BleepingComputer.com: XP Infected...Help Please!

Hello! I need help with my XP which seems to be infected. I am not very technologically advanced, but I did manage to run a few scans/logs, but I can not read the results at all! I ran MBAM to see what would come up, but it told me it found 0 threats, as did TDSSKiller. My PC has been running extremely slow (ping.exe shows up repeatedly & CPU usage is at 100%!), IE has many pop ups and google links are being redirected. Can someone please help me? I have no clue as where to begin! Thanks in advance!!

Here are the logs I have:

MBAM:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8406

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/22/2011 12:02:46 AM
mbam-log-2011-12-22 (00-02-46).txt

Scan type: Quick scan
Objects scanned: 210392
Time elapsed: 36 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


DDS:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by David at 0:54:02 on 2011-12-22
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.395 [GMT -6:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://biannual2012.com/
uSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: IDM integration (IDMIEHlprObj Class): {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7018.1622\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
LSP: mswsock.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1301681298296
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{C6640218-FAE2-4DCF-8514-7E85109B26D5} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{CF970E40-7341-456C-8C7D-E5D093A2E99E} : DhcpNameServer = 192.168.1.254
.
============= SERVICES / DRIVERS ===============
.
R1 IDMTDI;IDMTDI;c:\windows\system32\drivers\idmtdi.sys [2011-8-29 101616]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-4-1 135664]
S2 Mp3Tube Toolbar Service;Mp3Tube Toolbar Updater Service;c:\program files\mp3tube toolbar\mp3tubesvc.exe --> c:\program files\mp3tube toolbar\Mp3TubeSvc.exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-4-1 135664]
S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2011-12-20 50704]
.
=============== Created Last 30 ================
.
2011-12-22 06:06:38 -------- d-----w- c:\documents and settings\david\application data\PMW
2011-12-22 06:06:24 -------- d-----w- c:\program files\PMW
2011-12-22 06:06:24 -------- d-----w- c:\documents and settings\all users\application data\PMW
2011-12-20 23:47:49 -------- d-----w- c:\documents and settings\david\local settings\application data\PCHealth
2011-12-20 22:42:13 -------- d--h--w- C:\$AVG
2011-12-20 22:29:56 -------- d-----w- c:\documents and settings\david\application data\Malwarebytes
2011-12-20 22:29:33 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-12-20 22:29:29 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-20 22:29:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-20 21:59:40 388096 ----a-r- c:\documents and settings\david\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-12-20 21:59:39 -------- d-----w- c:\program files\Trend Micro
2011-12-20 20:03:25 -------- d--h--w- c:\documents and settings\all users\application data\Common Files
2011-12-20 19:45:03 -------- d-----w- c:\documents and settings\all users\application data\MFAData
2011-12-20 19:43:33 -------- d-----w- c:\windows\pss
2011-12-20 13:36:42 50704 ----a-w- c:\windows\system32\drivers\npf.sys
2011-12-20 13:36:42 281104 ----a-w- c:\windows\system32\wpcap.dll
2011-12-20 13:36:42 100880 ----a-w- c:\windows\system32\Packet.dll
2011-12-20 05:25:22 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-12-20 05:25:22 -------- d-----w- c:\windows\system32\wbem\Repository
2011-12-13 20:47:02 -------- d-----w- c:\program files\Microsoft Visual Studio 8
.
==================== Find3M ====================
.
2011-11-23 13:25:32 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec
2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-26 23:03:17 80 --sh--r- c:\windows\system32\6603C74903.dll
2011-10-25 13:37:08 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52:02 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13:22 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 16:41:20 611328 ------w- c:\windows\system32\uiautomationcore.dll
2011-09-26 16:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 16:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll
.
============= FINISH: 0:54:40.93 ===============


Attach:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/1/2011 12:39:16 PM
System Uptime: 12/21/2011 5:22:00 PM (7 hours ago)
.
Motherboard: Dell Inc | | 0HY175
Processor: AMD Athlon™ 64 X2 Dual Core Processor 4000+ | Socket M2 | 2104/1000mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 74 GiB total, 47.922 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 466 GiB total, 421.082 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Broadcom 440x 10/100 Integrated Controller
Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_01F41028&REV_02\4&DC268A3&0&3880
Manufacturer: Broadcom
Name: Broadcom 440x 10/100 Integrated Controller
PNP Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_01F41028&REV_02\4&DC268A3&0&3880
Service: bcm4sbxp
.
==== System Restore Points ===================
.
RP428: 11/21/2011 1:00:30 PM - Removed Microsoft Office Home and Student 2007
RP429: 11/22/2011 1:49:23 PM - System Checkpoint
RP430: 11/23/2011 1:52:23 PM - System Checkpoint
RP431: 11/24/2011 2:04:24 PM - System Checkpoint
RP432: 11/25/2011 1:15:59 AM - Installed Microsoft Office Home and Student 2007
RP433: 11/25/2011 1:19:24 AM - Printer Driver Send To Microsoft OneNote Driver Installed
RP434: 11/25/2011 1:27:33 AM - Removed Microsoft Office Home and Student 2007
RP435: 11/26/2011 1:52:24 AM - System Checkpoint
RP436: 11/27/2011 1:56:59 AM - System Checkpoint
RP437: 11/28/2011 3:08:56 AM - System Checkpoint
RP438: 11/29/2011 4:08:58 AM - System Checkpoint
RP439: 11/29/2011 12:39:32 PM - Installed Microsoft Office Professional 2010 Trial
RP440: 11/29/2011 12:44:03 PM - Installed Microsoft Office Professional 2007
RP441: 11/30/2011 1:05:31 PM - System Checkpoint
RP442: 12/1/2011 1:14:41 PM - System Checkpoint
RP443: 12/2/2011 2:01:10 PM - System Checkpoint
RP444: 12/3/2011 3:01:11 PM - System Checkpoint
RP445: 12/4/2011 3:49:10 PM - System Checkpoint
RP446: 12/5/2011 4:21:28 PM - System Checkpoint
RP447: 12/6/2011 4:59:47 PM - System Checkpoint
RP448: 12/7/2011 5:56:06 PM - System Checkpoint
RP449: 12/8/2011 5:59:00 PM - System Checkpoint
RP450: 12/9/2011 8:22:35 PM - System Checkpoint
RP451: 12/10/2011 8:58:59 PM - System Checkpoint
RP452: 12/11/2011 12:44:46 AM - Removed Microsoft Office Professional 2007
RP453: 12/11/2011 1:17:04 AM - Installed Microsoft Office Professional Plus 2007
RP454: 12/12/2011 2:26:12 AM - System Checkpoint
RP455: 12/13/2011 3:26:15 AM - System Checkpoint
RP456: 12/13/2011 2:28:28 PM - Removed Microsoft Office Professional Plus 2007
RP457: 12/13/2011 2:45:10 PM - Installed Microsoft Office Professional Plus 2007
RP458: 12/14/2011 4:16:53 PM - System Checkpoint
RP459: 12/15/2011 4:35:51 PM - System Checkpoint
RP460: 12/16/2011 5:12:00 PM - System Checkpoint
RP461: 12/17/2011 5:56:04 PM - System Checkpoint
RP462: 12/18/2011 6:10:56 PM - System Checkpoint
RP463: 12/19/2011 5:04:11 PM - Restore Operation
RP464: 12/19/2011 11:24:31 PM - Restore Operation
RP465: 12/20/2011 1:20:51 PM - Restore Operation
RP466: 12/20/2011 1:48:40 PM - Installed AVG 2012
RP467: 12/20/2011 1:49:43 PM - Installed AVG 2012
RP468: 12/20/2011 3:59:39 PM - Installed HiJackThis
RP469: 12/20/2011 5:46:41 PM - Software Distribution Service 3.0
RP470: 12/21/2011 4:18:36 PM - Removed AVG 2012
RP471: 12/21/2011 4:25:00 PM - Removed AVG 2012
RP472: 12/21/2011 4:37:17 PM - Removed AVG 2012
RP473: 12/21/2011 4:38:20 PM - Removed AVG 2012
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.1)
AMD APP SDK Runtime
Apple Application Support
Apple Mobile Device Support
Apple Software Update
BlackBerry Desktop Software 6.1
Bonjour
DivX Setup
Google Toolbar for Internet Explorer
Google Update Helper
High Definition Audio Driver Package - KB835221
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB981793)
Image Resizer Powertoy for Windows XP
InstaCodecs
Internet Download Manager
iPod Video Converter Factory
iTunes
Java Auto Updater
Java™ 6 Update 27
Malwarebytes' Anti-Malware version 1.51.2.1300
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
NVIDIA Drivers
QuickTime
Safari
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
SigmaTel Audio
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Outlook 2007 Junk Email Filter (KB2596560)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
WavePad Sound Editor
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows XP Service Pack 3
WinRAR 4.01 (32-bit)
Wireless USB Card
Xvid Video Codec
.
==== Event Viewer Messages From Past Week ========
.
12/21/2011 5:20:54 PM, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: The system cannot find the file specified.
12/20/2011 6:24:45 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: atapi PCIIde
12/20/2011 1:37:31 PM, error: Service Control Manager [7023] - The Network Location Awareness (NLA) service terminated with the following error: The specified procedure could not be found.
12/20/2011 1:37:02 PM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
12/20/2011 1:36:45 PM, error: Service Control Manager [7000] - The Mp3Tube Toolbar Updater Service service failed to start due to the following error: The system cannot find the file specified.
12/20/2011 1:17:37 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
.
==== End Of File ===========================


HijackThis:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:14:51 AM, on 12/22/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\David\My Documents\Downloads\Programs\ovzb1xsf.exe
C:\WINDOWS\System32\ping.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://biannual2012.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1301681298296
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Mp3Tube Toolbar Updater Service (Mp3Tube Toolbar Service) - Unknown owner - C:\Program Files\Mp3Tube Toolbar\Mp3TubeSvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 6883 bytes


(GMER was too big to paste or attach!)

Thanks in advance!

-David

This post has been edited by crazimoose2112: 22 December 2011 - 04:04 AM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

• Do not run any other tool untill instructed to do so!
  
• please Do not Attach logs or put in code boxes.
  
• Tell me about any problems that have occurred during the fix.
  
• Tell me of any other symptoms you may be having as these can help also.
  
• Do not run anything while running a fix.
  
• Do not run any other tool untill instructed to do so!

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following


• Log from Combofix
  
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

My computer is acting the same way. Now it is telling me there are corrupt and/or missing files. Thanks for all your help! I appreciate it!! Here is my log:


ComboFix 11-12-26.02 - David 12/26/2011 14:25:59.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.754 [GMT -6:00]
Running from: c:\documents and settings\David\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\2qHe7cg3.exe
c:\documents and settings\All Users\Application Data\Tarma Installer
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\_Setup.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\_Setupx.dll
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\Setup.dat
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\Setup.exe
c:\documents and settings\All Users\Application Data\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\Setup.ico
C:\Install.exe
c:\program files\QuestScan
c:\program files\QuestScan\QuestScan_deleted_\questscan.dll
c:\program files\QuestScan\QuestScan_deleted_\questscan.exe
c:\program files\QuestScan\uninstall.exe
c:\windows\$NtUninstallKB60071$\36366477\@
c:\windows\$NtUninstallKB60071$\36366477\bckfg.tmp
c:\windows\$NtUninstallKB60071$\36366477\cfg(2).ini
c:\windows\$NtUninstallKB60071$\36366477\cfg.ini
c:\windows\$NtUninstallKB60071$\36366477\Desktop.ini
c:\windows\$NtUninstallKB60071$\36366477\keywords
c:\windows\$NtUninstallKB60071$\36366477\kwrd.dll
c:\windows\$NtUninstallKB60071$\36366477\L\jecialfo
c:\windows\$NtUninstallKB60071$\36366477\lsflt7.ver
c:\windows\$NtUninstallKB60071$\36366477\U\00000001.@
c:\windows\$NtUninstallKB60071$\36366477\U\00000002.@
c:\windows\$NtUninstallKB60071$\36366477\U\00000004.@
c:\windows\$NtUninstallKB60071$\36366477\U\80000000.@
c:\windows\$NtUninstallKB60071$\36366477\U\80000004.@
c:\windows\$NtUninstallKB60071$\36366477\U\80000032.@
c:\windows\$NtUninstallKB60071$\3704866978
c:\windows\system32\6603C74903.dll
c:\windows\system32\6to4v32.dll
c:\windows\system32\NUSB3w32.dll
c:\windows\system32\PowerToyReadme.htm
c:\windows\system32\USB3Nw32.dll
c:\windows\Tasks\At1.job
c:\documents and settings\NetworkService\Cookies\K04EV0ZU.txt . . . . Failed to delete
c:\windows\$NtUninstallKB60071$ . . . . Failed to delete
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_6TO4
-------\Legacy_QUESTSCAN_SERVICE
-------\Service_6to4
-------\Service_QuestScan Service
-------\Legacy_NecUsb
-------\Legacy_Mp3Tube_Toolbar_Service
-------\Service_NecUsb
-------\Service_Mp3Tube Toolbar Service
.
.
((((((((((((((((((((((((( Files Created from 2011-11-26 to 2011-12-26 )))))))))))))))))))))))))))))))
.
.
2011-12-25 08:42 . 2011-08-31 23:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-25 02:24 . 2011-12-25 02:24 -------- d-----w- c:\program files\Microsoft Works
2011-12-25 02:20 . 2011-12-25 02:20 -------- d-----w- c:\program files\Microsoft.NET
2011-12-25 02:18 . 2011-12-25 02:17 29184 ----a-w- c:\windows\system32\x648a.com
2011-12-25 02:06 . 2011-12-25 02:06 -------- d-----w- c:\windows\system32\wbem\Repository
2011-12-25 02:05 . 2011-12-25 02:05 -------- d-----w- c:\program files\Common Files\Adobe
2011-12-25 02:02 . 2011-12-25 02:11 -------- d-----w- c:\documents and settings\David\Application Data\uTorrent
2011-12-25 02:01 . 2011-12-25 02:01 -------- d-----w- c:\program files\AVG
2011-12-25 01:56 . 2011-12-25 01:56 -------- d-----w- c:\documents and settings\NetworkService\PrivacIE
2011-12-22 06:06 . 2011-12-22 06:06 -------- d-----w- c:\documents and settings\David\Application Data\PMW
2011-12-20 22:42 . 2011-12-20 22:42 -------- d-----w- C:\$AVG
2011-12-20 22:29 . 2011-12-20 22:29 -------- d-----w- c:\documents and settings\David\Application Data\Malwarebytes
2011-12-20 22:29 . 2011-12-20 22:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-12-20 22:29 . 2011-12-25 08:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-20 21:59 . 2011-12-20 21:59 -------- d-----w- c:\program files\Trend Micro
2011-12-20 20:03 . 2011-12-20 20:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Common Files
2011-12-20 19:45 . 2011-12-25 02:04 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-12-20 19:16 . 2011-12-25 02:05 -------- d-s---w- c:\documents and settings\Administrator
2011-12-20 15:16 . 2011-12-20 15:16 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-12-19 22:53 . 2011-12-19 22:53 -------- d-----w- c:\documents and settings\NetworkService\IETldCache
2011-12-13 20:47 . 2011-12-25 02:17 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-11-29 18:39 . 2011-11-29 18:39 -------- d-----r- C:\MSOCache
2011-11-27 06:00 . 2011-11-27 06:00 -------- d-----w- c:\documents and settings\Guest\Local Settings\Application Data\Apple Computer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-04 11:23 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec
2011-10-10 14:22 . 2011-04-01 17:33 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2003-03-20 22:18 599040 ----a-w- c:\windows\system32\crypt32.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2011-05-30 14:50 21864 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-04-01 39408]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2011-11-14 3437976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2006-10-22 86016]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 282624]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-07-05 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-09 421736]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
.
R1 IDMTDI;IDMTDI;c:\windows\system32\drivers\idmtdi.sys [8/29/2011 8:47 AM 101616]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4/1/2011 3:03 PM 135664]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [4/1/2011 3:03 PM 135664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
NecUsbSevice REG_MULTI_SZ NecUsb
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2011-12-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-01 21:03]
.
2011-12-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-01 21:03]
.
2011-12-26 c:\windows\Tasks\User_Feed_Synchronization-{81A1D5B6-6057-4B71-B362-F925FD6E40FF}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 10:31]
.
2011-12-18 c:\windows\Tasks\wavepadShakeIcon.job
- c:\program files\NCH Swift Sound\WavePad\wavepad.exe [2011-04-09 02:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://biannual2012.com/
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
HKCU-Run-uTorrent - c:\program files\uTorrent\uTorrent.exe
Notify-NecUsb3Sevice - USB3Nw32.dll
Notify-USB3Nw32 - USB3Nw32.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-26 14:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,46,52,46,12,32,e0,f3,4e,9b,23,9e,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,46,52,46,12,32,e0,f3,4e,9b,23,9e,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{57b43206-adb5-447a-a0f9-e2924a5f3483}]
@Denied: (Full) (Everyone)
"Model"=dword:00000110
"Therad"=dword:00000020
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,88,79,0d,22,8e,33,17,75,e6,82,db,74,d6,1f,ea,8f,64,51,35,36,23,e5,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):0b,21,3c,e6,67,d9,d6,55,22,00,b8,9c,04,ca,06,1c,08,e9,19,ce,f1,
43,e5,26,44,d7,29,ef,8a,e3,5a,cc,6d,d2,2a,c0,e8,39,65,84,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ee,89,f8,96,cd,64,2d,ce,12,64,89,36,49,9f,df,ca,db,60,6b,69,e8,
4c,2b,f2,ef,3d,ce,ac,34,ac,c3,01,43,e7,ba,8b,0f,d8,cc,60,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{c82fb50d-dd22-4b89-a4e9-4f54b5a5c49a}]
@Denied: (Full) (Everyone)
"Model"=dword:0000013b
"Therad"=dword:0000000f
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(964)
c:\windows\system32\WININET.dll
c:\program files\Internet Download Manager\IDMShellExt.dll
c:\program files\Internet Download Manager\IDMNetMon.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\windows\System32\nvcpl.dll
c:\windows\System32\nvshell.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\windows\stsystra.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-12-26 15:02:02 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-26 21:01
.
Pre-Run: 49,014,607,872 bytes free
Post-Run: 53,930,807,296 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 57ED780467D527EA0EBDE62E284C083E

Hello

This is the tool I would like you to try and run next.

Please download aswMBR ( 511KB ) to your desktop.

• Double click the aswMBR.exe icon to run it
  
• Click the Scan button to start the scan
  
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Gringo

Thanks! it wants me to doenload Avast...should I download it?

thanks,
david

yes go ahead


gringo

Log:


aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software
Run date: 2011-12-26 15:40:28
-----------------------------
15:40:28.484 OS Version: Windows 5.1.2600 Service Pack 3
15:40:28.484 Number of processors: 2 586 0x6B01
15:40:28.484 ComputerName: DAVIDROOM UserName: David
15:40:29.562 Initialize success
15:54:56.796 AVAST engine defs: 11122601
15:55:13.515 The log file has been saved successfully to "C:\Documents and Settings\David\Desktop\aswMBR.txt"





Thanks!!

it does not look correct can you rerun it once more for me



gringo

aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software
Run date: 2011-12-26 15:40:28
-----------------------------
15:40:28.484 OS Version: Windows 5.1.2600 Service Pack 3
15:40:28.484 Number of processors: 2 586 0x6B01
15:40:28.484 ComputerName: DAVIDROOM UserName: David
15:40:29.562 Initialize success
15:54:56.796 AVAST engine defs: 11122601
15:55:13.515 The log file has been saved successfully to "C:\Documents and Settings\David\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software
Run date: 2011-12-26 15:40:28
-----------------------------
15:40:28.484 OS Version: Windows 5.1.2600 Service Pack 3
15:40:28.484 Number of processors: 2 586 0x6B01
15:40:28.484 ComputerName: DAVIDROOM UserName: David
15:40:29.562 Initialize success
15:54:56.796 AVAST engine defs: 11122601
15:55:13.515 The log file has been saved successfully to "C:\Documents and Settings\David\Desktop\aswMBR.txt"
18:37:44.812 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\nvgts1Port0Path0Target0Lun0
18:37:44.812 Disk 0 Vendor: WDC_WD80 10.0 Size: 76293MB BusType: 3
18:37:44.812 Device \Driver\nvgts -> DriverStartIo SCSIPORT.SYS f72d640e
18:37:44.859 Disk 0 MBR read successfully
18:37:44.859 Disk 0 MBR scan
18:37:46.531 Disk 0 Windows XP default MBR code
18:37:46.593 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76285 MB offset 63
18:37:47.171 Disk 0 scanning sectors +156232125
18:37:47.718 Disk 0 scanning C:\WINDOWS\system32\drivers
18:38:08.515 File: C:\WINDOWS\system32\drivers\netbt.sys **INFECTED** Win32:Aluroot [Rtk]
18:38:49.796 Service scanning
18:38:51.578 Modules scanning
18:39:23.812 Disk 0 trace - called modules:
18:39:23.828 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll SCSIPORT.SYS nvgts.sys
18:39:23.828 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x864be4c0]
18:39:23.828 3 CLASSPNP.SYS[f74c7fd7] -> nt!IofCallDriver -> \Device\0000005f[0x864b02c8]
18:39:23.828 5 ACPI.sys[f735e620] -> nt!IofCallDriver -> \Device\Scsi\nvgts1Port0Path0Target0Lun0[0x8646f030]
18:39:26.203 AVAST engine scan C:\WINDOWS
18:40:10.906 AVAST engine scan C:\WINDOWS\system32
18:43:29.234 File: C:\WINDOWS\system32\x648a.com **INFECTED** Win32:Malware-gen
18:43:33.046 AVAST engine scan C:\WINDOWS\system32\drivers
18:43:39.734 File: C:\WINDOWS\system32\drivers\netbt.sys **INFECTED** Win32:Aluroot [Rtk]
18:43:46.562 AVAST engine scan C:\Documents and Settings\David
18:45:44.890 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\David\Desktop\MBR.dat"
18:45:44.890 The log file has been saved successfully to "C:\Documents and Settings\David\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software
Run date: 2011-12-26 15:40:28
-----------------------------
15:40:28.484 OS Version: Windows 5.1.2600 Service Pack 3
15:40:28.484 Number of processors: 2 586 0x6B01
15:40:28.484 ComputerName: DAVIDROOM UserName: David
15:40:29.562 Initialize success
15:54:56.796 AVAST engine defs: 11122601
15:55:13.515 The log file has been saved successfully to "C:\Documents and Settings\David\Desktop\aswMBR.txt"
18:37:44.812 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\nvgts1Port0Path0Target0Lun0
18:37:44.812 Disk 0 Vendor: WDC_WD80 10.0 Size: 76293MB BusType: 3
18:37:44.812 Device \Driver\nvgts -> DriverStartIo SCSIPORT.SYS f72d640e
18:37:44.859 Disk 0 MBR read successfully
18:37:44.859 Disk 0 MBR scan
18:37:46.531 Disk 0 Windows XP default MBR code
18:37:46.593 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76285 MB offset 63
18:37:47.171 Disk 0 scanning sectors +156232125
18:37:47.718 Disk 0 scanning C:\WINDOWS\system32\drivers
18:38:08.515 File: C:\WINDOWS\system32\drivers\netbt.sys **INFECTED** Win32:Aluroot [Rtk]
18:38:49.796 Service scanning
18:38:51.578 Modules scanning
18:39:23.812 Disk 0 trace - called modules:
18:39:23.828 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll SCSIPORT.SYS nvgts.sys
18:39:23.828 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x864be4c0]
18:39:23.828 3 CLASSPNP.SYS[f74c7fd7] -> nt!IofCallDriver -> \Device\0000005f[0x864b02c8]
18:39:23.828 5 ACPI.sys[f735e620] -> nt!IofCallDriver -> \Device\Scsi\nvgts1Port0Path0Target0Lun0[0x8646f030]
18:39:26.203 AVAST engine scan C:\WINDOWS
18:40:10.906 AVAST engine scan C:\WINDOWS\system32
18:43:29.234 File: C:\WINDOWS\system32\x648a.com **INFECTED** Win32:Malware-gen
18:43:33.046 AVAST engine scan C:\WINDOWS\system32\drivers
18:43:39.734 File: C:\WINDOWS\system32\drivers\netbt.sys **INFECTED** Win32:Aluroot [Rtk]
18:43:46.562 AVAST engine scan C:\Documents and Settings\David
18:45:44.890 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\David\Desktop\MBR.dat"
18:45:44.890 The log file has been saved successfully to "C:\Documents and Settings\David\Desktop\aswMBR.txt"
18:45:49.406 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\David\Desktop\MBR.dat"
18:45:49.406 The log file has been saved successfully to "C:\Documents and Settings\David\Desktop\aswMBR.txt"

Greetings

I need you to make a bootable usb and to make a screenshot for me - follow the instructions below to do this

How to create a bootable Puppy USB Drive

• Download and save a copy of the latest Puppy ISO file
  
• Download and save a copy of Unetbootin for Windows.
  
• Insert an empty formatted USB drive into a USB port on the computer that's being used to create the bootable USB.
  
• Launch Unetbootin ....
  
• Ensure that Disk Image is selected.
  
• Using the browse button ... browse to and select the Puppy ISO file.
  
• Ensure that Type: is set to USB Drive and that the Drive: letter corresponds to the USB drive.
  
• Click OK

Unetbootin will now copy the Puppy files to the USB and make it a bootable device.

Next

You need to change the boot order of the computer to boot from a USB drive ....

• Read HERE for instructions how to do this.

Now boot into Puppylinux

when you get to the desktop Click on each of the drive items found in the bottom left corner to mount them (when mounted they will have a red cross next to them)

Next - Launch GParted which is found at Menu > System > GParted partition manager,
Click to select All Drives then click Okay
I need you to take a screenshot of the window that opens up - to do this follow these instructions

To take a screenshot in Puppy ....

With the GParted window open ...

• Click menu > Graphic > mtPaint-snapshot screen capture
  
• A small window will open ....
  
  
  • Click Capture Now
    
  • Click OK
  
  
• The mtPaint program will open ....
  
  • Click File > Save
    
  • Double click on ../
    
  • Double click on mnt/
    
  • Double click on sdb1/
    
  • Set File Format to JPEG
    
  • Enter screenshot1 into the text box
    
  • Click OK

This will save a file screenshot1.jpeg into the USB drive, paste or attach this to your next post

Next

• Click menu > shutdown > power off computer
  
• If prompted to save the session click on No

Puppy will now close down.

remove the usb and save it - we will use it again - boot back into windows and send me the screen capture

gringo

sorry for the delay! was at work! thanks for your help! heres what i have:

This post has been edited by crazimoose2112: 27 December 2011 - 01:16 AM

SystemLook:

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:

:filefind
netbt.sys
x648a.com 

• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

here it is:

SystemLook 30.07.11 by jpshortstuff
Log created at 00:41 on 27/12/2011 by David
Administrator - Elevation successful

========== filefind ==========

Searching for "netbt.sys"
C:\WINDOWS\$NtServicePackUninstall$\netbt.sys -----c- 162816 bytes [03:49 02/04/2011] [06:14 04/08/2004] 0C80E410CD2F47134407EE7DD19CC86B
C:\WINDOWS\ServicePackFiles\i386\netbt.sys ------- 162816 bytes [06:14 04/08/2004] [19:21 13/04/2008] 74B2B2F5BEA5E9A3DC021D685551BD3D
C:\WINDOWS\system32\drivers\netbt.sys --a---- 162816 bytes [20:37 16/07/2003] [19:21 13/04/2008] E83B450A3ADAE2D9EF4170474D94DDCC

Searching for "x648a.com "
C:\WINDOWS\system32\x648a.com --a---- 29184 bytes [02:18 25/12/2011] [02:17 25/12/2011] AB854DAC8C239A5C98808A05CFE6788D

-= EOF =-





thanks!

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

 ClearJavaCache::

KillAll::

File::
C:\WINDOWS\system32\x648a.com

FCopy::
C:\WINDOWS\ServicePackFiles\i386\netbt.sys | C:\WINDOWS\system32\drivers\netbt.sys

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

"information and logs"

In your next post I need the following


• report from Combofix
  
• let me know of any problems you may have had
  
• How is the computer doing now after running the script?

Gringo

I did as you said and it went smoothly at first. I got a couple of "this file is corrupt and/or missing" notifications. Also, the computer restarted and did a "consistency check" on the drives on the computer. Here is the log:

ComboFix 11-12-26.03 - David 12/27/2011 1:12.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.756 [GMT -6:00]
Running from: c:\documents and settings\David\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\David\Desktop\CFScript.txt.txt
.
FILE ::
"c:\windows\system32\x648a.com"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\x648a.com
.
.
--------------- FCopy ---------------
.
c:\windows\ServicePackFiles\i386\netbt.sys --> c:\windows\system32\drivers\netbt.sys
.
((((((((((((((((((((((((( Files Created from 2011-11-27 to 2011-12-27 )))))))))))))))))))))))))))))))
.
.
2011-12-25 08:42 . 2011-08-31 23:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-25 02:24 . 2011-12-25 02:24 -------- d-----w- c:\program files\Microsoft Works
2011-12-25 02:20 . 2011-12-25 02:20 -------- d-----w- c:\program files\Microsoft.NET
2011-12-25 02:06 . 2011-12-25 02:06 -------- d-----w- c:\windows\system32\wbem\Repository
2011-12-25 02:05 . 2011-12-25 02:05 -------- d-----w- c:\program files\Common Files\Adobe
2011-12-25 02:02 . 2011-12-25 02:11 -------- d-----w- c:\documents and settings\David\Application Data\uTorrent
2011-12-25 02:01 . 2011-12-25 02:01 -------- d-----w- c:\program files\AVG
2011-12-25 01:56 . 2011-12-25 01:56 -------- d-----w- c:\documents and settings\NetworkService\PrivacIE
2011-12-22 06:06 . 2011-12-22 06:06 -------- d-----w- c:\documents and settings\David\Application Data\PMW
2011-12-20 22:42 . 2011-12-20 22:42 -------- d-----w- C:\$AVG
2011-12-20 22:29 . 2011-12-20 22:29 -------- d-----w- c:\documents and settings\David\Application Data\Malwarebytes
2011-12-20 22:29 . 2011-12-20 22:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-12-20 22:29 . 2011-12-25 08:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-20 21:59 . 2011-12-20 21:59 -------- d-----w- c:\program files\Trend Micro
2011-12-20 20:03 . 2011-12-20 20:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Common Files
2011-12-20 19:45 . 2011-12-25 02:04 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-12-20 19:16 . 2011-12-25 02:05 -------- d-s---w- c:\documents and settings\Administrator
2011-12-20 15:16 . 2011-12-20 15:16 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-12-19 22:53 . 2011-12-19 22:53 -------- d-----w- c:\documents and settings\NetworkService\IETldCache
2011-12-13 20:47 . 2011-12-25 02:17 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-11-29 18:39 . 2011-11-29 18:39 -------- d-----r- C:\MSOCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-04 11:23 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec
2011-10-10 14:22 . 2011-04-01 17:33 692736 ----a-w- c:\windows\system32\inetcomm.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-26_20.53.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-12-27 07:28 . 2011-12-27 07:28 16384 c:\windows\Temp\Perflib_Perfdata_600.dat
+ 2003-07-16 20:37 . 2008-04-13 19:21 162816 c:\windows\system32\dllcache\netbt.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2011-05-30 14:50 21864 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-04-01 39408]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2011-11-14 3437976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2006-10-22 86016]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 282624]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-07-05 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-09 421736]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
.
R1 IDMTDI;IDMTDI;c:\windows\system32\drivers\idmtdi.sys [8/29/2011 8:47 AM 101616]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [4/1/2011 3:03 PM 135664]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [4/1/2011 3:03 PM 135664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
NecUsbSevice REG_MULTI_SZ NecUsb
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2011-12-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-01 21:03]
.
2011-12-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-01 21:03]
.
2011-12-26 c:\windows\Tasks\User_Feed_Synchronization-{81A1D5B6-6057-4B71-B362-F925FD6E40FF}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 10:31]
.
2011-12-18 c:\windows\Tasks\wavepadShakeIcon.job
- c:\program files\NCH Swift Sound\WavePad\wavepad.exe [2011-04-09 02:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://biannual2012.com/
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-27 01:29
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,46,52,46,12,32,e0,f3,4e,9b,23,9e,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,46,52,46,12,32,e0,f3,4e,9b,23,9e,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{57b43206-adb5-447a-a0f9-e2924a5f3483}]
@Denied: (Full) (Everyone)
"Model"=dword:00000110
"Therad"=dword:00000020
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,88,79,0d,22,8e,33,17,75,e6,82,db,74,d6,1f,ea,8f,64,51,35,36,23,e5,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):0b,21,3c,e6,67,d9,d6,55,22,00,b8,9c,04,ca,06,1c,08,e9,19,ce,f1,
43,e5,26,44,d7,29,ef,8a,e3,5a,cc,6d,d2,2a,c0,e8,39,65,84,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ee,89,f8,96,cd,64,2d,ce,12,64,89,36,49,9f,df,ca,db,60,6b,69,e8,
4c,2b,f2,ef,3d,ce,ac,34,ac,c3,01,43,e7,ba,8b,0f,d8,cc,60,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{c82fb50d-dd22-4b89-a4e9-4f54b5a5c49a}]
@Denied: (Full) (Everyone)
"Model"=dword:0000013b
"Therad"=dword:0000000f
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3912)
c:\windows\system32\WININET.dll
c:\program files\Internet Download Manager\IDMShellExt.dll
c:\program files\Internet Download Manager\IDMNetMon.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\windows\stsystra.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-12-27 01:34:43 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-27 07:34
ComboFix2.txt 2011-12-26 21:02
.
Pre-Run: 53,974,724,608 bytes free
Post-Run: 54,039,924,736 bytes free
.
- - End Of File - - 5A4F2E071CBF367E5987B013A97084A6