Avast found trojan horse...

Avast found few trojan horses and popped up the warning window 3 or 4 times. Then, Avast put few files to the temp directories for quarantine. The names of the trojan horses are xpre and xrun. Then, I use counterspy and it found and removed the trojan.Rootkit.gen
Could someone please help and see if there are other virus or spyware in my system? What should I do next? Thanks.

Edited by atw000, 01 February 2009 - 01:06 AM.

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a description of your problem, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.com
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results, click no to the Optional_Scan
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

R,
K

I have attached the captures. Also, I followed the "4 Simple Steps for removing Spyware, Hijackers, Viruses, and other Malware". They only found a couple of other virus. Thanks.

Trend Micro's Housecall Online Virus Scan
Panda Software's ActiveScan Online Virus Scan
Using Spybot - Search & Destroy
LavaSoft
Using Ad-aware to remove Spyware/Hijackers from Your Computer.

DDS (Ver_09-02-01.01) - NTFSx86
Run by Allen at 22:21:03.90 on Wed 02/11/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.142 [GMT -8:00]

AV: avast! antivirus 4.8.1335 [VPS 090210-0] *On-access scanning enabled* (Updated)
FW: COMODO Firewall Pro *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sandboxie\SbieSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Password Keychain\Passkeychain.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\Allen\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = file:///E:/Welcome.htm
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://my.netzero.net/s/search?r=minisearch
mSearch Page = hxxp://my.netzero.net/s/search?r=minisearch
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://my.netzero.net/s/search?r=minisearch
uURLSearchHooks: URLSearchHook Class: {37d2cdbf-2af4-44aa-8113-bd0d2da3c2b8} - c:\program files\netzero\SearchEnh1.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: CitiUSBrowserHelper Class: {387edf53-1cf2-4523-bc2f-13462651be8c} - c:\program files\virtual account numbers\BhoCitUS.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot - search & destroy\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
TB: ZeroBar: {f5735c15-1fb2-41fe-ba12-242757e69dde} - c:\program files\netzero\toolbar.dll
TB: ZeroBar: {f0f8ecbe-d460-4b34-b007-56a92e8f84a7} - c:\program files\netzero\Toolbar.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe
uRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
uRun: [SandboxieControl] "c:\program files\sandboxie\SbieCtrl.exe"
uRun: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\RegistryBooster.exe /S
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [COMODO Firewall Pro] "c:\program files\comodo\firewall\CPF.exe" /background
mRun: [Password Keychain] c:\program files\password keychain\Passkeychain.exe /H
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {DE700910-58F7-4D2E-B7E6-3BA2DA1B6806} - c:\progra~1\virtual account numbers\CitiVAN.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\windows\system32\msjava.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot - search & destroy\SDHelper.dll
Trusted Zone: turbotax.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: lbxfile - {56831180-F115-11d2-B6AA-00104B2B9943} - c:\program files\libronix dls\system\FileProt.dll
Handler: lbxres - {24508F1B-9E94-40EE-9759-9AF5795ADF52} - c:\program files\libronix dls\system\ResProt.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\allen\applic~1\mozilla\firefox\profiles\ohdv3prb.default\
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-1-31 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-2-1 28544]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-4-28 114768]
R1 cwmtdi;cwmtdi;c:\windows\system32\drivers\cwmtdi.sys [2007-5-14 48640]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-22 55024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-4-28 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-4-28 138680]
R2 CmdAgent;Comodo Application Agent;c:\program files\comodo\firewall\cmdagent.exe [2007-6-27 361040]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 950096]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-4-28 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-4-28 352920]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2009-1-5 103936]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-22 7408]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\sbredrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]

=============== Created Last 30 ================

2009-02-05 23:10 <DIR> --d----- c:\docume~1\allen\applic~1\Uniblue
2009-02-01 19:39 28,544 a------- c:\windows\system32\drivers\pavboot.sys
2009-02-01 19:37 <DIR> --d----- c:\program files\Panda Security
2009-02-01 00:39 102,664 a------- c:\windows\system32\drivers\tmcomm.sys
2009-02-01 00:37 <DIR> --d----- c:\documents and settings\allen\.housecall6.6
2009-02-01 00:27 <DIR> --d----- c:\docume~1\allen\applic~1\IObit
2009-02-01 00:08 15,688 a------- c:\windows\system32\lsdelete.exe
2009-01-31 23:07 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-01-31 23:03 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-31 23:03 <DIR> --d----- c:\program files\Lavasoft
2009-01-30 01:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Sunbelt
2009-01-29 22:03 <DIR> --d----- C:\Sandbox
2009-01-29 22:02 2,974 a------- c:\windows\Sandboxie.ini
2009-01-29 22:02 <DIR> --d----- c:\program files\Sandboxie
2009-01-29 21:56 <DIR> --d----- c:\program files\SpywareBlaster
2009-01-29 20:30 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-01-29 20:30 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-01-29 20:30 <DIR> --d----- c:\docume~1\allen\applic~1\SUPERAntiSpyware.com
2009-01-29 20:16 <DIR> --d----- c:\program files\Trend Micro
2009-01-29 01:03 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-01-29 01:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-01-28 23:25 2,774 a------- c:\windows\system32\rn.tmp
2009-01-19 13:10 <DIR> --d----- c:\program files\MSXML 4.0
2009-01-16 20:07 <DIR> --d----- c:\docume~1\allen\applic~1\Libronix DLS
2009-01-16 20:07 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Libronix DLS
2009-01-16 20:05 <DIR> --d----- c:\program files\Libronix DLS

==================== Find3M ====================

2009-01-16 21:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
2009-01-05 14:33 3,751,995 a------- c:\windows\system32\GPhotos.scr
2008-12-19 01:10 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 01:10 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2008-12-18 21:25 634,024 -------- c:\windows\system32\dllcache\iexplore.exe
2008-12-18 21:23 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2008-12-11 02:57 333,952 -------- c:\windows\system32\dllcache\srv.sys
2008-10-19 01:50 1,360,384 a---h--- c:\docume~1\allen\applic~1\V4RB.dll
2008-10-19 01:50 64,512 a---h--- c:\docume~1\allen\applic~1\rbap450.dll
2008-04-30 12:40 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat
2006-07-01 09:26 88 ---shr-- c:\windows\system32\CF8813EB82.sys
2006-07-01 09:26 2,516 a--sh--- c:\windows\system32\KGyGaAvL.sys
2008-07-23 00:04 16,384 a--sh--- c:\windows\system32\config\systemprofile\cookies\index.dat
2008-07-23 00:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
2008-07-23 00:03 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008072320080724\index.dat
2008-07-23 00:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

============= FINISH: 22:22:17.06 ===============

Edited by PropagandaPanda, 12 February 2009 - 06:33 PM.

Hello.

Those logs look clean.

Please tell me what item Avast! is flagging as trojans.

Download and run MalwareBytes Anti-Malware
If you already have MBAM installed, simply update and run a quick scan.

Please download Malwarebytes Anti-Malware setup and to your desktop.
alternate download link 1
alternate download link 2

Refer to the steps given here on installing MalwareBytes, running the scan, and saving the log file (not on using File Assasin).

• If you have trouble updating, try the other mirror download site.
• Should the computer in question not be able update using the normal method download the update file from here, using another machine if needed. Simple double click the file to install the updates.
• If MalwareBytes asks to reboot to remove certain items, do so right away.

Please include the scan logfile in your next reply.

Update Java to Version 6 Update 12
Your current version of Java is outdated. Malware creators can exploit the lesser security of older versions. Please uninstall your current version through Add/Remove Programs. Remove all instances of Java, J2SE Runtime, Java Runtime, and Java Runtime Environment. Restart your computer after uninstalling.

Please download the installer here. Choose "Windows"

Delete the installer after use.

---

Please post a new DDS.txt after.

With Regards,
The Panda

Here is what I found from Avast log:
1/28/2009 10:09:05 AM SYSTEM 1452 AAVM - scanning warning: x_AavmCheckFileDirectEx: http://www.sfsymphony.org/ScriptResource.a...287182783750000 (C:\WINDOWS\TEMP\_avast4_\unp216677148.tmp) returning error, 0000A413.
1/28/2009 11:34:30 PM SYSTEM 1440 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\DOCUME~1\Allen\LOCALS~1\Temp\prun.tmp" file.
1/28/2009 11:35:30 PM SYSTEM 1440 Sign of "Win32:Secat [Trj]" has been found in "C:\DOCUME~1\Allen\LOCALS~1\Temp\rasesnet.tmp\[UPX]" file.
1/28/2009 11:35:46 PM SYSTEM 1440 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\DOCUME~1\Allen\LOCALS~1\Temp\winvsnet.tmp" file.
1/28/2009 11:38:19 PM SYSTEM 1440 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\DOCUME~1\Allen\LOCALS~1\Temp\prun.tmp" file.
1/28/2009 11:38:40 PM SYSTEM 1440 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\DOCUME~1\Allen\LOCALS~1\Temp\winvsnet.tmp" file.
1/28/2009 11:38:56 PM SYSTEM 1440 Sign of "Win32:Fasec [Trj]" has been found in "C:\WINDOWS\system32\drivers\seneka.sys" file.
1/28/2009 11:49:29 PM Allen 2184 Sign of "JS:Downtr [Trj]" has been found in "C:\Documents and Settings\Allen\Local Settings\Application Data\Microsoft\Windows Live Mail\Hotmail (al fed\Work\5DB233EA-0000001D.eml\An analysis of the Ilookup Trojan.doc#4125581404" file.
1/28/2009 11:50:00 PM Allen 2184 Sign of "Win32:Patched-JJ [Trj]" has been found in "C:\Documents and Settings\Allen\Local Settings\Temp\pouqdetfsk.tmp" file.
1/29/2009 8:31:24 PM SYSTEM 1436 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\Allen\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.BIN (C:\Documents and Settings\Allen\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.BIN) returning error, 0000A413.

Thanks for your help!

Edited by atw000, 13 February 2009 - 03:14 AM.

Right now, I have Spybot Teatimer, Ad-Adaware realtime protection, Windows Defender and Avast for monitoring realtime process. The computer is getting quite slow. Should I enable all of them for realtime monitoring? Which ones should I use?

For scanning, in addition to the above, I have superantispyware and malwarebyte installed as well. Which ones should I use for periodic scanning? Which ones I can delete from my computer? Thanks.

Hello.

Let's first take care of this infection. DDS was not able to detect the rootkit.

Disable Realtime Protection
Antimalware programs can interfere with the tools we need to run. Please temporarily disable all realtime protections you have enabled. Refer to this page, if you are unsure how.

Disable Avast!'s realtime protection by right clicking on the try icon beside your clock that looks like and selecting Stop On-Access Protection.

In the settings:


To disable SpyBot's TeaTimer:

• Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
• If prompted with a legal dialog, accept the warning.
• Click and then on "Advanced Mode"
  
• You may be presented with a warning dialog. If so, press
• Click on
• Click on
• Uncheck this checkbox:
  
• Close/Exit Spybot Search and Destroy

Download and Run ComboFix
Download Combofix by sUBs from any of the links below, and save it to your desktop.
Link 1, Link 2, Link 3

• Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
• Double click on ComboFix.exe and follow the prompts. If you are using Windows Vista, right click the icon and select "Run as Administrator". You will not recieve the prompts below if you are not using Windows XP. ComboFix will check to see if you have the Windows Recovery Console installed.
• If you did not have it installed, you will see the prompt below. Choose YES.
  
  
  
• When the Recovery Console has been installed, you will see the prompt below. Choose YES.
  
• When finished, ComboFix will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Download and Run Scan with GMER
We will use GMER to scan for rootkits.

Please download GMER.zip to your desktop from any of the links below:
LINK1, LINK2

• Right click on GMER.zip and select "Extract All".
• Close all other open programs as there is a slight chance your computer will crash.
• Double click GMER.exe. Your security programs may detect GMER's driver trying to load. Allow it.
• You may see a warning saying "GMER has detected rootkit activity". If so, select NO.
• Leaving the settings at default, click Scan.
• When the scan is complete, click Save and save the log onto your desktop.

Please include the log in your next reply.

---

In your next reply include:
-the ComboFix log
-the GMER scan log

With Regards,
The Panda

Here are the files, thanks.

ComboFix 09-02-12.03 - Allen 2009-02-13 18:30:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.220 [GMT -8:00]
Running from: c:\documents and settings\Allen\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090212-0] *On-access scanning disabled* (Updated)
FW: COMODO Firewall Pro *enabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Allen\Application Data\rbap450.dll
c:\documents and settings\Allen\Application Data\V4RB.dll
c:\documents and settings\Echo.PC\Application Data\rbap450.dll
c:\documents and settings\Echo.PC\Application Data\V4RB.dll
c:\windows\IE4 Error Log.txt

.
((((((((((((((((((((((((( Files Created from 2009-01-14 to 2009-02-14 )))))))))))))))))))))))))))))))
.

2009-02-13 18:26 . 2009-02-13 18:27 <DIR> d-------- C:\32788R22FWJFW
2009-02-12 23:59 . 2009-02-12 23:58 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-12 23:59 . 2009-02-12 23:58 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-12 22:50 . 2009-02-12 22:50 <DIR> d-------- c:\documents and settings\Allen\Application Data\Malwarebytes
2009-02-12 22:49 . 2009-02-12 22:50 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-12 22:49 . 2009-02-12 22:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-12 22:49 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-12 22:49 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-05 23:10 . 2009-02-05 23:10 <DIR> d-------- c:\documents and settings\Allen\Application Data\Uniblue
2009-02-01 23:06 . 2009-02-01 23:06 <DIR> d-------- c:\documents and settings\Echo.PC\Application Data\Sunbelt
2009-02-01 19:39 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-02-01 19:37 . 2009-02-01 19:37 <DIR> d-------- c:\program files\Panda Security
2009-02-01 00:39 . 2009-02-01 00:38 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys
2009-02-01 00:37 . 2009-02-01 19:34 <DIR> d-------- c:\documents and settings\Allen\.housecall6.6
2009-02-01 00:27 . 2009-02-01 00:27 <DIR> d-------- c:\documents and settings\Allen\Application Data\IObit
2009-02-01 00:08 . 2009-01-31 23:07 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-01-31 23:07 . 2009-01-31 23:07 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-01-31 23:03 . 2009-01-31 23:03 <DIR> d-------- c:\program files\Lavasoft
2009-01-31 23:03 . 2009-01-31 23:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-31 23:03 . 2009-01-31 23:04 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-30 01:27 . 2009-01-30 01:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sunbelt
2009-01-29 22:23 . 2009-01-29 22:23 <DIR> d-------- c:\documents and settings\Echo.PC\Application Data\SUPERAntiSpyware.com
2009-01-29 22:03 . 2009-01-29 22:27 <DIR> d-------- C:\Sandbox
2009-01-29 22:02 . 2009-01-29 22:02 <DIR> d-------- c:\program files\Sandboxie
2009-01-29 22:02 . 2009-02-13 00:26 2,974 --a------ c:\windows\Sandboxie.ini
2009-01-29 21:56 . 2009-01-29 21:57 <DIR> d-------- c:\program files\SpywareBlaster
2009-01-29 20:30 . 2009-01-29 21:36 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-01-29 20:30 . 2009-01-29 20:30 <DIR> d-------- c:\documents and settings\Allen\Application Data\SUPERAntiSpyware.com
2009-01-29 20:30 . 2009-01-29 20:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-01-29 20:16 . 2009-01-29 20:16 <DIR> d-------- c:\program files\Trend Micro
2009-01-29 19:55 . 2009-02-09 21:53 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-01-29 01:03 . 2009-01-31 22:21 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-29 01:03 . 2009-01-31 23:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-28 23:25 . 2009-01-28 23:25 2,774 --a------ c:\windows\system32\rn.tmp
2009-01-19 13:10 . 2009-01-19 13:10 <DIR> d-------- c:\program files\MSXML 4.0
2009-01-16 20:07 . 2009-01-16 21:20 <DIR> d-------- c:\documents and settings\Allen\Application Data\Libronix DLS
2009-01-16 20:07 . 2009-01-16 20:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Libronix DLS
2009-01-16 20:05 . 2009-01-16 20:24 <DIR> d-------- c:\program files\Libronix DLS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-14 02:29 --------- d-----w c:\program files\Blue Coat K9 Web Protection
2009-02-13 07:58 --------- d-----w c:\program files\Java
2009-02-11 21:41 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-01 08:27 --------- d-----w c:\program files\IObit
2009-01-30 09:26 --------- d-----w c:\program files\Sunbelt Software
2009-01-30 04:29 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-01-17 05:35 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll
2009-01-13 23:39 72,992 ----a-w c:\windows\system32\drivers\bckd.sys
2009-01-10 20:04 --------- d-----w c:\documents and settings\Allen\Application Data\Sonic
2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr
2008-12-28 05:57 --------- d-----w c:\program files\Google
2008-12-19 09:10 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-04-30 20:40 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2006-07-01 17:26 88 --sh--r c:\windows\system32\CF8813EB82.sys
2006-07-01 17:26 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys
2008-07-23 08:04 16,384 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
2008-07-23 08:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2008-07-23 08:03 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008072320080724\index.dat
2008-07-23 08:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-04 94208]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2009-01-05 336896]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"COMODO Firewall Pro"="c:\program files\Comodo\Firewall\CPF.exe" [2007-06-27 1115728]
"Password Keychain"="c:\program files\Password Keychain\Passkeychain.exe" [2003-07-16 1437696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-31 509784]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-12 148888]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 c:\windows\LOGI_MWX.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

c:\documents and settings\Echo.PC\Start Menu\Programs\Startup\
Sandboxed Web Browser.lnk - c:\program files\Sandboxie\Start.exe [2009-01-05 37888]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-31 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-02-01 28544]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-28 114768]
R1 bckd;bckd;c:\windows\system32\drivers\bckd.sys [2009-01-13 72992]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-28 20560]
R2 bckwfs;Blue Coat K9 Web Protection;c:\program files\Blue Coat K9 Web Protection\k9filter.exe [2007-04-30 1078560]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 SbieDrv;SbieDrv;c:\program files\Sandboxie\SbieDrv.sys [2009-01-05 103936]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-02-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-31 23:07]

2008-11-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2008-06-28 c:\windows\Tasks\McAfee.com Scan for Viruses - My Computer (PC-Echo).job
- c:\program files\mcafee.com\vso\mcmnhdlr.exe []

2009-02-14 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
HKCU-Run-Uniblue RegistryBooster 2 - c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe


.
------- Supplementary Scan -------
.
uStart Page = file:///E:/Welcome.htm
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: {{DE700910-58F7-4D2E-B7E6-3BA2DA1B6806} - c:\progra~1\Virtual Account Numbers\CitiVAN.exe
Trusted Zone: turbotax.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\Allen\Application Data\Mozilla\Firefox\Profiles\ohdv3prb.default\
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-13 18:32:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-02-13 18:34:12
ComboFix-quarantined-files.txt 2009-02-14 02:34:08

Pre-Run: 121,536,950,272 bytes free
Post-Run: 121,579,016,192 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

196 --- E O F --- 2009-02-13 07:05:51

Edited by PropagandaPanda, 14 February 2009 - 10:05 AM.

Hello.

Looks good.

Submit File to Online Scanner

There is a file that I would like you to check out for me using VirusTotal/VirSCAN

• Open VirusTotal Online Scanner or VirSCAN. If one site is busy or down, try the other
• At the top of the page you'll see a box. Paste in the following line(s) (do one line at a time).
• c:\windows\system32\drivers\bckd.sys

• Click Submit.
• Wait for the scan to finish.
• Copy Scanner Results into your next reply.
• If more than one file was listed, repeat for each of them.

Update Java to Version 6 Update 12
Your current version of Java is outdated. Malware creators can exploit the lesser security of older versions. Please uninstall your current version through Add/Remove Programs. Remove all instances of Java, J2SE Runtime, Java Runtime, and Java Runtime Environment. Restart your computer after uninstalling.

Please download the installer here. Choose "Windows"

Delete the installer after use.

F-Secure Online Scan
Please run F-Secure Online Scanner.
This scan is for Internet Explorer only.

• It is suggested that you disable security programs and close any other windows during the scan. While your security is disabled, please refrain from surfing on other sites. Refer to this page if you are unsure how.
• Go to F-Secure Online Scanner
• Follow the instructions here for installation.
• Accept the License Agreement.
• Once the ActiveX installs, click Full System Scan
• Once the download completes, the scan will begin automatically. The scan will take some time to finish, so please be patient.
• When the scan completes, click the Automatic cleaning (recommended) button.
• Click the Show Report button and copy the entire report in your next reply.
• Be sure to re-enable any security programs.

---

Also include a new DDS.txt.

Please tell me of any symptoms.

With Regards,
The Panda

I don't see any symptoms. Here are the files. Thanks.

DDS (Ver_09-02-01.01) - NTFSx86
Run by Allen at 0:46:05.78 on Sun 02/15/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.285 [GMT -8:00]

AV: avast! antivirus 4.8.1335 [VPS 090214-0] *On-access scanning enabled* (Updated)
FW: COMODO Firewall Pro *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Password Keychain\Passkeychain.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\Comodo\Firewall\cpf.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Allen\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = file:///E:/Welcome.htm
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: URLSearchHook Class: {37d2cdbf-2af4-44aa-8113-bd0d2da3c2b8} - c:\program files\netzero\SearchEnh1.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: CitiUSBrowserHelper Class: {387edf53-1cf2-4523-bc2f-13462651be8c} - c:\program files\virtual account numbers\BhoCitUS.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot - search & destroy\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: ZeroBar: {f5735c15-1fb2-41fe-ba12-242757e69dde} - c:\program files\netzero\toolbar.dll
TB: ZeroBar: {f0f8ecbe-d460-4b34-b007-56a92e8f84a7} - c:\program files\netzero\Toolbar.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe
uRun: [SandboxieControl] "c:\program files\sandboxie\SbieCtrl.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [COMODO Firewall Pro] "c:\program files\comodo\firewall\CPF.exe" /background
mRun: [Password Keychain] c:\program files\password keychain\Passkeychain.exe /H
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {DE700910-58F7-4D2E-B7E6-3BA2DA1B6806} - c:\progra~1\virtual account numbers\CitiVAN.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot - search & destroy\SDHelper.dll
Trusted Zone: turbotax.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} - hxxp://support.f-secure.com/ols/fscax.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: lbxfile - {56831180-F115-11d2-B6AA-00104B2B9943} - c:\program files\libronix dls\system\FileProt.dll
Handler: lbxres - {24508F1B-9E94-40EE-9759-9AF5795ADF52} - c:\program files\libronix dls\system\ResProt.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\allen\applic~1\mozilla\firefox\profiles\ohdv3prb.default\
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-1-31 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-2-1 28544]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-4-28 114768]
R1 bckd;bckd;c:\windows\system32\drivers\bckd.sys [2009-1-13 72992]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-22 55024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-4-28 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-4-28 138680]
R2 bckwfs;Blue Coat K9 Web Protection;c:\program files\blue coat k9 web protection\k9filter.exe [2007-4-30 1078560]
R2 CmdAgent;Comodo Application Agent;c:\program files\comodo\firewall\cmdagent.exe [2007-6-27 361040]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-4-28 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-4-28 352920]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2009-1-5 103936]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 950096]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-22 7408]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\sbredrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]

=============== Created Last 30 ================

2009-02-14 23:43 <DIR> --d----- C:\fsaua.data
2009-02-13 18:43 250 a------- c:\windows\gmer.ini
2009-02-13 18:29 <DIR> a-dshr-- C:\cmdcons
2009-02-13 18:27 161,792 a------- c:\windows\SWREG.exe
2009-02-13 18:27 98,816 a------- c:\windows\sed.exe
2009-02-12 23:59 73,728 a------- c:\windows\system32\javacpl.cpl
2009-02-12 23:59 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-12 22:50 <DIR> --d----- c:\docume~1\allen\applic~1\Malwarebytes
2009-02-12 22:49 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-12 22:49 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-12 22:49 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-12 22:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-05 23:10 <DIR> --d----- c:\docume~1\allen\applic~1\Uniblue
2009-02-01 19:39 28,544 a------- c:\windows\system32\drivers\pavboot.sys
2009-02-01 19:37 <DIR> --d----- c:\program files\Panda Security
2009-02-01 00:39 102,664 a------- c:\windows\system32\drivers\tmcomm.sys
2009-02-01 00:37 <DIR> --d----- c:\documents and settings\allen\.housecall6.6
2009-02-01 00:27 <DIR> --d----- c:\docume~1\allen\applic~1\IObit
2009-02-01 00:08 15,688 a------- c:\windows\system32\lsdelete.exe
2009-01-31 23:07 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-01-31 23:03 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-31 23:03 <DIR> --d----- c:\program files\Lavasoft
2009-01-30 01:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Sunbelt
2009-01-29 22:03 <DIR> --d----- C:\Sandbox
2009-01-29 22:02 3,182 a------- c:\windows\Sandboxie.ini
2009-01-29 22:02 <DIR> --d----- c:\program files\Sandboxie
2009-01-29 21:56 <DIR> --d----- c:\program files\SpywareBlaster
2009-01-29 20:30 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-01-29 20:30 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-01-29 20:30 <DIR> --d----- c:\docume~1\allen\applic~1\SUPERAntiSpyware.com
2009-01-29 20:16 <DIR> --d----- c:\program files\Trend Micro
2009-01-29 01:03 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-01-29 01:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-01-28 23:25 2,774 a------- c:\windows\system32\rn.tmp
2009-01-19 13:10 <DIR> --d----- c:\program files\MSXML 4.0
2009-01-16 20:07 <DIR> --d----- c:\docume~1\allen\applic~1\Libronix DLS
2009-01-16 20:07 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Libronix DLS
2009-01-16 20:05 <DIR> --d----- c:\program files\Libronix DLS

==================== Find3M ====================

2009-01-16 21:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
2009-01-13 15:39 72,992 a------- c:\windows\system32\drivers\bckd.sys
2009-01-05 14:33 3,751,995 a------- c:\windows\system32\GPhotos.scr
2008-12-19 01:10 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 01:10 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2008-12-18 21:25 634,024 -------- c:\windows\system32\dllcache\iexplore.exe
2008-12-18 21:23 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2008-12-11 02:57 333,952 -------- c:\windows\system32\dllcache\srv.sys
2008-04-30 12:40 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat
2006-07-01 09:26 88 ---shr-- c:\windows\system32\CF8813EB82.sys
2006-07-01 09:26 2,516 a--sh--- c:\windows\system32\KGyGaAvL.sys
2008-07-23 00:04 16,384 a--sh--- c:\windows\system32\config\systemprofile\cookies\index.dat
2008-07-23 00:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
2008-07-23 00:03 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008072320080724\index.dat
2008-07-23 00:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

============= FINISH: 0:47:06.28 ===============

Edited by PropagandaPanda, 15 February 2009 - 10:02 AM.

Hello.

Looks good. Unless there are any issues, we can wrap up.

Uninstall ComboFix
Remove Combofix now that we're done with it.

• Click on your Start Menu, then Run....
• Now type combofix /u in the runbox and click OK. Notice the space between the "x" and "/".
  
  
• When shown the disclaimer, Select "2"

Uninstalling ComboFix will do the following:

• Delete ComboFix and its components from your computer.
• Delete other tools commonly used during the malware removal process.
• Resets clock settings to standard format.
• Hides file extensions and hidden/system files.
• Clears System Restore cache and creates new restore point.

Preventing Malware Infection in the Future
Please take some time to look at the following links, giving some advice and suggestions for preventing future infections:

• So How did I get infected?
• Microsoft - 'Security at home'

For general slowness problems that you may have, take a look at Slow Computer/browser? It May Not Be Malware. Read How to use the Startup Database to identify and disable uneeded processes and increase the amount of available resources.

---

Do you have any further questions or concerns?

With Regards,
The Panda

Right now, I have Spybot Teatimer, Ad-Adaware realtime protection, Windows Defender and Avast for monitoring realtime protection. The computer is getting quite slow. Should I enable all of them for realtime protection? Which ones should I use?

For periodic scanning, in addition to the above, I have superantispyware and malwarebyte installed as well. Which ones should I use for periodic scanning? Which ones I can delete from my computer? Thanks.

Hello.

Feel free to disable Ad-Aware Monitoring, and Windows Defender. They are not very good in my opinion.

Periodic scanning, I would leave to MalwareBytes. It's very quick and takes up less space than SAS.

With Regards,
THe Panda

There had been no reply from the topic starter in 5 days. Due to inactivity, this topic is now closed.
If you are the topic starter and need this topic reopened, send me a message.

Everyone else, please begin a new topic.

With Regards,
The Panda