Redirect Virus Help

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > HijackThis Logs and Virus/Trojan/Spyware/Malware Removal

Forum Guidelines

Read this topic before posting a log.

DO NOT post a ComboFix log unless requested to.

Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

2 Pages

1 2 >

Redirect Virus Help

Options

Erchino View Member Profile	Jun 30 2009, 01:51 PM Post #1
Member Group: Members Posts: 16 Joined: 30-June 09 Member No.: 346,933	Hello, around a month ago firefox and ie started to act extremely weird. Whenever I searched in google and clicked on a link, I was sent to random websites and now it is really starting to bug me. Also, some websites, even if they are not googled take a long time to load, and at the bar at the bottom i always see pagead2.googlesyndication.com loading, and info-feed or something, and sometimes I see random numbers. Then it will randomly send me to the website I wanted or other times redirect me to other websites, and sometimes websites won't load completely at all, forcing me to reload the website many times. I have searched for solutions, and I have found things like hijackthis and malwarebytes, and I have downloaded them but I don't know how to use them. It would be greatly appreciated if someone could help me remove this problem. Also, I don't know if this is also because of the virus, but some websites get a page load error. It says... Failed to Connect Firefox can't establish a connection to the server at website Though the site seems valid, the browser was unable to establish a connection. * Could the site be temporarily unavailable? Try again later. * Are you unable to browse other sites? Check the computer's network connection. * Is your computer or network protected by a firewall or proxy? Incorrect settings can interfere with Web browsing. Here is my hijackthis log from like 5 mins ago... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:23:21 PM, on 6/30/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\DAEMON Tools\daemon.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Administrator\Desktop\virusfix\tools.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file) R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: (no name) - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file) O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [PowerTweak Menu] C:\WINDOWS\system32\mmm.exe O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray O4 - HKCU\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [RGSC] C:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FAH@C:+Documents and Settings+Administrator+Desktop+Games+FarCry2+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe - Unknown owner - C:\WINDOWS\ O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 11021 bytes It would be greatly appreciated if someone could walk me through on solving this problem, thank you.

schrauber View Member Profile	Jul 4 2009, 02:48 AM Post #2
Mr.Mechanic Group: HJT Team Posts: 3,047 Joined: 3-May 08 From: Saarland,Germany Member No.: 206,858	Hello Erchino and welcome to Bleeping Computer We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far. Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware. If you have already posted a DDS log, please do so again, as your situation may have changed. Use the 'Add Reply' and add the new log to this thread. Thanks and again sorry for the delay. We need to see some information about what is happening in your machine. Please perform the following scan: Download DDS by sUBs from one of the following links. Save it to your desktop. DDS.scr DDS.pif Double click on the DDS icon, allow it to run. A small box will open, with an explaination about the tool. No input is needed, the scan is running. Notepad will open with the results. Follow the instructions that pop up for posting the results. Close the program window, and delete the program from your desktop. Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE -------------------- regards, schrauber If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you! If I have helped you then please consider donating to continue the fight against malware

Erchino View Member Profile	Jul 4 2009, 11:15 AM Post #3
Member Group: Members Posts: 16 Joined: 30-June 09 Member No.: 346,933	Hello, thank you very much for answering, I appreciate your help. I have downloaded the DDS file, and have run it, but once it finishes the scan, notepad opens up but blank. The popup telling me the directions do appear however. Is there any way I can make the log open in wordpad rather than notepad? Wordpad in my computer always works, notepad has never worked. Whenever I open a text file in notepad a Create new file pop up appears, and it tells me "C:\etc\etc\; doesn't exist. Create it?". If I click yes, an error (filename - Notepad ++: notepad++.exe- Application Error) pops up telling me "The exception unknown software exception (0xc000000d) occurred in the application at location 0x0045761c". Click on OK to terminate the program. If I click no, the same Create new file pops up, and if I click either yes or no after this, notepad opens up blank. It is strange because this notepad looks somewhat similar to a compiler, I do not know if this is normal. Again, thank you for your help.

syler View Member Profile	Jul 7 2009, 01:40 AM Post #4
Forum Addict Group: HJT Team Posts: 3,903 Joined: 7-November 07 From: Warrington, UK Member No.: 168,228	Hello and welcome to Bleeping Computer. My name is Syler, I will be helping you to solve your Malware issues. Whilst I am helping you, I would be grateful if you would note the following: Please do not run other tools or scans unless I ask you to and follow all the steps I give you, in order. Copy and paste all logs requested in you reply, Do not attach them unless asked too. If you don't know or understand something, please don't hesitate to say or ask before you proceed with my instructions. Please continue to work with me, until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clear. If I do not hear back from you within 5 days of my last post, then this topic will be closed. It sounds like you may have a problem with your file association for txt files, lets see if we can fix this, as you are going to need notepad so I can get the logs I need. Go here http://www.dougknox.com/xp/file_assoc.htm Download the zip file for TXT File Association Fix, save it to your desktop. Extract the contents of the zip then double click xp_txt_fix.reg and click yes. Let me no if this fixes your notepad problem. Thanks -------------------- Any requests for help via PM will be ignored, please use the forums. If I have help you, and you would like to make a donation, click here

Erchino View Member Profile	Jul 7 2009, 12:12 PM Post #5
Member Group: Members Posts: 16 Joined: 30-June 09 Member No.: 346,933	Hello, I resolved the notepad problem by replacing my computer's notepad with another computer's notepad in system32. Apparently my notepad was corrupted, but now the issue is solved and the log shows up now. I attached the Attach.txt file and Here is the DDS log... DDS (Ver_09-06-26.01) - NTFSx86 Run by Administrator at 13:06:05.43 on Tue 07/07/2009 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1264 [GMT -4:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\DAEMON Tools\daemon.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\explorer.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Administrator\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://search.orbitdownloader.com uInternet Settings,ProxyOverride = .local uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll uURLSearchHooks: H - No File uURLSearchHooks: H - No File uURLSearchHooks: H - No File uURLSearchHooks: H - No File mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll mWinlogon: SfcDisable=-99 (0xffffff9d) BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Megaupload Toolbar: {a057a204-bacc-4d26-c39e-35f1d2a32ec8} - c:\progra~1\megaup~1\MEGAUP~1.DLL BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Megaupload Toolbar: {a057a204-bacc-4d26-c39e-35f1d2a32ec8} - c:\progra~1\megaup~1\MEGAUP~1.DLL TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File TB: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No File TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File uRun: [TaskSwitchXP] c:\program files\taskswitchxp\TaskSwitchXP.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [DAEMON Tools Pro Agent] "c:\program files\daemon tools pro\DTProAgent.exe" uRun: [Google Update] "c:\documents and settings\administrator\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [RGSC] c:\program files\rockstar games\rockstar games social club\RGSCLauncher.exe /silent uRun: [Aim6] uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe" uRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033 mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [PowerTweak Menu] c:\windows\system32\mmm.exe mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe" -H mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe dRun: [TaskSwitchXP] c:\program files\taskswitchxp\TaskSwitchXP.exe dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\dropbox.lnk - c:\program files\dropbox\Dropbox.exe uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1) dPolicies-explorer: NoSMHelp = 1 (0x1) dPolicies-explorer: ForceClassicControlPanel = 1 (0x1) dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1) IE: &AIM Toolbar Search - c:\documents and settings\all users\application data\aim toolbar\ietoolbar\resources\en-us\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: avgrsstarter - avgrsstx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\kddvh3hz.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - component: c:\program files\mozilla firefox\components\FFComm.dll FF - plugin: c:\documents and settings\administrator\local settings\application data\google\update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews..wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-7-1 12552] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-7-1 335752] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-7-1 27784] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-7-1 108552] R1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [2009-6-16 33824] R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-7-1 298776] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-6-29 195856] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-9-11 24652] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-6-29 19096] R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-6-29 38160] S0 roji;roji;c:\windows\system32\drivers\vqgzrsjz.sys --> c:\windows\system32\drivers\vqgzrsjz.sys [?] S2 FAH@C:+Documents and Settings+Administrator+Desktop+Games+FarCry2+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe;FAH@C:+Documents and Settings+Administrator+Desktop+Games+FarCry2+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe;c:\documents and settings\administrator\desktop\games\farcry2\[razor1911][web seed] far cry 2 crack - real 100% fully working\fah.exe -svcstart --> c:\documents and settings\administrator\desktop\games\farcry2\[razor1911][web seed] far cry 2 crack - real 100% fully working\FAH.exe -svcstart [?] =============== Created Last 30 ================ 2009-07-07 13:01 69,120 a------- c:\windows\NOTEPAD.EXE 2009-07-06 23:36 <DIR> --d----- c:\program files\MegauploadToolbar 2009-07-04 11:26 <DIR> --d-h--- c:\windows\PIF 2009-07-01 13:26 <DIR> --d----- c:\program files\Pcsx2 2009-07-01 11:55 <DIR> --d----- c:\program files\EA GAMES 2009-07-01 04:34 <DIR> --d----- c:\program files\Spybot - Search & Destroy 2009-07-01 03:38 12,552 a------- c:\windows\system32\drivers\avgrkx86.sys 2009-07-01 03:38 11,952 a------- c:\windows\system32\avgrsstx.dll 2009-07-01 03:38 335,752 a------- c:\windows\system32\drivers\avgldx86.sys 2009-07-01 03:38 <DIR> --d----- c:\windows\system32\drivers\Avg 2009-07-01 03:38 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar 2009-07-01 03:38 108,552 a------- c:\windows\system32\drivers\avgtdix.sys 2009-06-30 13:56 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NortonInstaller 2009-06-29 15:03 <DIR> --d----- c:\program files\hpHosts 2009-06-29 14:16 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-29 14:16 19,096 a------- c:\windows\system32\drivers\mbam.sys 2009-06-29 14:08 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes 2009-06-29 13:53 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware 2009-06-29 13:53 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-06-29 12:39 <DIR> --d----- c:\program files\Click-2U 2009-06-28 13:26 <DIR> --d----- c:\program files\Project64 2009-06-27 15:12 <DIR> --d----- C:\fixwareout 2009-06-27 09:38 <DIR> --d----- C:\Torque 2009-06-27 01:10 <DIR> --d----- c:\program files\TorqueAdvanced 2009-06-27 00:45 <DIR> --d----- c:\program files\Torque 2009-06-26 23:33 <DIR> --d----- c:\program files\common files\Software Update Utility 2009-06-26 23:33 <DIR> --d----- c:\program files\AIM Toolbar 2009-06-26 23:33 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AIM Toolbar 2009-06-25 16:48 <DIR> --d----- c:\program files\common files\DivX Shared 2009-06-16 16:57 33,824 a------- c:\windows\system32\drivers\oreans32.sys 2009-06-16 16:50 <DIR> --d----- c:\program files\EterniaGames 2009-06-14 18:56 <DIR> --d----- c:\docume~1\admini~1\applic~1\Independent 2009-06-14 17:33 4,096 a------- c:\windows\d3dx.dat 2009-06-14 16:04 <DIR> --d----- c:\program files\GarageGames 2009-06-14 15:12 <DIR> --d----- c:\program files\Adventure Game Studio 3.1.2 SP1 2009-06-14 15:10 175 a------- c:\windows\W2W.ini 2009-06-14 15:03 <DIR> --d----- c:\program files\GStudio7 2009-06-14 15:03 17,408 a------- C:\psapi.dll 2009-06-14 13:12 4 a------- c:\windows\system32\ulfconfig0103.ulf 2009-06-14 13:08 <DIR> --d----- c:\program files\Pixologic 2009-06-14 12:14 <DIR> --d----- c:\docume~1\admini~1\applic~1\GarageGames 2009-06-09 11:41 <DIR> --d----- c:\windows\A7E07C2B2220441587E3784D5814BC93.TMP 2009-06-09 11:22 <DIR> --d----- c:\program files\505games ==================== Find3M ==================== 2009-05-22 01:25 162,816 a------- c:\windows\system32\fmod.dll 2009-05-02 20:00 94,208 a------- c:\windows\ScUnin.exe 2009-05-02 20:00 32,930 a------- c:\windows\scunin.dat 2009-04-27 00:49 81,984 a------- c:\windows\system32\bdod.bin 2008-10-25 23:48 22,328 a------- c:\docume~1\admini~1\applic~1\PnkBstrK.sys 2006-05-03 05:06 163,328 ---shr-- c:\windows\system32\flvDX.dll 2007-02-21 06:47 31,232 ---shr-- c:\windows\system32\msfDX.dll 2008-03-16 08:30 216,064 ---shr-- c:\windows\system32\nbDX.dll ============= FINISH: 13:06:14.77 =============== Thank you very much. Attached File(s) Attach.zip ( 3.31k ) Number of downloads: 2

syler View Member Profile	Jul 10 2009, 07:10 PM Post #6
Forum Addict Group: HJT Team Posts: 3,903 Joined: 7-November 07 From: Warrington, UK Member No.: 168,228	Hello Erchino, Im very sorry for the delay in my responce I had forgoten to make sure I get notified when you reply I have done that now sorry again. Please download Malwarebytes' Anti-Malware from Here Note: If you already have Malwarebytes' Anti-Malware, just update then run it. Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Full Scan", then click Scan (the scan may take some time to finish, so please be patient). When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy and Paste the entire report in your next reply . Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. *Next* We need to create an OTL Report Please download OTL from one of the following mirrors: This is THE Mirror Save it to your desktop. Double click on the icon on your desktop. Click the "Scan All Users" checkbox. Push the button. Two reports will open, copy and paste them in a reply here: OTListIt.txt <-- Will be opened Extra.txt <-- Will be minimized Then please post back here with the following: MBAM log OTListIt.txt Extra.txt -------------------- Any requests for help via PM will be ignored, please use the forums. If I have help you, and you would like to make a donation, click here

syler View Member Profile	Jul 11 2009, 11:02 PM Post #8
Forum Addict Group: HJT Team Posts: 3,903 Joined: 7-November 07 From: Warrington, UK Member No.: 168,228	One or more of the identified infections is a backdoor trojan/Rootkit. This allows hackers to remotely control your computer, steal critical system information and download and execute files. I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? When Should I Format, How Should I Reinstall We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide you want to proceed with trying to clean your machine please follow these next steps. We will begin with ComboFix. Please download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed, click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply. This tool is not a toy and not for everyday use. ComboFix SHOULD NOT** be used unless requested by a forum helper If you need help, see this link: http://www.bleepingcomputer.com/combofix/how-to-use-combofix -------------------- Any requests for help via PM will be ignored, please use the forums. If I have help you, and you would like to make a donation, click here

Erchino View Member Profile	Jul 11 2009, 11:51 PM Post #9
Member Group: Members Posts: 16 Joined: 30-June 09 Member No.: 346,933	Hello, I understand the risks. But fortunately this computer does not contain any sensitive information. This computer is one where I do work for school, or play games, but nothing very important. I will proceed by fixing the virus rather than formatting. Here is the log that it created for me (not the ComboFix log) just in case you require it. ComboFix 09-07-09.08 - Administrator 07/12/2009 0:20.1.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1601 [GMT -4:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\recycler\S-1-5-21-1137756934-9911463176-292060987-7670 c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb c:\windows\system32\drivers\gaopdxlkxejumpvwpyotjdpwxsnqgoaywvaowy.sys c:\windows\system32\drivers\gaopdxqdslxobshfhwmhxinvaoigovknukcbqm.sys c:\windows\system32\gaopdxcounter c:\windows\system32\gaopdxmniwqdetpswetvoxseqvuhpcmbnvgflp.dll c:\windows\system32\msconfig.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_gaopdxserv.sys -------\Legacy_OREANS32 -------\Service_oreans32 ((((((((((((((((((((((((( Files Created from 2009-06-12 to 2009-07-12 ))))))))))))))))))))))))))))))) . 2009-07-12 04:36 . 2009-07-12 04:36 -------- d-----w- c:\windows\system32\wbem\snmp 2009-07-12 04:36 . 2009-07-12 04:36 -------- d-----w- c:\windows\system32\xircom 2009-07-12 04:36 . 2009-07-12 04:36 -------- d-----w- c:\program files\microsoft frontpage 2009-07-11 22:38 . 2009-07-11 22:38 -------- d-----w- c:\program files\Valvesoftware 2009-07-10 02:48 . 2009-07-10 02:48 -------- d-----w- c:\program files\LucasArts 2009-07-09 15:50 . 2009-07-09 15:50 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\CAPCOM 2009-07-09 15:23 . 2009-07-09 15:23 -------- d-----w- c:\program files\CAPCOM 2009-07-09 15:22 . 2009-03-09 19:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-07-09 15:22 . 2009-03-09 19:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-07-09 15:22 . 2009-03-16 18:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-07-09 15:22 . 2009-03-16 18:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-07-09 15:22 . 2009-03-09 19:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-07-09 15:22 . 2009-03-16 18:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-07-07 17:01 . 2004-08-10 04:00 69120 ----a-w- c:\windows\NOTEPAD.EXE 2009-07-07 13:16 . 2009-07-01 07:38 327688 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgldx86.sys 2009-07-07 13:16 . 2009-07-01 07:38 2314496 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgdiagex.exe 2009-07-07 13:16 . 2009-07-01 07:38 493336 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtbapi.dll 2009-07-07 13:16 . 2009-07-01 07:38 3402008 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe 2009-07-07 13:16 . 2009-07-01 07:38 1204504 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgabout.dll 2009-07-07 13:16 . 2009-07-01 07:38 337176 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avglogx.dll 2009-07-07 13:16 . 2009-07-01 07:38 1085208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe 2009-07-07 03:44 . 2008-08-04 20:44 1060808 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kddvh3hz.default\extensions\{991A772A-BA13-4c1d-A9EF-F897F31DEC7D}\chrome\cache\megauper.exe 2009-07-07 03:36 . 2009-07-07 03:36 -------- d-----w- c:\program files\MegauploadToolbar 2009-07-04 15:26 . 2009-07-04 15:26 -------- d--h--w- c:\windows\PIF 2009-07-02 04:26 . 2009-07-02 04:26 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera 2009-07-02 04:26 . 2009-07-02 04:26 -------- d-----w- c:\program files\Opera 2009-07-01 17:48 . 2009-07-01 17:48 12862 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0E2B767B-EA6A-489B-BF83-8083FE1DB661}\_1EEFFF72773535163E4216.exe 2009-07-01 17:26 . 2009-07-01 18:55 -------- d-----w- c:\program files\Pcsx2 2009-07-01 15:55 . 2009-07-01 15:55 -------- d-----w- c:\program files\EA GAMES 2009-07-01 08:34 . 2009-07-01 14:36 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-01 08:04 . 2009-07-01 08:03 2052376 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll 2009-07-01 08:04 . 2009-07-01 08:03 3298072 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe 2009-07-01 08:04 . 2009-07-01 08:03 829208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcfgx.dll 2009-07-01 08:04 . 2009-07-01 07:38 1261344 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwd.dll 2009-07-01 08:04 . 2009-07-01 07:38 352024 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgxch32.dll 2009-07-01 08:03 . 2009-07-01 07:38 27784 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmfx86.sys 2009-07-01 08:03 . 2009-07-01 08:03 1454360 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll 2009-07-01 07:46 . 2009-06-02 17:38 1004800 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll 2009-07-01 07:38 . 2009-07-01 07:38 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2009-07-01 07:38 . 2009-07-01 07:38 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-07-01 07:38 . 2009-07-07 13:16 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-07-01 07:38 . 2009-07-01 08:03 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-07-01 07:38 . 2009-07-11 23:21 -------- d-----w- c:\windows\system32\drivers\Avg 2009-07-01 07:38 . 2009-07-01 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar 2009-07-01 07:38 . 2009-07-01 07:38 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-06-30 17:56 . 2009-06-30 17:56 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-06-29 19:03 . 2009-06-29 19:03 -------- d-----w- c:\program files\hpHosts 2009-06-29 18:08 . 2009-06-29 18:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-06-29 17:59 . 2009-06-29 17:59 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Installer3148 2009-06-29 17:53 . 2009-07-11 23:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-29 17:53 . 2009-06-29 17:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-29 16:39 . 2009-07-01 17:46 -------- d-----w- c:\program files\Click-2U 2009-06-28 17:26 . 2009-06-29 05:50 -------- d-----w- c:\program files\Project64 2009-06-27 19:12 . 2009-06-27 19:12 -------- d-----w- C:\fixwareout 2009-06-27 13:38 . 2009-06-27 13:38 -------- d-----w- C:\Torque 2009-06-27 05:10 . 2009-06-27 05:26 -------- d-----w- c:\program files\TorqueAdvanced 2009-06-27 04:45 . 2009-06-27 05:30 -------- d-----w- c:\program files\Torque 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\program files\Common Files\Software Update Utility 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\program files\AIM Toolbar 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM Toolbar 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AIM Toolbar 2009-06-25 20:48 . 2009-06-25 20:48 -------- d-----w- c:\program files\Common Files\DivX Shared 2009-06-16 20:57 . 2009-06-16 20:57 33824 ----a-w- c:\windows\system32\drivers\oreans32.sys 2009-06-16 20:50 . 2009-06-16 20:50 -------- d-----w- c:\program files\EterniaGames 2009-06-14 22:56 . 2009-06-26 06:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\Independent 2009-06-14 21:33 . 2009-06-14 21:33 4096 ----a-w- c:\windows\d3dx.dat 2009-06-14 20:04 . 2009-06-14 20:54 -------- d-----w- c:\program files\GarageGames 2009-06-14 19:12 . 2009-06-18 22:13 -------- d-----w- c:\program files\Adventure Game Studio 3.1.2 SP1 2009-06-14 19:03 . 2009-06-14 19:11 -------- d-----w- c:\program files\GStudio7 2009-06-14 19:03 . 2009-06-14 19:03 17408 ----a-w- C:\psapi.dll 2009-06-14 17:08 . 2009-06-14 17:08 -------- d-----w- c:\program files\Pixologic 2009-06-14 16:14 . 2009-06-14 16:14 4927488 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\products\legions_instantaction_com\23\install\Legions.exe 2009-06-14 16:14 . 2009-06-14 16:14 3727720 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\products\legions_instantaction_com\23\install\d3dx9_35.dll 2009-06-14 16:14 . 2009-06-14 16:14 345088 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\products\legions_instantaction_com\23\install\fmodex.dll 2009-06-14 16:14 . 2009-02-23 18:42 652608 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\iaplugin.dll 2009-06-14 16:14 . 2009-06-26 06:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\GarageGames . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-12 00:58 . 2008-12-26 21:11 -------- d-----w- c:\program files\Dropbox 2009-07-12 00:20 . 2008-12-01 00:21 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0 2009-07-12 00:15 . 2009-03-14 03:25 -------- d-----w- c:\program files\MDM 2009-07-12 00:15 . 2008-09-11 05:03 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-11 23:18 . 2008-12-26 21:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\Dropbox 2009-07-11 15:49 . 2008-09-11 05:33 -------- d-----w- c:\documents and settings\Administrator\Application Data\Azureus 2009-07-11 04:21 . 2008-09-21 01:28 -------- d-----w- c:\documents and settings\Administrator\Application Data\MegauploadToolbar 2009-07-10 02:48 . 2008-09-11 05:02 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-04 19:33 . 2008-09-11 05:33 76768 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-07-04 15:46 . 2008-09-12 04:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-07-04 15:44 . 2008-09-12 00:20 -------- d-----w- c:\program files\MSBuild 2009-07-04 15:37 . 2008-09-11 22:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Autodesk 2009-07-04 15:35 . 2008-09-11 22:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk 2009-07-01 07:38 . 2008-09-11 05:40 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8 2009-06-30 17:53 . 2008-09-11 05:20 -------- d-----w- c:\program files\Google 2009-06-30 15:43 . 2008-12-03 04:41 -------- d-----w- c:\program files\Yahoo! 2009-06-30 03:29 . 2009-03-12 21:45 -------- d-----w- c:\program files\Microsoft ActiveSync 2009-06-30 03:29 . 2008-10-06 01:37 -------- d-----w- c:\program files\Sun 2009-06-30 03:27 . 2008-09-11 22:44 -------- d-----w- c:\program files\Bonjour 2009-06-30 03:19 . 2008-10-06 02:58 -------- d-----w- c:\program files\Common Files\Apple 2009-06-27 03:36 . 2009-01-09 00:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\Orbit 2009-06-27 03:33 . 2008-09-11 05:30 -------- d-----w- c:\program files\AIM6 2009-06-27 03:33 . 2008-09-11 05:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint 2009-06-27 03:29 . 2009-06-27 03:29 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads 2009-06-25 20:48 . 2008-10-11 01:11 -------- d-----w- c:\program files\DivX 2009-06-19 19:06 . 2008-12-01 00:31 18368 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSA\9.0\1033\ResourceCache.dll 2009-06-19 19:06 . 2008-12-01 00:31 1680160 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\9.0\1033\ResourceCache.dll 2009-06-09 15:41 . 2008-10-25 16:01 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-06-09 15:22 . 2009-06-09 15:22 -------- d-----w- c:\program files\505games 2009-06-04 18:29 . 2009-06-04 18:29 -------- d-----w- c:\program files\Electronic Arts 2009-06-03 22:05 . 2008-11-24 17:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Move Networks 2009-05-29 03:34 . 2009-05-29 03:34 1915520 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 2009-05-29 03:33 . 2009-05-29 03:33 1878984 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe 2009-05-22 21:38 . 2009-05-22 21:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ubisoft 2009-05-22 20:59 . 2009-05-22 20:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft 2009-05-22 05:25 . 2009-05-11 03:28 162816 ----a-w- c:\windows\system32\fmod.dll 2009-05-19 05:36 . 2009-06-27 03:29 97072 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\bsetutil.exe 2009-05-19 05:36 . 2009-06-27 03:29 2884832 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\vwpt.exe 2009-05-19 05:36 . 2009-06-27 03:29 28 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\unregister.bat 2009-05-19 05:36 . 2009-06-27 03:29 25 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\register.bat 2009-05-19 05:36 . 2009-06-27 03:29 1484856 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\toolbar.exe 2009-05-19 05:36 . 2009-06-27 03:29 142040 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\alsetup.exe 2009-05-19 05:36 . 2009-06-27 03:29 30512 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\Uninstaller.exe 2009-05-19 05:36 . 2009-06-27 03:29 111920 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\AOLSearch.dll 2009-05-18 03:59 . 2009-04-26 23:16 -------- d-----w- c:\program files\Common Files\BitDefender 2009-05-18 01:05 . 2009-05-18 01:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Canneverbe_Limited 2009-05-18 01:04 . 2009-05-18 01:04 -------- d-----w- c:\program files\CDBurnerXP 2009-05-16 02:14 . 2009-04-25 23:45 -------- d-----w- c:\program files\Starcraft 2009-05-06 18:11 . 2009-05-06 18:11 69120 ----a-w- c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\aimtbres.dll 2009-05-03 00:00 . 2009-05-03 00:00 32930 ----a-w- c:\windows\scunin.dat 2009-05-03 00:00 . 2009-05-03 00:00 967 ----a-w- c:\windows\ScUnin.pif 2009-05-03 00:00 . 2009-05-03 00:00 94208 ----a-w- c:\windows\ScUnin.exe 2009-05-02 16:22 . 2009-05-02 16:22 529 ----a-w- c:\windows\eReg.dat 2009-05-02 15:40 . 2009-03-29 23:27 247384 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-04-27 04:49 . 2009-04-27 00:45 81984 ----a-w- c:\windows\system32\bdod.bin 2009-04-22 04:20 . 2009-04-22 04:20 14311680 ----a-w- c:\windows\system32\xlive.dll 2009-04-22 04:20 . 2009-04-22 04:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll 2009-04-17 18:01 . 2009-04-17 18:01 1059112 ----a-w- c:\documents and settings\LocalService\Application Data\MEGAUPLOADTOOLBAR\megauper.exe 2008-08-13 23:02 . 2008-08-13 23:02 35840 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll 2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 2006-05-03 09:06 . 2008-10-03 08:42 163328 --sh--r- c:\windows\system32\flvDX.dll 2007-02-21 10:47 . 2008-10-03 08:42 31232 --sh--r- c:\windows\system32\msfDX.dll 2008-03-16 12:30 . 2008-10-03 08:42 216064 --sh--r- c:\windows\system32\nbDX.dll . ------- Sigcheck ------- [-] 2008-05-21 15:19 361344 68F06FE0021B01E670AF37B8C5964FDF c:\windows\system32\drivers\tcpip.sys [-] 2008-05-21 15:35 547328 A55B8899D2EA2E800061BCFD456E34DC c:\windows\system32\winlogon.exe [-] 2008-05-21 15:33 1551872 C26978D5F821A7330439DD7F0AAAF678 c:\windows\explorer.exe [-] 2008-05-21 15:33 25088 B5E8782D4AF1B3756F38E11E7C157BBE c:\windows\system32\ctfmon.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-C39E-35F1D2A32EC8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-06-16 13:29 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-05-21 25088] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-19 133104] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-08-16 167368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168] "PowerTweak Menu"="c:\windows\system32\mmm.exe" [2005-07-05 828416] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-03-16 868352] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-27 148888] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-10 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-10 81920] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-01 1948440] "BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-05-10 1626112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-03-01 124928] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-07-01 07:38 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Program Files\\AVG\\AVG8\\avgam.exe"= "c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"= "c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\CAPCOM\\STREETFIGHTERIV\\StreetFighterIV.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "<NO NAME>"= "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service . Contents of the 'Scheduled Tasks' folder 2009-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1004336348-1177238915-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-19 01:43] 2009-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1004336348-1177238915-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-19 01:43] 2009-07-11 c:\windows\Tasks\Malwarebytes' Scheduled Scan for Administrator.job - c:\program files\Malwarebytes' Anti-Malware\yoyo.exe [2009-06-29 15:27] . - - - - ORPHANS REMOVED - - - - HKCU-Run-RGSC - c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe HKCU-Run-Aim6 - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://search.orbitdownloader.com uInternet Settings,ProxyOverride = .local IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kddvh3hz.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews..wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-12 00:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ "ServiceDll"="c:\windows\system32\es.dll" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@C:+Documents and Settings+Administrator+Desktop+Games+FarCry2+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] "ImagePath"="c:\documents and settings\Administrator\Desktop\Games\FarCry2\ [RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING\FAH.exe -svcstart" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@C:+Documents and Settings+Administrator+Desktop+Games+FarCry2+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] "ImagePath"="c:\documents and settings\Administrator\Desktop\Games\FarCry2\ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1993962763-1004336348-1177238915-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY] "??"=hex:74,ae,4a,63,72,d9,b5,2b,1b,d4,5e,93,e7,18,5f,fd,34,78,ce,7e,26,79,57, 27,d6,da,03,92,32,66,18,a6,46,3f,ce,c4,55,6f,5b,49,87,df,70,52,1b,03,1e,4e,\ "??"=hex:69,6f,5c,46,6a,89,f9,ee,2d,48,e0,10,87,42,1e,12 [HKEY_USERS\S-1-5-21-1993962763-1004336348-1177238915-500\Software\SecuROM\License information] "datasecu"=hex:35,90,47,3c,39,4f,70,06,19,e3,cf,28,df,bb,d2,dd,93,d9,02,5b,2f, 3c,b9,0e,58,16,02,67,84,f6,41,60,16,7c,08,4d,fb,bb,ce,fd,a1,ac,a0,e2,bb,96,\ "rkeysecu"=hex:93,92,7c,fc,f7,ff,aa,56,7f,eb,9e,8d,d9,17,a8,04 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(780) c:\windows\system32\sfc_os.dll c:\windows\system32\COMRes.dll c:\windows\system32\cscui.dll - - - - - - - > 'explorer.exe'(2940) c:\windows\system32\CRYPT32.dll c:\windows\system32\MSASN1.dll c:\program files\Unlocker\UnlockerHook.dll c:\windows\system32\msctfime.ime c:\windows\system32\COMRes.dll c:\windows\System32\cscui.dll c:\windows\system32\SETUPAPI.dll c:\windows\system32\msi.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\system32\MSVCP60.dll c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\progra~1\AVG\AVG8\avgwdsvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\progra~1\AVG\AVG8\avgam.exe c:\program files\AVG\AVG8\avgrsx.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\CDBurnerXP\NMSAccessU.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\HPZipm12.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\Viewpoint\Common\ViewpointService.exe c:\windows\system32\rundll32.exe c:\windows\system32\rundll32.exe c:\progra~1\MI3AA1~1\rapimgr.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************ . Completion time: 2009-07-12 0:48 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-12 04:47 Pre-Run: 70,201,663,488 bytes free Post-Run: 74,931,351,552 bytes free 385 And here is the ComboFix log:** ComboFix 09-07-09.08 - Administrator 07/12/2009 0:20.1.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1601 [GMT -4:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\recycler\S-1-5-21-1137756934-9911463176-292060987-7670 c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb c:\windows\system32\drivers\gaopdxlkxejumpvwpyotjdpwxsnqgoaywvaowy.sys c:\windows\system32\drivers\gaopdxqdslxobshfhwmhxinvaoigovknukcbqm.sys c:\windows\system32\gaopdxcounter c:\windows\system32\gaopdxmniwqdetpswetvoxseqvuhpcmbnvgflp.dll c:\windows\system32\msconfig.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_gaopdxserv.sys -------\Legacy_OREANS32 -------\Service_oreans32 ((((((((((((((((((((((((( Files Created from 2009-06-12 to 2009-07-12 ))))))))))))))))))))))))))))))) . 2009-07-12 04:36 . 2009-07-12 04:36 -------- d-----w- c:\windows\system32\wbem\snmp 2009-07-12 04:36 . 2009-07-12 04:36 -------- d-----w- c:\windows\system32\xircom 2009-07-12 04:36 . 2009-07-12 04:36 -------- d-----w- c:\program files\microsoft frontpage 2009-07-11 22:38 . 2009-07-11 22:38 -------- d-----w- c:\program files\Valvesoftware 2009-07-10 02:48 . 2009-07-10 02:48 -------- d-----w- c:\program files\LucasArts 2009-07-09 15:50 . 2009-07-09 15:50 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\CAPCOM 2009-07-09 15:23 . 2009-07-09 15:23 -------- d-----w- c:\program files\CAPCOM 2009-07-09 15:22 . 2009-03-09 19:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-07-09 15:22 . 2009-03-09 19:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-07-09 15:22 . 2009-03-16 18:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-07-09 15:22 . 2009-03-16 18:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-07-09 15:22 . 2009-03-09 19:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-07-09 15:22 . 2009-03-16 18:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-07-07 17:01 . 2004-08-10 04:00 69120 ----a-w- c:\windows\NOTEPAD.EXE 2009-07-07 13:16 . 2009-07-01 07:38 327688 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgldx86.sys 2009-07-07 13:16 . 2009-07-01 07:38 2314496 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgdiagex.exe 2009-07-07 13:16 . 2009-07-01 07:38 493336 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtbapi.dll 2009-07-07 13:16 . 2009-07-01 07:38 3402008 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe 2009-07-07 13:16 . 2009-07-01 07:38 1204504 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgabout.dll 2009-07-07 13:16 . 2009-07-01 07:38 337176 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avglogx.dll 2009-07-07 13:16 . 2009-07-01 07:38 1085208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe 2009-07-07 03:44 . 2008-08-04 20:44 1060808 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kddvh3hz.default\extensions\{991A772A-BA13-4c1d-A9EF-F897F31DEC7D}\chrome\cache\megauper.exe 2009-07-07 03:36 . 2009-07-07 03:36 -------- d-----w- c:\program files\MegauploadToolbar 2009-07-04 15:26 . 2009-07-04 15:26 -------- d--h--w- c:\windows\PIF 2009-07-02 04:26 . 2009-07-02 04:26 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera 2009-07-02 04:26 . 2009-07-02 04:26 -------- d-----w- c:\program files\Opera 2009-07-01 17:48 . 2009-07-01 17:48 12862 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0E2B767B-EA6A-489B-BF83-8083FE1DB661}\_1EEFFF72773535163E4216.exe 2009-07-01 17:26 . 2009-07-01 18:55 -------- d-----w- c:\program files\Pcsx2 2009-07-01 15:55 . 2009-07-01 15:55 -------- d-----w- c:\program files\EA GAMES 2009-07-01 08:34 . 2009-07-01 14:36 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-01 08:04 . 2009-07-01 08:03 2052376 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll 2009-07-01 08:04 . 2009-07-01 08:03 3298072 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe 2009-07-01 08:04 . 2009-07-01 08:03 829208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcfgx.dll 2009-07-01 08:04 . 2009-07-01 07:38 1261344 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwd.dll 2009-07-01 08:04 . 2009-07-01 07:38 352024 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgxch32.dll 2009-07-01 08:03 . 2009-07-01 07:38 27784 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmfx86.sys 2009-07-01 08:03 . 2009-07-01 08:03 1454360 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll 2009-07-01 07:46 . 2009-06-02 17:38 1004800 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll 2009-07-01 07:38 . 2009-07-01 07:38 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2009-07-01 07:38 . 2009-07-01 07:38 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-07-01 07:38 . 2009-07-07 13:16 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-07-01 07:38 . 2009-07-01 08:03 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-07-01 07:38 . 2009-07-11 23:21 -------- d-----w- c:\windows\system32\drivers\Avg 2009-07-01 07:38 . 2009-07-01 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar 2009-07-01 07:38 . 2009-07-01 07:38 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-06-30 17:56 . 2009-06-30 17:56 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-06-29 19:03 . 2009-06-29 19:03 -------- d-----w- c:\program files\hpHosts 2009-06-29 18:08 . 2009-06-29 18:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-06-29 17:59 . 2009-06-29 17:59 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Installer3148 2009-06-29 17:53 . 2009-07-11 23:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-29 17:53 . 2009-06-29 17:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-29 16:39 . 2009-07-01 17:46 -------- d-----w- c:\program files\Click-2U 2009-06-28 17:26 . 2009-06-29 05:50 -------- d-----w- c:\program files\Project64 2009-06-27 19:12 . 2009-06-27 19:12 -------- d-----w- C:\fixwareout 2009-06-27 13:38 . 2009-06-27 13:38 -------- d-----w- C:\Torque 2009-06-27 05:10 . 2009-06-27 05:26 -------- d-----w- c:\program files\TorqueAdvanced 2009-06-27 04:45 . 2009-06-27 05:30 -------- d-----w- c:\program files\Torque 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\program files\Common Files\Software Update Utility 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\program files\AIM Toolbar 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM Toolbar 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AIM Toolbar 2009-06-25 20:48 . 2009-06-25 20:48 -------- d-----w- c:\program files\Common Files\DivX Shared 2009-06-16 20:57 . 2009-06-16 20:57 33824 ----a-w- c:\windows\system32\drivers\oreans32.sys 2009-06-16 20:50 . 2009-06-16 20:50 -------- d-----w- c:\program files\EterniaGames 2009-06-14 22:56 . 2009-06-26 06:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\Independent 2009-06-14 21:33 . 2009-06-14 21:33 4096 ----a-w- c:\windows\d3dx.dat 2009-06-14 20:04 . 2009-06-14 20:54 -------- d-----w- c:\program files\GarageGames 2009-06-14 19:12 . 2009-06-18 22:13 -------- d-----w- c:\program files\Adventure Game Studio 3.1.2 SP1 2009-06-14 19:03 . 2009-06-14 19:11 -------- d-----w- c:\program files\GStudio7 2009-06-14 19:03 . 2009-06-14 19:03 17408 ----a-w- C:\psapi.dll 2009-06-14 17:08 . 2009-06-14 17:08 -------- d-----w- c:\program files\Pixologic 2009-06-14 16:14 . 2009-06-14 16:14 4927488 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\products\legions_instantaction_com\23\install\Legions.exe 2009-06-14 16:14 . 2009-06-14 16:14 3727720 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\products\legions_instantaction_com\23\install\d3dx9_35.dll 2009-06-14 16:14 . 2009-06-14 16:14 345088 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\products\legions_instantaction_com\23\install\fmodex.dll 2009-06-14 16:14 . 2009-02-23 18:42 652608 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\iaplugin.dll 2009-06-14 16:14 . 2009-06-26 06:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\GarageGames . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-12 00:58 . 2008-12-26 21:11 -------- d-----w- c:\program files\Dropbox 2009-07-12 00:20 . 2008-12-01 00:21 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0 2009-07-12 00:15 . 2009-03-14 03:25 -------- d-----w- c:\program files\MDM 2009-07-12 00:15 . 2008-09-11 05:03 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-11 23:18 . 2008-12-26 21:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\Dropbox 2009-07-11 15:49 . 2008-09-11 05:33 -------- d-----w- c:\documents and settings\Administrator\Application Data\Azureus 2009-07-11 04:21 . 2008-09-21 01:28 -------- d-----w- c:\documents and settings\Administrator\Application Data\MegauploadToolbar 2009-07-10 02:48 . 2008-09-11 05:02 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-04 19:33 . 2008-09-11 05:33 76768 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-07-04 15:46 . 2008-09-12 04:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-07-04 15:44 . 2008-09-12 00:20 -------- d-----w- c:\program files\MSBuild 2009-07-04 15:37 . 2008-09-11 22:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Autodesk 2009-07-04 15:35 . 2008-09-11 22:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk 2009-07-01 07:38 . 2008-09-11 05:40 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8 2009-06-30 17:53 . 2008-09-11 05:20 -------- d-----w- c:\program files\Google 2009-06-30 15:43 . 2008-12-03 04:41 -------- d-----w- c:\program files\Yahoo! 2009-06-30 03:29 . 2009-03-12 21:45 -------- d-----w- c:\program files\Microsoft ActiveSync 2009-06-30 03:29 . 2008-10-06 01:37 -------- d-----w- c:\program files\Sun 2009-06-30 03:27 . 2008-09-11 22:44 -------- d-----w- c:\program files\Bonjour 2009-06-30 03:19 . 2008-10-06 02:58 -------- d-----w- c:\program files\Common Files\Apple 2009-06-27 03:36 . 2009-01-09 00:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\Orbit 2009-06-27 03:33 . 2008-09-11 05:30 -------- d-----w- c:\program files\AIM6 2009-06-27 03:33 . 2008-09-11 05:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint 2009-06-27 03:29 . 2009-06-27 03:29 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads 2009-06-25 20:48 . 2008-10-11 01:11 -------- d-----w- c:\program files\DivX 2009-06-19 19:06 . 2008-12-01 00:31 18368 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSA\9.0\1033\ResourceCache.dll 2009-06-19 19:06 . 2008-12-01 00:31 1680160 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\9.0\1033\ResourceCache.dll 2009-06-09 15:41 . 2008-10-25 16:01 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-06-09 15:22 . 2009-06-09 15:22 -------- d-----w- c:\program files\505games 2009-06-04 18:29 . 2009-06-04 18:29 -------- d-----w- c:\program files\Electronic Arts 2009-06-03 22:05 . 2008-11-24 17:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Move Networks 2009-05-29 03:34 . 2009-05-29 03:34 1915520 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 2009-05-29 03:33 . 2009-05-29 03:33 1878984 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe 2009-05-22 21:38 . 2009-05-22 21:38 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ubisoft 2009-05-22 20:59 . 2009-05-22 20:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft 2009-05-22 05:25 . 2009-05-11 03:28 162816 ----a-w- c:\windows\system32\fmod.dll 2009-05-19 05:36 . 2009-06-27 03:29 97072 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\bsetutil.exe 2009-05-19 05:36 . 2009-06-27 03:29 2884832 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\vwpt.exe 2009-05-19 05:36 . 2009-06-27 03:29 28 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\unregister.bat 2009-05-19 05:36 . 2009-06-27 03:29 25 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\register.bat 2009-05-19 05:36 . 2009-06-27 03:29 1484856 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\toolbar.exe 2009-05-19 05:36 . 2009-06-27 03:29 142040 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\alsetup.exe 2009-05-19 05:36 . 2009-06-27 03:29 30512 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\Uninstaller.exe 2009-05-19 05:36 . 2009-06-27 03:29 111920 ----a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\AOLSearch.dll 2009-05-18 03:59 . 2009-04-26 23:16 -------- d-----w- c:\program files\Common Files\BitDefender 2009-05-18 01:05 . 2009-05-18 01:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Canneverbe_Limited 2009-05-18 01:04 . 2009-05-18 01:04 -------- d-----w- c:\program files\CDBurnerXP 2009-05-16 02:14 . 2009-04-25 23:45 -------- d-----w- c:\program files\Starcraft 2009-05-06 18:11 . 2009-05-06 18:11 69120 ----a-w- c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\aimtbres.dll 2009-05-03 00:00 . 2009-05-03 00:00 32930 ----a-w- c:\windows\scunin.dat 2009-05-03 00:00 . 2009-05-03 00:00 967 ----a-w- c:\windows\ScUnin.pif 2009-05-03 00:00 . 2009-05-03 00:00 94208 ----a-w- c:\windows\ScUnin.exe 2009-05-02 16:22 . 2009-05-02 16:22 529 ----a-w- c:\windows\eReg.dat 2009-05-02 15:40 . 2009-03-29 23:27 247384 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-04-27 04:49 . 2009-04-27 00:45 81984 ----a-w- c:\windows\system32\bdod.bin 2009-04-22 04:20 . 2009-04-22 04:20 14311680 ----a-w- c:\windows\system32\xlive.dll 2009-04-22 04:20 . 2009-04-22 04:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll 2009-04-17 18:01 . 2009-04-17 18:01 1059112 ----a-w- c:\documents and settings\LocalService\Application Data\MEGAUPLOADTOOLBAR\megauper.exe 2008-08-13 23:02 . 2008-08-13 23:02 35840 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll 2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 2006-05-03 09:06 . 2008-10-03 08:42 163328 --sh--r- c:\windows\system32\flvDX.dll 2007-02-21 10:47 . 2008-10-03 08:42 31232 --sh--r- c:\windows\system32\msfDX.dll 2008-03-16 12:30 . 2008-10-03 08:42 216064 --sh--r- c:\windows\system32\nbDX.dll . ------- Sigcheck ------- [-] 2008-05-21 15:19 361344 68F06FE0021B01E670AF37B8C5964FDF c:\windows\system32\drivers\tcpip.sys [-] 2008-05-21 15:35 547328 A55B8899D2EA2E800061BCFD456E34DC c:\windows\system32\winlogon.exe [-] 2008-05-21 15:33 1551872 C26978D5F821A7330439DD7F0AAAF678 c:\windows\explorer.exe [-] 2008-05-21 15:33 25088 B5E8782D4AF1B3756F38E11E7C157BBE c:\windows\system32\ctfmon.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-C39E-35F1D2A32EC8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-06-16 13:29 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-05-21 25088] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-19 133104] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-08-16 167368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168] "PowerTweak Menu"="c:\windows\system32\mmm.exe" [2005-07-05 828416] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-03-16 868352] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-27 148888] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-10 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-10 81920] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-01 1948440] "BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-05-10 1626112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-03-01 124928] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-07-01 07:38 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Program Files\\AVG\\AVG8\\avgam.exe"= "c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"= "c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\CAPCOM\\STREETFIGHTERIV\\StreetFighterIV.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "<NO NAME>"= "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service . Contents of the 'Scheduled Tasks' folder 2009-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1004336348-1177238915-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-19 01:43] 2009-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1004336348-1177238915-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-19 01:43] 2009-07-11 c:\windows\Tasks\Malwarebytes' Scheduled Scan for Administrator.job - c:\program files\Malwarebytes' Anti-Malware\yoyo.exe [2009-06-29 15:27] . - - - - ORPHANS REMOVED - - - - HKCU-Run-RGSC - c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe HKCU-Run-Aim6 - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://search.orbitdownloader.com uInternet Settings,ProxyOverride = .local IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kddvh3hz.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews..wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-12 00:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ "ServiceDll"="c:\windows\system32\es.dll" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@C:+Documents and Settings+Administrator+Desktop+Games+FarCry2+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] "ImagePath"="c:\documents and settings\Administrator\Desktop\Games\FarCry2\ [RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING\FAH.exe -svcstart" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@C:+Documents and Settings+Administrator+Desktop+Games+FarCry2+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] "ImagePath"="c:\documents and settings\Administrator\Desktop\Games\FarCry2\ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1993962763-1004336348-1177238915-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY] "??"=hex:74,ae,4a,63,72,d9,b5,2b,1b,d4,5e,93,e7,18,5f,fd,34,78,ce,7e,26,79,57, 27,d6,da,03,92,32,66,18,a6,46,3f,ce,c4,55,6f,5b,49,87,df,70,52,1b,03,1e,4e,\ "??"=hex:69,6f,5c,46,6a,89,f9,ee,2d,48,e0,10,87,42,1e,12 [HKEY_USERS\S-1-5-21-1993962763-1004336348-1177238915-500\Software\SecuROM\License information] "datasecu"=hex:35,90,47,3c,39,4f,70,06,19,e3,cf,28,df,bb,d2,dd,93,d9,02,5b,2f, 3c,b9,0e,58,16,02,67,84,f6,41,60,16,7c,08,4d,fb,bb,ce,fd,a1,ac,a0,e2,bb,96,\ "rkeysecu"=hex:93,92,7c,fc,f7,ff,aa,56,7f,eb,9e,8d,d9,17,a8,04 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(780) c:\windows\system32\sfc_os.dll c:\windows\system32\COMRes.dll c:\windows\system32\cscui.dll - - - - - - - > 'explorer.exe'(2940) c:\windows\system32\CRYPT32.dll c:\windows\system32\MSASN1.dll c:\program files\Unlocker\UnlockerHook.dll c:\windows\system32\msctfime.ime c:\windows\system32\COMRes.dll c:\windows\System32\cscui.dll c:\windows\system32\SETUPAPI.dll c:\windows\system32\msi.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\system32\MSVCP60.dll c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\progra~1\AVG\AVG8\avgwdsvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\progra~1\AVG\AVG8\avgam.exe c:\program files\AVG\AVG8\avgrsx.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\CDBurnerXP\NMSAccessU.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\HPZipm12.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\Viewpoint\Common\ViewpointService.exe c:\windows\system32\rundll32.exe c:\windows\system32\rundll32.exe c:\progra~1\MI3AA1~1\rapimgr.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2009-07-12 0:48 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-12 04:47 Pre-Run: 70,201,663,488 bytes free Post-Run: 74,931,351,552 bytes free 385 I hope to hear from you soon, thank you very much.

syler View Member Profile	Jul 11 2009, 11:56 PM Post #10
Forum Addict Group: HJT Team Posts: 3,903 Joined: 7-November 07 From: Warrington, UK Member No.: 168,228	QUOTE Here is the log that it created for me (not the ComboFix log) just in case you require it. What do you mean by this? and why have you posted combofix.txt twice? -------------------- Any requests for help via PM will be ignored, please use the forums. If I have help you, and you would like to make a donation, click here

Erchino View Member Profile	Jul 12 2009, 12:00 AM Post #11
Member Group: Members Posts: 16 Joined: 30-June 09 Member No.: 346,933	Oh, that was the log that popped up right after ComboFix finished, and I also copied the one on the C:\ drive. My mistake, I did not know they were the same. From what I can tell everything seems to be running smoothly now! All the websites are back online, and google no longer redirects me. I am not sure if we are done with everything, so is there anything else I require to do?

syler View Member Profile	Jul 12 2009, 12:07 AM Post #12
Forum Addict Group: HJT Team Posts: 3,903 Joined: 7-November 07 From: Warrington, UK Member No.: 168,228	Ah rite, got it. We are not done yet, it's not that easy I need some time to look through your log, then I will get back to you with some more instuctions, It will probably be sometime tomorrow when I reply. Syler -------------------- Any requests for help via PM will be ignored, please use the forums. If I have help you, and you would like to make a donation, click here

Erchino View Member Profile	Jul 12 2009, 12:27 AM Post #13
Member Group: Members Posts: 16 Joined: 30-June 09 Member No.: 346,933	Yes I understand, thank you very much for taking your valuable time to solve my stupidities and mistakes. Your services have been better then anything I could have ever found. I hope to never have to bother anybody else again lol. But I will wait for your reply.

syler View Member Profile	Jul 12 2009, 05:28 PM Post #14
Forum Addict Group: HJT Team Posts: 3,903 Joined: 7-November 07 From: Warrington, UK Member No.: 168,228	Hi Erchino, Peer-to-Peer Programs Warning Your log shows that you are using so called peer-to-peer or file-sharing programs (in your case Vuse). These programs allow to share files between users as the name(s) suggest. In today's world cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it. It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology. It is also important to note that sharing entertainment files and proprietary software infringes the copyright laws in many countries over the world and you are putting yourself at risk of being indicted through organizations watching over the rights of the authors of such files (i.e. the RIAA for music files, or the MPAA for movie files in the USA) or the authors of the files themselves. Naturally there are also legal ways to use these services, such as downloading Linux distributions or office suites such as "Open Office." It is your decision whether or not you wish to keep your program(s). However, please refrain from using them until your computer has been declared clean. 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: CODE Folder:: c:\documents and settings\Administrator\Desktop\Games\FarCry2 Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-C39E-35F1D2A32EC8}] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"=- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMConfigurePrograms"=- [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"=- "ForceClassicControlPanel"=- "NoSMConfigurePrograms"=- [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "<NO NAME>"=- Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. *Next* Download and Run Rooter SD Please download Rooter.exe and save it to your desktop Double-click it to start the tool. If you are using Vista, please right-click and choose Run As Administrator Alow it to run when you get a Security Warning A black Command Windows will open saying: "Please Wait..." It will now begin to scan, please be paitent. The scan should not take more than 2 minutes A Notepad file containing the report will open soon. It can also be found at %systemdrive%\Rooter.txt Please post the contents of that log in your next reply *Next* Download and Run FlashDisinfector Please download Flash_Disinfector.exe by sUBs and save it to your desktop. Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear. The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well. Wait until it has finished scanning and then exit the program. Reboot your computer when done. Note: Flash_Disinfector will create a hidden file named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder. It will help protect your drives from future infection. Then please post back here with the following: Combofix.txt Rooter.txt -------------------- Any requests for help via PM will be ignored, please use the forums. If I have help you, and you would like to make a donation, click here

Erchino View Member Profile	Jul 12 2009, 09:54 PM Post #15
Member Group: Members Posts: 16 Joined: 30-June 09 Member No.: 346,933	Here is my second ComboFix log: ComboFix 09-07-12.03 - Administrator 07/12/2009 22:01.2.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1461 [GMT -4:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt . ((((((((((((((((((((((((( Files Created from 2009-06-13 to 2009-07-13 ))))))))))))))))))))))))))))))) . 2009-07-13 00:35 . 2003-04-19 04:32 4736 ----a-w- c:\windows\system32\drivers\tandpl.sys 2009-07-13 00:35 . 2003-03-02 21:44 7552 ----a-w- c:\windows\system32\drivers\enodpl.sys 2009-07-13 00:29 . 2002-05-21 12:37 131072 ----a-r- c:\windows\system32\eax.dll 2009-07-13 00:29 . 2009-07-13 00:29 -------- d-----w- c:\program files\Ubisoft 2009-07-12 04:36 . 2009-07-12 04:36 -------- d-----w- c:\windows\system32\wbem\snmp 2009-07-12 04:36 . 2009-07-12 04:36 -------- d-----w- c:\windows\system32\xircom 2009-07-12 04:36 . 2009-07-12 04:36 -------- d-----w- c:\program files\microsoft frontpage 2009-07-11 22:38 . 2009-07-11 22:38 -------- d-----w- c:\program files\Valvesoftware 2009-07-10 02:48 . 2009-07-10 02:48 -------- d-----w- c:\program files\LucasArts 2009-07-09 15:50 . 2009-07-09 15:50 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\CAPCOM 2009-07-09 15:23 . 2009-07-09 15:23 -------- d-----w- c:\program files\CAPCOM 2009-07-09 15:22 . 2009-03-09 19:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-07-09 15:22 . 2009-03-09 19:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-07-09 15:22 . 2009-03-16 18:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-07-09 15:22 . 2009-03-16 18:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-07-09 15:22 . 2009-03-09 19:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-07-09 15:22 . 2009-03-16 18:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-07-07 17:01 . 2004-08-10 04:00 69120 ----a-w- c:\windows\NOTEPAD.EXE 2009-07-07 13:16 . 2009-07-01 07:38 327688 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgldx86.sys 2009-07-07 13:16 . 2009-07-01 07:38 2314496 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgdiagex.exe 2009-07-07 13:16 . 2009-07-01 07:38 493336 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtbapi.dll 2009-07-07 13:16 . 2009-07-01 07:38 3402008 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe 2009-07-07 13:16 . 2009-07-01 07:38 1204504 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgabout.dll 2009-07-07 13:16 . 2009-07-01 07:38 337176 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avglogx.dll 2009-07-07 13:16 . 2009-07-01 07:38 1085208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe 2009-07-07 03:44 . 2008-08-04 20:44 1060808 ----a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kddvh3hz.default\extensions\{991A772A-BA13-4c1d-A9EF-F897F31DEC7D}\chrome\cache\megauper.exe 2009-07-07 03:36 . 2009-07-07 03:36 -------- d-----w- c:\program files\MegauploadToolbar 2009-07-04 15:26 . 2009-07-04 15:26 -------- d--h--w- c:\windows\PIF 2009-07-02 04:26 . 2009-07-02 04:26 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera 2009-07-02 04:26 . 2009-07-02 04:26 -------- d-----w- c:\program files\Opera 2009-07-01 17:48 . 2009-07-01 17:48 12862 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0E2B767B-EA6A-489B-BF83-8083FE1DB661}\_1EEFFF72773535163E4216.exe 2009-07-01 17:26 . 2009-07-01 18:55 -------- d-----w- c:\program files\Pcsx2 2009-07-01 15:55 . 2009-07-01 15:55 -------- d-----w- c:\program files\EA GAMES 2009-07-01 08:34 . 2009-07-01 14:36 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-01 08:04 . 2009-07-01 08:03 2052376 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll 2009-07-01 08:04 . 2009-07-01 08:03 3298072 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe 2009-07-01 08:04 . 2009-07-01 08:03 829208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcfgx.dll 2009-07-01 08:04 . 2009-07-01 07:38 1261344 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwd.dll 2009-07-01 08:04 . 2009-07-01 07:38 352024 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgxch32.dll 2009-07-01 08:03 . 2009-07-01 07:38 27784 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmfx86.sys 2009-07-01 08:03 . 2009-07-01 08:03 1454360 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll 2009-07-01 07:46 . 2009-06-02 17:38 1004800 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll 2009-07-01 07:38 . 2009-07-01 07:38 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys 2009-07-01 07:38 . 2009-07-01 07:38 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-07-01 07:38 . 2009-07-07 13:16 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-07-01 07:38 . 2009-07-01 08:03 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-07-01 07:38 . 2009-07-12 23:21 -------- d-----w- c:\windows\system32\drivers\Avg 2009-07-01 07:38 . 2009-07-01 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar 2009-07-01 07:38 . 2009-07-01 07:38 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-06-30 17:56 . 2009-06-30 17:56 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-06-29 19:03 . 2009-06-29 19:03 -------- d-----w- c:\program files\hpHosts 2009-06-29 18:08 . 2009-06-29 18:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-06-29 17:59 . 2009-06-29 17:59 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Installer3148 2009-06-29 17:53 . 2009-07-11 23:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-29 17:53 . 2009-06-29 17:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-29 16:39 . 2009-07-01 17:46 -------- d-----w- c:\program files\Click-2U 2009-06-28 17:26 . 2009-06-29 05:50 -------- d-----w- c:\program files\Project64 2009-06-27 19:12 . 2009-06-27 19:12 -------- d-----w- C:\fixwareout 2009-06-27 13:38 . 2009-06-27 13:38 -------- d-----w- C:\Torque 2009-06-27 05:10 . 2009-06-27 05:26 -------- d-----w- c:\program files\TorqueAdvanced 2009-06-27 04:45 . 2009-06-27 05:30 -------- d-----w- c:\program files\Torque 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\program files\Common Files\Software Update Utility 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\program files\AIM Toolbar 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM Toolbar 2009-06-27 03:33 . 2009-06-27 03:33 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AIM Toolbar 2009-06-25 20:48 . 2009-06-25 20:48 -------- d-----w- c:\program files\Common Files\DivX Shared 2009-06-16 20:57 . 2009-06-16 20:57 33824 ----a-w- c:\windows\system32\drivers\oreans32.sys 2009-06-16 20:50 . 2009-06-16 20:50 -------- d-----w- c:\program files\EterniaGames 2009-06-14 22:56 . 2009-06-26 06:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\Independent 2009-06-14 21:33 . 2009-06-14 21:33 4096 ----a-w- c:\windows\d3dx.dat 2009-06-14 20:04 . 2009-06-14 20:54 -------- d-----w- c:\program files\GarageGames 2009-06-14 19:12 . 2009-06-18 22:13 -------- d-----w- c:\program files\Adventure Game Studio 3.1.2 SP1 2009-06-14 19:03 . 2009-06-14 19:11 -------- d-----w- c:\program files\GStudio7 2009-06-14 19:03 . 2009-06-14 19:03 17408 ----a-w- C:\psapi.dll 2009-06-14 17:08 . 2009-06-14 17:08 -------- d-----w- c:\program files\Pixologic 2009-06-14 16:14 . 2009-06-14 16:14 4927488 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\products\legions_instantaction_com\23\install\Legions.exe 2009-06-14 16:14 . 2009-06-14 16:14 3727720 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\products\legions_instantaction_com\23\install\d3dx9_35.dll 2009-06-14 16:14 . 2009-06-14 16:14 345088 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\products\legions_instantaction_com\23\install\fmodex.dll 2009-06-14 16:14 . 2009-02-23 18:42 652608 ----a-w- c:\documents and settings\Administrator\Application Data\GarageGames\IAPlayer\iaplugin.dll 2009-06-14 16:14 . 2009-06-26 06:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\GarageGames . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-13 00:29 . 2008-09-11 05:03 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-12 21:45 . 2008-09-21 01:28 -------- d-----w- c:\documents and settings\Administrator\Application Data\MegauploadToolbar 2009-07-12 00:58 . 2008-12-26 21:11 -------- d-----w- c:\program files\Dropbox 2009-07-12 00:20 . 2008-12-01 00:21 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0 2009-07-12 00:15 . 2009-03-14 03:25 -------- d-----w- c:\program files\MDM 2009-07-11 23:18 . 2008-12-26 21:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\Dropbox 2009-07-11 15:49 . 2008-09-11 05:33 -------- d-----w- c:\documents and settings\Administrator\Application Data\Azureus 2009-07-10 02:48 . 2008-09-11 05:02 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-04 19:33 . 2008-09-11 05:33 76768 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-07-04 15:46 . 2008-09-12 04:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-07-04 15:44 . 2008-09-12 00:20 -------- d-----w- c:\program files\MSBuild 2009-07-04 15:37 . 2008-09-11 22:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\Autodesk 2009-07-04 15:35 . 2008-09-11 22:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk 2009-07-01 07:38 . 2008-09-11 05:40 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8 2009-06-30 17:53 . 2008-09-11 05:20 -------- d-----w- c:\program files\Google 2009-06-30 15:43 . 2008-12-03 04:41 -------- d-----w- c:\program files\Yahoo! 2009-06-30 03:29 . 2009-03-12 21:45 -------- d-----w- c:\program files\Microsoft ActiveSync 2009-06-30 03:29 . 2008-10-06 01:37 -------- d-----w- c:\program files\Sun 2009-06-30 03:27 . 2008-09-11 22:44 -------- d-----w- c:\program files\Bonjour 2009-06-30 03:19 . 2008-10-06 02:58 -------- d-----w- c:\program files\Common Files\Apple 2009-06-27 03:36 . 2009-01-09 00:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\Orbit 2009-06-27 03:33 . 2008-09-11 05:30 -------- d-----w- c:\program files\AIM6 2009-06-27 03:33 . 2008-09-11 05:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint 2009-05-18 03:59 . 2009-04-26 23:16 -------- d-----w- c:\program files\Common Files\BitDefender 2009-05-18 01:05 . 2009-05-18 01:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Canneverbe_Limited 2009-05-18 01:04 . 2009-05-18 01:04 -------- d-----w- c:\program files\CDBurnerXP 2009-05-16 02:14 . 2009-04-25 23:45 -------- d-----w- c:\program files\Starcraft 2009-05-06 18:11 . 2009-05-06 18:11 69120 ----a-w- c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\aimtbres.dll 2009-05-03 00:00 . 2009-05-03 00:00 32930 ----a-w- c:\windows\scunin.dat 2009-05-03 00:00 . 2009-05-03 00:00 967 ----a-w- c:\windows\ScUnin.pif 2009-05-03 00:00 . 2009-05-03 00:00 94208 ----a-w- c:\windows\ScUnin.exe 2009-05-02 16:22 . 2009-05-02 16:22 529 ----a-w- c:\windows\eReg.dat 2009-05-02 15:40 . 2009-03-29 23:27 247384 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-04-27 04:49 . 2009-04-27 00:45 81984 ----a-w- c:\windows\system32\bdod.bin 2009-04-22 04:20 . 2009-04-22 04:20 14311680 ----a-w- c:\windows\system32\xlive.dll 2009-04-22 04:20 . 2009-04-22 04:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll 2009-04-17 18:01 . 2009-04-17 18:01 1059112 ----a-w- c:\documents and settings\LocalService\Application Data\MEGAUPLOADTOOLBAR\megauper.exe 2008-08-13 23:02 . 2008-08-13 23:02 35840 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll 2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 2006-05-03 09:06 . 2008-10-03 08:42 163328 --sh--r- c:\windows\system32\flvDX.dll 2007-02-21 10:47 . 2008-10-03 08:42 31232 --sh--r- c:\windows\system32\msfDX.dll 2008-03-16 12:30 . 2008-10-03 08:42 216064 --sh--r- c:\windows\system32\nbDX.dll . ------- Sigcheck ------- [-] 2008-05-21 15:19 361344 68F06FE0021B01E670AF37B8C5964FDF c:\windows\system32\drivers\tcpip.sys [-] 2008-05-21 15:35 547328 A55B8899D2EA2E800061BCFD456E34DC c:\windows\system32\winlogon.exe [-] 2008-05-21 15:33 1551872 C26978D5F821A7330439DD7F0AAAF678 c:\windows\explorer.exe [-] 2008-05-21 15:33 25088 B5E8782D4AF1B3756F38E11E7C157BBE c:\windows\system32\ctfmon.exe [-] 2008-05-21 15:28 1390080 CB75214525D36F923D3948DA3CD1562D c:\windows\system32\comres.dll [-] 2008-05-21 15:28 724992 AF8ED52D2A32C7729C7F91C72B8CCB10 c:\windows\system32\comctl32.dll [7] 2004-08-04 12:00 921088 AEF3D788DBF40C7C4D204EA45EB0C505 c:\windows\WinSxS\InstallTemp\21620\comctl32.dll [7] 2004-08-04 12:00 921088 AEF3D788DBF40C7C4D204EA45EB0C505 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll [7] 2008-04-14 00:12 1054208 BD38D1EBE24A46BD3EDA059560AFBA12 c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll . ((((((((((((((((((((((((((((( SnapShot@2009-07-12_04.37.21 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-12 16:57 . 2009-07-12 16:57 16384 c:\windows\Temp\Perflib_Perfdata_1fc.dat + 2004-08-04 12:00 . 2009-07-12 17:01 89736 c:\windows\system32\perfc009.dat - 2004-08-04 12:00 . 2009-07-12 04:23 89736 c:\windows\system32\perfc009.dat + 2004-08-04 12:00 . 2009-07-12 17:01 490796 c:\windows\system32\perfh009.dat - 2004-08-04 12:00 . 2009-07-12 04:23 490796 c:\windows\system32\perfh009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-16 1004800] [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-06-16 13:29 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-16 1004800] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-16 1004800] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-05-21 25088] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-10 68856] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-19 133104] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-08-16 167368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168] "PowerTweak Menu"="c:\windows\system32\mmm.exe" [2005-07-05 828416] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-03-16 868352] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-27 148888] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-10 8429568] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-10 81920] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-01 1948440] "BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-05-10 1626112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-03-01 124928] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-07-01 07:38 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Program Files\\AVG\\AVG8\\avgam.exe"= "c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"= "c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\CAPCOM\\STREETFIGHTERIV\\StreetFighterIV.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "<NO NAME>"= "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service --- Other Services/Drivers In Memory --- NewlyCreated - ENODPL NewlyCreated - TANDPL . Contents of the 'Scheduled Tasks' folder 2009-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1004336348-1177238915-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-19 01:43] 2009-07-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1004336348-1177238915-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-19 01:43] 2009-07-11 c:\windows\Tasks\Malwarebytes' Scheduled Scan for Administrator.job - c:\program files\Malwarebytes' Anti-Malware\yoyo.exe [2009-06-29 15:27] . . ------- Supplementary Scan ------- . uStart Page = hxxp://search.orbitdownloader.com uInternet Settings,ProxyOverride = .local IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\kddvh3hz.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews..wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-12 22:10 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ "ServiceDll"="c:\windows\system32\es.dll" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@C:+Documents and Settings+Administrator+Desktop+Games+FarCry2+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] "ImagePath"="c:\documents and settings\Administrator\Desktop\Games\FarCry2\ [RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING\FAH.exe -svcstart" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@C:+Documents and Settings+Administrator+Desktop+Games+FarCry2+[RAZOR1911][WEB SEED] FAR CRY 2 CRACK - REAL 100% FULLY WORKING+FAH.exe] "ImagePath"="c:\documents and settings\Administrator\Desktop\Games\FarCry2\ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1993962763-1004336348-1177238915-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY] "??"=hex:74,ae,4a,63,72,d9,b5,2b,1b,d4,5e,93,e7,18,5f,fd,34,78,ce,7e,26,79,57, 27,d6,da,03,92,32,66,18,a6,46,3f,ce,c4,55,6f,5b,49,87,df,70,52,1b,03,1e,4e,\ "??"=hex:69,6f,5c,46,6a,89,f9,ee,2d,48,e0,10,87,42,1e,12 [HKEY_USERS\S-1-5-21-1993962763-1004336348-1177238915-500\Software\SecuROM\License information] "datasecu"=hex:35,90,47,3c,39,4f,70,06,19,e3,cf,28,df,bb,d2,dd,93,d9,02,5b,2f, 3c,b9,0e,58,16,02,67,84,f6,41,60,16,7c,08,4d,fb,bb,ce,fd,a1,ac,a0,e2,bb,96,\ "rkeysecu"=hex:93,92,7c,fc,f7,ff,aa,56,7f,eb,9e,8d,d9,17,a8,04 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(772) c:\windows\system32\sfc_os.dll c:\windows\system32\COMRes.dll c:\windows\system32\cscui.dll - - - - - - - > 'explorer.exe'(3432) c:\windows\system32\CRYPT32.dll c:\windows\system32\MSASN1.dll c:\windows\system32\msctfime.ime c:\windows\system32\COMRes.dll c:\windows\System32\cscui.dll c:\windows\system32\SETUPAPI.dll c:\windows\system32\msi.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\system32\MSVCP60.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2009-07-13 22:16 ComboFix-quarantined-files.txt 2009-07-13 02:16 ComboFix2.txt 2009-07-12 04:48 Pre-Run: 72,523,005,952 bytes free Post-Run: 72,551,178,240 bytes free 343 And here is my Rooter log: Rooter.exe (v1.0.2) by Eric_71 . SeDebugPrivilege granted successfully ... . Windows XP . (5.1.2600) Service Pack 3 [32_bits] - x86 Family 6 Model 15 Stepping 2, GenuineIntel . [wscsvc] STOPPED (state:1) : Security Center -> Disabled ! [SharedAccess] RUNNING (state:4) Windows Firewall -> Enabled . Internet Explorer 7.0.5730.13 Mozilla Firefox 3.5 (en-GB) . C:\ [Fixed-NTFS] .. ( Total:293 Go - Free:67 Go ) D:\ [Removable] E:\ [Removable] F:\ [Removable] G:\ [Removable] H:\ [CD_Rom] K:\ [Fixed-NTFS] .. ( Total:149 Go - Free:132 Go ) M:\ [CD_Rom] . Scan : 22:24.27 Path : C:\Documents and Settings\Administrator\Desktop\Rooter.exe User : Administrator ( Administrator -> YES ) . ----------------------\\ Processes . Locked [System Process] (0) ______ System (4) ______ \SystemRoot\System32\smss.exe (700) ______ \??\C:\WINDOWS\system32\csrss.exe (748) ______ \??\C:\WINDOWS\system32\winlogon.exe (772) ______ C:\WINDOWS\system32\services.exe (816) ______ C:\WINDOWS\system32\lsass.exe (828) ______ C:\WINDOWS\system32\svchost.exe (988) ______ C:\WINDOWS\system32\svchost.exe (1064) ______ C:\WINDOWS\System32\svchost.exe (1212) ______ C:\WINDOWS\system32\svchost.exe (1340) ______ C:\WINDOWS\system32\svchost.exe (1484) ______ C:\WINDOWS\system32\spoolsv.exe (1616) ______ C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (256) ______ C:\Program Files\Bonjour\mDNSResponder.exe (280) ______ C:\WINDOWS\system32\svchost.exe (300) ______ C:\Program Files\Java\jre6\bin\jqs.exe (508) ______ c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (536) ______ C:\PROGRA~1\AVG\AVG8\avgam.exe (684) ______ C:\PROGRA~1\AVG\AVG8\avgrsx.exe (716) ______ C:\PROGRA~1\AVG\AVG8\avgnsx.exe (728) ______ C:\Program Files\AVG\AVG8\avgcsrvx.exe (944) ______ C:\Program Files\CDBurnerXP\NMSAccessU.exe (1732) ______ C:\WINDOWS\system32\nvsvc32.exe (1788) ______ C:\WINDOWS\system32\HPZipm12.exe (1816) ______ c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (1844) ______ C:\Program Files\Viewpoint\Common\ViewpointService.exe (1876) ______ C:\WINDOWS\System32\alg.exe (2232) ______ C:\WINDOWS\system32\rundll32.exe (2844) ______ C:\Program Files\Analog Devices\Core\smax4pnp.exe (3216) ______ C:\Program Files\Java\jre6\bin\jusched.exe (3244) ______ C:\WINDOWS\system32\RUNDLL32.EXE (3276) ______ C:\Program Files\iTunes\iTunesHelper.exe (3352) ______ C:\PROGRA~1\AVG\AVG8\avgtray.exe (3384) ______ C:\Program Files\iPod\bin\iPodService.exe (3412) ______ C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (3420) ______ C:\WINDOWS\system32\ctfmon.exe (3436) ______ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (3456) ______ C:\Program Files\DAEMON Tools Pro\DTProAgent.exe (3520) ______ C:\Program Files\Microsoft ActiveSync\wcescomm.exe (3608) ______ C:\Program Files\DAEMON Tools\daemon.exe (3616) ______ C:\PROGRA~1\MI3AA1~1\rapimgr.exe (3744) ______ C:\WINDOWS\explorer.exe (3432) ______ C:\Documents and Settings\Administrator\Desktop\Rooter.exe (1832) . ----------------------\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . \Device\Harddisk0\Partition0 (Start_Offset:8225280 \| Length:160031047680) \Device\Harddisk0\Partition1 (Start_Offset:8257536 \| Length:160031015424) . ----------------------\\ Scheduled Tasks . C:\WINDOWS\Tasks\desktop.ini C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1004336348-1177238915-500Core.job C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1004336348-1177238915-500UA.job C:\WINDOWS\Tasks\Malwarebytes' Scheduled Scan for Administrator.job C:\WINDOWS\Tasks\SA.DAT . ----------------------\\ Registry . . ----------------------\\ Files & Folders . C:\DOCUME~1\ADMINI~1\Desktop\Games\Beyond.Good.and.Evil-iMMERSiON\Beyond.Good.and.Evil.Patch.v1.01-iMSDOX\crack.rar C:\DOCUME~1\ADMINI~1\Application Data\Azureus\torrents\Grand+Theft+Auto+IV+%5BPC%5D+%2B+keygen.rar[1].torrent C:\DOCUME~1\ADMINI~1\Desktop\Omnia\Backup\touchpal\keygen.exe C:\DOCUME~1\ADMINI~1\Desktop\Omnia\Pocket PC Essentials - February 2009\Pocket PC Essentials - February 2009\memmaid 2.3 with keygen.rar C:\DOCUME~1\ADMINI~1\My Documents\Azureus Downloads\LimeWire PRO version 4.18.3[needs no keygen].rar C:\DOCUME~1\ADMINI~1\Desktop\Games\Beyond.Good.and.Evil-iMMERSiON\Beyond.Good.and.Evil.Patch.v1.01-iMSDOX\crack.rar C:\DOCUME~1\ADMINI~1\Application Data\Azureus\torrents\Grand+Theft+Auto+IV+%5BPC%5D+%2B+keygen.rar[1].torrent C:\DOCUME~1\ADMINI~1\Desktop\Omnia\Backup\touchpal\keygen.exe C:\DOCUME~1\ADMINI~1\Desktop\Omnia\Pocket PC Essentials - February 2009\Pocket PC Essentials - February 2009\memmaid 2.3 with keygen.rar C:\DOCUME~1\ADMINI~1\My Documents\Azureus Downloads\LimeWire PRO version 4.18.3[needs no keygen].rar ==> Cracks & Keygens <== . ----------------------\\ Scan completed at 22:24.32 . C:\Rooter$\Rooter_1.txt - (12/07/2009 \| 22:24.32).c I have also run FlashDisinfector and inserted my phone in the usb port. It lasted around 5 seconds I do not know if that is normal. One last thing, I do not know if this is because of the virus, or a software or hardware problem but this week the computer has started to become jittery. Things like games stutter, some once in a while, others quite often. Most of these games don't require much system specs, and my computer can run games, especially old ones (games from 2003-2005) quite well, but even so for some odd reason these games stutter. Thank you.

« Next Oldest · HijackThis Logs and Virus/Trojan/Spyware/Malware Removal · Next Newest »

2 Pages

1 2 >

2 User(s) are reading this topic (2 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 21st November 2009 - 08:36 PM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Virus Removal Guides