BleepingComputer.com: sinowal@mbr

Hello there.
My computer facing problem that being slow down. When I surfing net, it direct me to adverting pages when I click any link.
I used Avast antivirus. It noticed me that my computer effected by sinowal@mbr.
But it do nothing to remove the rootkit.
So i download Combofix and run in safemode.
After that the computer is ok now.
But just need the expert to check my logfile.
Since I read the instruction of Combofix, it strongly recommended to seek expert to analyst my logfile.

Thank you.


ComboFix 11-04-12.01 - User 04/13/2011 12:44:18.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.874.66.1033.18.1015.833 [GMT 8:00]
Running from: c:\documents and settings\User.USER-7BA9959356\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\1.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\a.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\b.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\c.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\d.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\e.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\f.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\g.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\h.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\i.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\J.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\k.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\l.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\m.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\n.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\o.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\p.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\q.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\r.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\s.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\t.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\u.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\v.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\w.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\x.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\y.xml
c:\documents and settings\User.USER-7BA9959356\Application Data\PriceGong\Data\z.xml
c:\program files\Internet Explorer\SET13C.tmp
c:\program files\Internet Explorer\SET13D.tmp
c:\program files\Internet Explorer\SET13F.tmp
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
.
.
\\.\PhysicalDrive0 - Bootkit Sinowal was found and disinfected
.
\\.\PhysicalDrive0 - Bootkit Sinowal was found and disinfected
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_npf
.
.
((((((((((((((((((((((((( Files Created from 2011-03-13 to 2011-04-13 )))))))))))))))))))))))))))))))
.
.
2011-04-13 04:29 . 2011-04-13 04:29 -------- d-----w- c:\documents and settings\Administrator.USER-7BA9959356\Local Settings\Application Data\Mozilla
2011-04-12 03:32 . 2011-02-23 14:56 301528 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-04-12 03:32 . 2011-02-23 14:54 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-04-12 03:32 . 2011-02-23 14:55 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-04-12 03:32 . 2011-02-23 14:56 371544 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-04-12 03:32 . 2011-02-23 14:55 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-04-12 03:32 . 2011-02-23 14:55 102232 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-04-12 03:32 . 2011-02-23 14:55 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-04-12 03:32 . 2011-02-23 14:54 30680 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-04-12 03:31 . 2011-02-23 15:04 40648 ----a-w- c:\windows\avastSS.scr
2011-04-12 03:31 . 2011-02-23 15:04 190016 ----a-w- c:\windows\system32\aswBoot.exe
2011-04-06 02:27 . 2011-04-06 02:27 -------- d-----w- c:\documents and settings\User.USER-7BA9959356\Application Data\SUPERAntiSpyware.com
2011-04-01 11:26 . 2011-04-12 03:31 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-04-01 11:26 . 2011-04-01 11:26 -------- d-----w- c:\program files\AVAST Software
2011-03-25 12:10 . 2011-03-25 12:10 -------- d-----w- c:\program files\URUSoft
2011-03-24 13:46 . 2011-03-26 07:07 -------- d-----w- c:\documents and settings\User.USER-7BA9959356\Application Data\dvdcss
2011-03-24 07:29 . 2011-03-24 07:29 -------- d-----w- c:\documents and settings\User.USER-7BA9959356\Application Data\Meebo
2011-03-24 07:29 . 2011-03-24 07:29 -------- d-----w- c:\documents and settings\User.USER-7BA9959356\Local Settings\Application Data\Meebo
2011-03-15 14:50 . 2011-03-15 14:50 -------- d-----w- c:\documents and settings\User.USER-7BA9959356\Tracing
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-01 07:43 . 2010-04-14 06:17 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-02-26 03:48 . 2010-04-24 01:00 720896 ----a-w- c:\windows\iun6002ev.exe
.
.
------- Sigcheck -------
.
[-] 2010-02-23 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-04-27 02:08 2393184 ----a-w- c:\program files\DVDVideoSoftTB\tbDVDV.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 14:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 15:04 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Meebo Notifier"="c:\documents and settings\User.USER-7BA9959356\Local Settings\Application Data\Meebo\Meebo Notifier\MeeboNotifier.exe" [2010-07-14 818888]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\a19b314a-cf89-4ea7-b865-5310f71bc6f2.com" [2011-04-13 2403568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-08-14 94208]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-08-14 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-08-14 114688]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-11 18:38 34672 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]
2010-08-10 07:10 2349776 ----a-w- c:\program files\IObit\Advanced SystemCare 3\AWC.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast]
2011-02-23 15:04 3451496 ----a-w- c:\program files\AVAST Software\Avast\AvastUI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2010-11-09 02:07 281768 ----a-w- c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2006-04-13 03:09 49152 ----a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 03:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2005-12-07 14:57 30208 ------w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-11-24 01:46 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-11-24 01:37 274608 ----a-w- c:\program files\Real\realplayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2010-12-09 10:45 74752 ----a-w- c:\program files\Winamp\winampa.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Antivirus"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirSchedulerService"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\WINDOWS\\system32\\freecell.exe"=
"c:\\WINDOWS\\system32\\mshearts.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"6646:TCP"= 6646:TCP:Services
"4073:TCP"= 4073:TCP:Services
"3885:TCP"= 3885:TCP:Services
"4766:TCP"= 4766:TCP:Services
"6168:TCP"= 6168:TCP:Services
"1778:TCP"= 1778:TCP:Services
"2994:TCP"= 2994:TCP:Services
"9570:TCP"= 9570:TCP:Services
"5838:TCP"= 5838:TCP:Services
"4480:TCP"= 4480:TCP:Services
"5581:TCP"= 5581:TCP:Services
"4640:TCP"= 4640:TCP:Services
"8632:TCP"= 8632:TCP:Services
"2517:TCP"= 2517:TCP:Services
"4817:TCP"= 4817:TCP:Services
"6756:TCP"= 6756:TCP:Services
"6629:TCP"= 6629:TCP:Services
"8913:TCP"= 8913:TCP:Services
"8699:TCP"= 8699:TCP:Services
"9701:TCP"= 9701:TCP:Services
"9130:TCP"= 9130:TCP:Services
"6987:TCP"= 6987:TCP:Services
"4970:TCP"= 4970:TCP:Services
"9998:TCP"= 9998:TCP:Services
"5237:TCP"= 5237:TCP:Services
"3926:TCP"= 3926:TCP:Services
"9851:TCP"= 9851:TCP:Services
"4830:TCP"= 4830:TCP:Services
"8849:TCP"= 8849:TCP:Services
"5631:TCP"= 5631:TCP:Services
"5935:TCP"= 5935:TCP:Services
"6245:TCP"= 6245:TCP:Services
"2103:TCP"= 2103:TCP:Services
"1662:TCP"= 1662:TCP:Services
"2203:TCP"= 2203:TCP:Services
"6686:TCP"= 6686:TCP:Services
"4362:TCP"= 4362:TCP:Services
"1973:TCP"= 1973:TCP:Services
"5384:TCP"= 5384:TCP:Services
"5080:TCP"= 5080:TCP:Services
"7320:TCP"= 7320:TCP:Services
"2854:TCP"= 2854:TCP:Services
"3895:TCP"= 3895:TCP:Services
"6435:TCP"= 6435:TCP:Services
"6880:TCP"= 6880:TCP:Services
"2323:TCP"= 2323:TCP:Services
"3132:TCP"= 3132:TCP:Services
"7581:TCP"= 7581:TCP:Services
"9584:TCP"= 9584:TCP:Services
"2186:TCP"= 2186:TCP:Services
"2129:TCP"= 2129:TCP:Services
.
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [4/12/2011 11:32 AM 371544]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [4/12/2011 11:32 AM 301528]
S1 SABKUTIL;SABKUTIL;\??\c:\program files\SUPERAntiSpyware\SABKUTIL.sys --> c:\program files\SUPERAntiSpyware\SABKUTIL.sys [?]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/18/2010 2:25 AM 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/11/2010 2:41 AM 67656]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [4/14/2010 2:17 PM 135336]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/12/2011 11:32 AM 19544]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/24/2010 9:46 AM 136176]
S3 bcm;WiMAX Network Adapter;c:\windows\system32\DRIVERS\drxvi314.sys --> c:\windows\system32\DRIVERS\drxvi314.sys [?]
S3 bcmbusctr;WiMAX Bus Driver;c:\windows\system32\DRIVERS\BcmBusCtr.sys --> c:\windows\system32\DRIVERS\BcmBusCtr.sys [?]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys --> c:\windows\system32\DRIVERS\ewusbnet.sys [?]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys --> c:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\drivers\cmusbser.sys [4/19/2010 12:04 PM 97408]
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34]
.
2011-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-24 01:45]
.
2011-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-24 01:45]
.
2011-04-13 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-854245398-1229272821-515967899-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 03:33]
.
2011-04-13 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-854245398-1229272821-515967899-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 03:33]
.
2011-04-13 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-09-28 14:44]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.youtube.com/my_videos
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Download All using 4shared Desktop - c:\program files\4shared Desktop\down_all.htm
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\documents and settings\User\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\User.USER-7BA9959356\Application Data\Mozilla\Firefox\Profiles\v6ien1du.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.youtube.com/my_subscriptions?feature=mhum
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-DivXLand Media Subtitler - c:\windows\unvise32.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-13 12:56
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):e1,28,2b,e1,4b,38,cb,6f,8c,8d,d5,01,17,9d,be,e3,e6,f4,78,bb,ff,
bd,8b,7a,31,cc,80,58,fa,b0,c3,80,43,f5,92,88,6d,c5,06,ba,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{f2e3697a-b821-4cf1-b4f2-63444f3560b2}]
@Denied: (Full) (Everyone)
"Model"=dword:00000086
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,ab,9e,50,1b,eb,77,d1,ab,64,f4,70,f3,56,c1,34,d7,83,e0,8b,c5,07,bb,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(244)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
- - - - - - - > 'explorer.exe'(1212)
c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL
.
Completion time: 2011-04-13 13:00:50 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-13 05:00
.
Pre-Run: 22,218,149,888 bytes free
Post-Run: 22,119,288,832 bytes free
.
- - End Of File - - B29C38792D539B7E83CA82E6884C45B8

Hi 12Panna, and welcome to Bleeping Computer.

Please follow our Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help, and post the logs requested! This include the DDS.txt and Attach.txt logs + GMER logfile...

Additionally,
Please download HelpAsst_mebroot_fix.exe and save it to your Desktop.
Close out all other open programs and windows.
Double click the file to run it and follow any prompts.
After it finishes, click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !
When it completes, a log will open.
Please post the contents of that log.

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.