpcnetp; [x]

RPCNETP is a LoJack service. Let's do this scan anyway, and see what happens:

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
• Click Start
• When asked, allow the ActiveX control to install
• Click Start
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
• Click Scan (This scan can take several hours, so please be patient)
• Once the scan is completed, you may close the window
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic

 

[Mitch Flander]

DragonMaster,
My research on rcpnetp showed that Lojack reference, too! I think Absolute software is the parent company, right? That had to have been on my pc for a LONG (I think), so I wonder why AVG is just now reporting it. I'm starting to wonder if we'll be able to get this laptop "right" again. I sure appreciate you trying, though. I know a few symptoms that started a week or so back have become major problems (flash player crashes, some websites won't load but then later do). Anyway, I ran ESET and it found 5 threats. I can't remember them all and didn't make note of them because I thought the log file WOULD. It did NOT. In fact, it only shows 2 lines! I'm posting that, but the threats it listed that I remember are:

Win32\widgi(something)
Win32\Installer.D and 3 more....very similar.. all in Win32. Sorry can't remember the rest.

Here's the log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK

 

[Jay Pfoutz]

This should help finish up...

Please run the F-Secure Online Scanner

• Accept the License Agreement and check the box. Then click on Run Check.
• 
• It will ask you to Run the Java plugin. Please confirm.
• Once the download completes, the window for the scanner will launch.
• Please confirm anymore prompts, and then select Full Scan.
• The scan will take some time to finish, so please be patient.
• When the scan completes, click the Automatic cleaning (recommended) button.
• It will run its cleaning.
• Click the Full report button and Copy & Paste the entire report (except the bold text at the foot of the page) in your next reply. Once that's done, click the Close button on the scan window.

 

[Mitch Flander]

The F-secure scanner is taking a long time to load. The little wheel has been turning for at least 10 minutes. I never got asked to run the java plug-in, either. Is it hung up, do you think?

 

[Mitch Flander]

DragonMaster,

I left the F-secure trying to load and went to bed at midnight. When I checked this morning, the "wheel" was still spinning. It never loaded. Do you have anything else I can try? I appreciate it.

Mitch

 

[Mitch Flander]

This thing is really starting to wreak havoc with my PC. It's a work PC and I'm having trouble with applications now.

 

[Jay Pfoutz]

Sorry that happened. Was unexpected.

ComboFix

Please download ComboFix

by sUBs
From BleepingComputer.com

Please save the file to your Desktop, but rename it first to svchost.exe

Important information about ComboFix

Before the download:

• Please copy and paste these instructions to Notepad and save to your Desktop, or print them - for easier access.
• It is important to rename ComboFix before the download.
• Please do not rename ComboFix to other names, but only the one indicated.

After the download:

• Close any open browsers.
• Very Important: Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Please visit here if you don't know how.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
• Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
• If there is no Internet connection after running ComboFix, then restart your computer to restore back your connection.

Running ComboFix:

• Double click on svchost.exe & follow the prompts.
• It will attempt to install the Recovery Console:

• When ComboFix finishes, it will produce a report for you.
• Please post the "C:\Combo-Fix.txt" in your next reply.

Troubleshooting ComboFix

Safe Mode:

If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there.

(To boot into Safe Mode, tap F8 after BIOS, and just before the Windows
logo appears. A list of options will appear, select "Safe Mode.")

Re-downloading:

If this doesn't work either, try the same method (above method), but try to download it again, except name
ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe.

Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe.

 

[Mitch Flander]

Whew... that was scary. First of all it didn't disconnect the PC from the internet when it started, so I yanked the cord myself to be sure. Then once it finished, I couldn't start a browser and got the message "this is a file marked for deletion"! Anyway, a reboot fixed that one. I'm anxiously waiting for your reply. Funny, AVG has not reported the threat since middle of the day yesterday, but the symptoms are still here and rpcnetp is still running.

Here's the combofix log:

ComboFix 12-08-17.03 - Mitch 08/17/2012 15:10:33.4.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3572.2195 [GMT -4:00]
Running from: c:\users\SG3 13\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
.
.
((((((((((((((((((((((((( Files Created from 2012-07-17 to 2012-08-17 )))))))))))))))))))))))))))))))
.
.
2012-08-17 19:19 . 2012-08-17 19:19 -------- d-----w- c:\users\TEMP\AppData\Local\temp
2012-08-17 19:19 . 2012-08-17 19:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-17 19:19 . 2012-08-17 19:19 -------- d-----w- c:\users\admin 1\AppData\Local\temp
2012-08-16 13:22 . 2012-08-17 12:49 58288 ----a-w- c:\windows\system32\rpcnet.dll
2012-08-16 13:10 . 2012-08-16 13:10 -------- d-----w- c:\program files\ESET
2012-08-16 12:56 . 2012-08-17 12:49 17920 ----a-w- c:\windows\system32\rpcnetp.exe
2012-08-15 17:07 . 2012-08-16 12:56 17920 ----a-w- c:\windows\system32\rpcnetp.dll
2012-08-15 16:25 . 2012-08-15 16:25 -------- d-----w- C:\_OTL
2012-08-14 16:23 . 2012-08-14 16:27 -------- d-----w- c:\users\Mitch\AppData\Roaming\PeaZip
2012-08-14 16:23 . 2012-08-14 16:23 -------- d-----w- c:\program files\PeaZip
2012-08-14 15:51 . 2012-08-14 15:51 -------- d-----w- c:\program files\7-Zip
2012-08-13 15:35 . 2012-08-13 15:35 -------- d-----w- c:\users\Mitch\AppData\Local\Electronic_Arts_Inc
2012-08-13 15:35 . 2012-08-13 15:35 -------- d-----w- c:\programdata\Electronic Arts
2012-08-12 02:16 . 2012-08-17 19:19 -------- d-----w- c:\users\Mitch\AppData\Local\temp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-17 15:20 . 2011-04-11 19:11 411368 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-16 13:21 . 2010-03-23 03:01 13160 ----a-w- c:\windows\system32\Upgrd.exe
2012-08-16 13:21 . 2010-03-23 03:01 58288 ------w- c:\windows\system32\rpcnet.exe
2012-08-15 02:09 . 2012-05-03 12:37 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-15 02:09 . 2011-05-20 03:09 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-03 17:46 . 2011-05-05 21:24 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-03 02:14 . 2010-04-01 11:53 348160 ----a-w- c:\windows\system32\msvcr71.dll
2012-06-03 02:14 . 2010-04-01 11:53 499712 ----a-w- c:\windows\system32\msvcp71.dll
2012-05-28 02:55 . 2010-03-25 01:58 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-05-28 02:55 . 2010-03-25 01:58 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-05-28 02:55 . 2010-03-25 01:58 103736 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-07-19 13:47 . 2012-02-23 21:47 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2011-03-04 00:52 762000 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2011-03-04 00:52 762000 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2011-03-04 00:52 762000 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"40488D29BDB5DFCFC38F8F60CCA5FCD9DB75D9F3._service_run"="c:\program files\Google\Chrome\Application\chrome.exe" [2012-08-14 1229848]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nomtray"="c:\program files\NetMotion Client\nomtray.exe" [2010-02-06 559704]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-04 948880]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\c:\0autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Billminder.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Billminder.lnk
backup=c:\windows\pss\Billminder.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Quicken Startup.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Quicken Startup.lnk
backup=c:\windows\pss\Quicken Startup.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Mitch^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CM Control Center.lnk]
path=c:\users\Mitch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CM Control Center.lnk
backup=c:\windows\pss\CM Control Center.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Mitch^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Livelink Explorer Synchronizer.lnk]
path=c:\users\Mitch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Livelink Explorer Synchronizer.lnk
backup=c:\windows\pss\Livelink Explorer Synchronizer.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\40488D29BDB5DFCFC38F8F60CCA5FCD9DB75D9F3._service_run]
2012-08-14 04:31 1229848 ----a-w- c:\program files\Google\Chrome\Application\chrome.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-02 14:07 843712 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-01-04 02:51 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2009-05-26 20:46 1159168 ------w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2008-12-24 14:26 114688 ------w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2012-07-03 17:46 973488 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2012-07-03 17:46 973488 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mylbx]
2012-03-21 18:22 2143552 ----a-w- c:\program files\My Lockbox\mylbx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
2010-10-16 17:42 279144 ----a-w- c:\windows\System32\nvhotkey.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrnStatusMX]
2007-08-29 21:06 1077248 ----a-w- c:\program files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QAGENT]
2001-08-01 01:59 94208 ----a-w- c:\program files\QUICKENW\qagent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2011-09-26 14:03 1242448 ----a-w- c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 15:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2012-06-03 02:14 296056 ----a-w- c:\program files\real\realplayer\Update\realsched.exe
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 acpials;ALS Sensor Filter;c:\windows\system32\DRIVERS\acpials.sys [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
R3 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys [x]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S1 fsclm;FIPS Encryption Driver;c:\windows\system32\drivers\fsclm.sys [x]
S1 NMDRV;NetMotion Client Driver;c:\program files\NetMotion Client\nmdrv.sys [x]
S1 NMRoam;NetMotion Roaming Detection Daemon;c:\windows\system32\DRIVERS\nmroam.sys [x]
S1 NMutilnt;NetMotion Utility Driver;c:\windows\system32\drivers\nmutilnt.sys [x]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
S2 MESSERV;NetMotion Client;c:\program files\NetMotion Client\messerv.exe [x]
S2 mrtRate;mrtRate; [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
S3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [x]
S3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [x]
S3 cvusbdrv;Dell ControlVault;c:\windows\system32\Drivers\cvusbdrv.sys [x]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y6232.sys [x]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
S3 nmvnic;NMVNIC Network Adapter;c:\windows\system32\DRIVERS\nmvnic.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 02:09]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-30 00:35]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-30 00:35]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://foxnews.com/
Trusted Zone: dwm-cipapps
TCP: DhcpNameServer = 10.11.2.199 10.11.2.200 10.25.10.53 10.11.50.110
FF - ProfilePath - c:\users\Mitch\AppData\Roaming\Mozilla\Firefox\Profiles\0ng2lj8a.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.foxnews.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q=
.
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR
kernel: MBR read successfully
user != kernel MBR !!!
copy of MBR has been found in sector 61 !
copy of MBR has been found in sector 62 !
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,43,27,3b,b5,fa,11,07,4f,98,b8,cb,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,43,27,3b,b5,fa,11,07,4f,98,b8,cb,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(1464)
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\program files\Open Text\Livelink Explorer\LLNS3.dll
c:\program files\Open Text\Livelink Explorer\llsmo.dll
c:\program files\Open Text\Livelink Explorer\lldsbase.dll
c:\program files\Open Text\Livelink Explorer\lllangbase.dll
c:\program files\Open Text\Livelink Explorer\llkrnl.dll
c:\program files\Open Text\Livelink Explorer\llds3.dll
c:\program files\Open Text\Livelink Explorer\otxmlp3.dll
c:\program files\Open Text\Livelink Explorer\lapibase.dll
c:\program files\Open Text\Livelink Explorer\lapiattr.dll
c:\program files\Open Text\Livelink Explorer\llctls3.dll
c:\program files\Open Text\Livelink Explorer\lldsui.dll
c:\program files\Open Text\Livelink Explorer\llopts.dll
c:\program files\Open Text\Livelink Explorer\lllang_en_US.dll
.
Completion time: 2012-08-17 15:20:59
ComboFix-quarantined-files.txt 2012-08-17 19:20
ComboFix2.txt 2012-08-12 04:05
ComboFix3.txt 2012-08-12 02:16
.
Pre-Run: 95,176,343,552 bytes free
Post-Run: 95,272,714,240 bytes free
.
- - End Of File - - 658BC283045494731C9AC42A55624DE1

 

[Mitch Flander]

One more thing here. I mentioned that RCPNET.EXE is not coming up as a threat anymore. I forgot but the reason is I added it to the exceptions in AVG. I figured that was ok since it just keeps popping up as a threat without any success removing it.

 

[Jay Pfoutz]

Okay. That's fine.

Please download aswMBR from here

• Save aswMBR.exe to your Desktop
• Double click aswMBR.exe to run it
• Click the Scan button to start the scan as illustrated below

Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives

• Once the scan finishes click Save log to save the log to your Desktop
  
  
  
  
• Copy and paste the contents of aswMBR.txt back here for review

 

[Mitch Flander]

Thanks again, DragonMaster. Am I supposed to do the "FixMBR" step on the scanner..or is that what you meant about not addressing rootkits yet?
Here's the log:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-18 16:31:58
-----------------------------
16:31:58.230 OS Version: Windows 6.1.7600
16:31:58.230 Number of processors: 2 586 0x170A
16:31:58.230 ComputerName: MITCH-PC UserName: Mitch
16:31:59.260 Initialize success
16:33:49.188 AVAST engine defs: 12081800
16:34:11.027 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
16:34:11.027 Disk 0 Vendor: Size: 0MB BusType: 0
16:34:11.043 Disk 0 MBR read successfully
16:34:11.043 Disk 0 MBR scan
16:34:11.059 Disk 0 Windows 7 default MBR code
16:34:11.059 Disk 0 MBR hidden
16:34:11.059 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 258 MB offset 63
16:34:11.074 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 530432
16:34:11.090 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 227975 MB offset 21501952
16:34:11.121 Disk 0 scanning C:\Windows\system32\drivers
16:34:21.821 Service scanning
16:34:45.907 Modules scanning
16:34:59.538 Disk 0 trace - called modules:
16:34:59.553 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStorV.sys halmacpi.dll
16:34:59.569 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8767b030]
16:34:59.569 3 CLASSPNP.SYS[8cfb059e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86429028]
16:35:11.643 AVAST engine scan C:\Windows
16:35:27.540 AVAST engine scan C:\Windows\system32
16:38:52.502 AVAST engine scan C:\Windows\system32\drivers
16:39:08.278 AVAST engine scan C:\Users\Mitch
17:00:13.100 AVAST engine scan C:\ProgramData
17:10:12.330 Scan finished successfully
17:12:14.157 Disk 0 MBR has been saved successfully to "C:\Users\SG3 13\Desktop\tech help\MBR.dat"
17:12:14.167 The log file has been saved successfully to "C:\Users\SG3 13\Desktop\tech help\aswMBR.txt"

 

[Jay Pfoutz]

Yeah, don't hit that. If there are no more issues, then we shall clean up!

Clean up System Restore

Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

To manually create a new Restore Point

• Go to Control Panel and select System and Maintenance
• Select System
• On the left select Advance System Settings and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name I.e. Clean
• Select Create

Now we can purge the infected ones

• Go back to the System and Maintenance page
• Select Performance Information and Tools
• On the left select Open Disk Cleanup
• Select Files from all users and accept the warning if you get one
• In the drop down box select your main drive I.e. C
• For a few moments the system will make some calculations:
  
  
• Select the More Options tab
  
  
• In the System Restore and Shadow Backups select Clean up
  
  
• Select Delete on the pop up
• Select OK
• Select Delete

Run OTC to remove our tools

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC.exe by OldTimer:

• Save it to your Desktop.
• Double click OTC.exe.
• Click the CleanUp! button.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Purge old temporary files

Download CCleaner Slim and save it to your Desktop - Alternate download link

When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
Follow the prompts to install the program.

* Double-click the CCleaner shortcut on the desktop to start the program.
* Click on the Options block on the left, then choose Cookies.
* Under Cookies to Delete, highlight any cookies you would like to retain permanently
* Click the right arrow > to move them to the Cookies to Keep window.
* Go into Options > Advanced & uncheck Only delete files in Windows Temp folders older than 48 hours
* Click Cleaner on the left then Run Cleaner on the right to run the program.
* Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

Caution: Only use the Registry feature if you are very familiar with the registry.
Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

Security Check

Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Tell me in your next reply, if you have completed these tasks:

• Cleaned System Restore
• Ran OTC
• Ran CCleaner
• Ran Security Check

Also, let me know how your computer is running, and don't forget to post the contents of the Security Check log.

 

[Mitch Flander]

Hey..

I did the first step, but a section of the second step is not showing up. See my highlights in your instructions section that I pasted in red below:

Now we can purge the infected ones

• Go back to the System and Maintenance page
• Select Performance Information and Tools
• On the left select Open Disk Cleanup
• Select Files from all users and accept the warning if you get one <---this step doesn't show up. Goes straight to the next bullet point.
• In the drop down box select your main drive I.e. C
• For a few moments the system will make some calculations:

I'll await your comments before going any further. thanks!

 

[Mitch Flander]

DragonMaster,
You can disregard the above reply. I chose "cleanup system files" and I was able to finally get the choices to get to the goal of deleting all but the most recent restore point.

I went all the way through the steps and before I ran ccleaner, I still get the IDP.Trojan warning from AVG (rcpnetp). I found some steps online and wanted to run this by you. Please check the paste below and see if this method makes sense to you. Otherwise I get this threat on every bootup unless I put in the the "allowed" section in AVG. Bottom line, should I ignore this threat?? Here's the steps:

1) Click START then Run or just Windows key and "R" then Notepad.
2) Type anything you want like Hello there and save the file on the desktop as example : test.txt
3) Copy test.txt to the C:\Windows\System32 filder on Winxp case.
4) Click START go to RUN then type CMD hit enter.
5) From the command line type "CD \Windows\System32" without the quotes and hit enter.
6) Now just type this four commands.
7.1 "copy test.txt rpcnet.exe" its going to ask you if you want to replace the file say yes.
7.2 "copy test.txt rpcnet.dll" enter replace yes.
7.3 "copy test.txt rpcnetp.exe" enter replace yes.
7.4 "copy test.txt rpcnetp.dll" enter replace yes. All this commands without the quotes.
8) Now this other four commands.
8.1 "attrib rpcnet.exe +r" then hit enter.
8.2 "attrib rpcnet.dll +r" hit enter.
8.3 "attrib rpcnetp.exe +r" hit enter.
8.4 "attrib rpcnetp.dll +r" hit enter. Again all the commands above without quotes.
9)Now the files can't be overwritten by the BIOS and you have empty files when windows starts and tries to run them nothing will happen as they are not real DLL or exe files and you will get rid of the LOJACK.

..And here's the last paste (from security check):

Results of screen317's Security Check version 0.99.46
Windows 7 x86 (UAC is enabled)
Out of date service pack!!
Internet Explorer 8 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG Anti-Virus Free Edition 2012
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.62.0.1300
CCleaner
Java(TM) 6 Update 20
Java(TM) 6 Update 3
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.3.300.271
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (14.0.1)
Google Chrome 21.0.1180.77
Google Chrome 21.0.1180.79
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````


Computer seems to be running ok at present, but I'm just worried about the rpcnetp thing....
thanks...

 

[Mitch Flander]

Strike that last comment about "running ok". I'm gettng messages during browsing "a script is causing probs (or something like that)", getting full screen pop-ups that won't let you close without "leave this page" messages or "stay on this page", etc. It tries to deceive and redirect you.
I tried to play a game to check the performance. It ran ok for about 5 mins then the frame rate when WAY down. I was finally able to get out of it and notice CPU usage was at 100%. I finally just shut down because it wasn't getting any better. I have no idea what's up at this point. Definitely not a clean PC.or so it seems.

 

[Jay Pfoutz]

Well, post a new GMER log, and also do the following (I might find interest in this):

Please download Listparts
Run the tool,
check the "list BCD" box
click "Scan" and post the log (Result.txt) it makes.