Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Another Google Redirect


  • This topic is locked This topic is locked
10 replies to this topic

#1 Sickoota

Sickoota

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:08:03 PM

Posted 10 March 2009 - 01:04 PM

You guys seem to be getting alot of these.

Here's DDS.txt



DDS (Ver_09-02-01.01) - NTFSx86
Run by Kevin at 14:00:54.67 on 2009-03-10
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_02
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2045.1438 [GMT -4:00]

AV: Kaspersky Internet Security *On-access scanning enabled* (Updated)
FW: Kaspersky Internet Security *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaSafeConnectWatcher.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\Program Files\Sana Security\Primary Response SafeConnect\agent\bin\SanaAgent.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Sana Security\Primary Response SafeConnect\agent\bin\SanaSafeConnect.exe
C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CO2 Saver\CO2Saver.exe
C:\Program Files\Sana Security\Primary Response SafeConnect\agent\bin\SanaMonitor.exe
C:\WINDOWS\system32\dlcxcoms.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\FirstClass\fcc32.exe
C:\Documents and Settings\Kevin\My Documents\My Pictures\MySTyle\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NVRaidService] c:\windows\system32\nvraidservice.exe
mRun: [CTDVDDET] "c:\program files\creative\sound blaster x-fi\dvdaudio\CTDVDDET.EXE"
mRun: [VolPanel] "c:\program files\creative\sound blaster x-fi\volume panel\VolPanel.exe" /r
mRun: [AudioDrvEmulator] "c:\program files\creative\shared files\module loader\dllml.exe" -1 audiodrvemulator "c:\program files\creative\shared files\module loader\audio emulator\AudDrvEm.dll"
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [SanaSafeConnect] "c:\program files\sana security\primary response safeconnect\agent\bin\SanaSafeConnect.exe"
mRun: [FaxCenterServer] "c:\program files\dell pc fax\fm3032.exe" /s
mRun: [dlcxmon.exe] "c:\program files\dell photo aio printer 926\dlcxmon.exe"
mRun: [DLCXCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCXtime.dll,_RunDLLEntry@16
mRun: [EnGraph QuickTimeKiller] c:\program files\engraph\quicktimekiller\QuickTimeKiller.exe
mRun: [CTXFIHLP] CTXFIHLP.EXE
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [34e35348] rundll32.exe "c:\windows\system32\nmlfeycn.dll",b
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRunOnce: [RealUpgradeHelper] "c:\program files\common files\real\update_ob\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\co2sav~1.lnk - c:\program files\co2 saver\CO2Saver.exe
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: Add to Banner Ad Blocker - c:\program files\kaspersky lab\kaspersky internet security 2009\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by134fd.bay134.hotmail.msn.com/resources/MsnPUpld.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - hxxp://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
Notify: klogon - c:\windows\system32\klogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kevin\applic~1\mozilla\firefox\profiles\3d24uqo7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll

============= SERVICES / DRIVERS ===============

R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-2-15 33808]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-2-15 226832]
R2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe [2008-11-11 206088]
R2 SanaSafeConnectAgent;SanaSafeConnectAgent;c:\program files\sana security\primary response safeconnect\agent\bin\SanaAgent.exe [2008-3-21 4937240]
R2 SanaSafeConnectWatcher;SanaSafeConnectWatcher;c:\program files\sana security\primary response safeconnect\agent\bin\SanaSafeConnectWatcher.exe [2008-3-21 539160]
R3 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592]
R3 SanaSafeConnectDriver;SanaSafeConnectDriver;c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\SafeConnectDriver.sys [2008-3-21 161304]
S3 SanaSafeConnectFilter;SanaSafeConnectFilter;c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\SafeConnectFilter.sys [2008-3-21 29720]
S3 SanaSafeConnectShim;SanaSafeConnectShim;c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\SafeConnectShim.sys [2008-3-21 27376]
S3 XDva121;XDva121; [x]

=============== Created Last 30 ================

2009-03-10 13:31 <DIR> a-dshr-- C:\cmdcons
2009-03-10 13:30 161,792 a------- c:\windows\SWREG.exe
2009-03-10 13:30 98,816 a------- c:\windows\sed.exe
2009-03-10 13:30 388,608 a------- c:\windows\system32\CF4447.exe
2009-03-10 13:30 <DIR> --d----- C:\ComboFix
2009-03-10 13:03 <DIR> --d----- c:\windows\system32\NtmsData
2009-03-06 15:38 <DIR> --d----- c:\windows\system32\XPSViewer
2009-03-06 15:37 14,048 -------- c:\windows\system32\spmsg2.dll
2009-03-06 15:32 507,400 a------- c:\windows\system32\XAudio2_1.dll
2009-03-06 15:32 65,032 a------- c:\windows\system32\XAPOFX1_0.dll
2009-03-06 15:32 3,850,760 a------- c:\windows\system32\D3DX9_38.dll
2009-03-06 15:32 1,491,992 a------- c:\windows\system32\D3DCompiler_38.dll
2009-03-06 15:32 479,752 a------- c:\windows\system32\XAudio2_0.dll
2009-03-06 15:32 467,984 a------- c:\windows\system32\d3dx10_38.dll
2009-03-06 15:32 238,088 a------- c:\windows\system32\xactengine3_1.dll
2009-03-06 15:32 238,088 a------- c:\windows\system32\xactengine3_0.dll
2009-03-06 15:32 25,608 a------- c:\windows\system32\X3DAudio1_4.dll
2009-03-06 15:32 25,608 a------- c:\windows\system32\X3DAudio1_3.dll
2009-03-06 15:31 <DIR> --d----- c:\windows\Logs
2009-03-06 00:08 <DIR> --d----- c:\program files\iPod
2009-03-06 00:08 <DIR> --d----- c:\program files\iTunes
2009-03-06 00:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-03-06 00:07 <DIR> --d----- c:\program files\Bonjour
2009-02-27 18:43 189,072 a------- c:\windows\system32\PnkBstrB.xtr
2009-02-18 22:01 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NortonInstaller
2009-02-16 19:07 <DIR> --d----- c:\program files\Audacity 1.3 Beta (Unicode)
2009-02-15 16:33 386 a------- c:\windows\system32\%LocalXml%
2009-02-15 14:54 101,287 a------- c:\windows\system32\drivers\klin.dat
2009-02-15 14:54 89,601 a------- c:\windows\system32\drivers\klick.dat
2009-02-15 14:54 33,808 a------- c:\windows\system32\drivers\klbg.sys
2009-02-15 14:53 8,053,280 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-02-15 14:53 876,576 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2009-02-15 14:53 63,996 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-02-15 14:53 4,076 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2009-02-15 14:53 <DIR> --d----- c:\program files\Kaspersky Lab
2009-02-15 14:53 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2009-02-15 14:36 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
2009-02-13 11:34 250 a------- c:\windows\gmer.ini
2009-02-10 18:01 <DIR> --d----- c:\docume~1\kevin\applic~1\Malwarebytes
2009-02-10 18:01 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-10 18:01 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 18:01 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-10 18:01 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes

==================== Find3M ====================

2009-03-02 21:30 189,072 a------- c:\windows\system32\PnkBstrB.exe
2009-03-02 21:07 138,920 a------- c:\windows\system32\drivers\PnkBstrK.sys
2009-02-27 18:33 75,064 a------- c:\windows\system32\PnkBstrA.exe
2009-01-31 15:31 413,696 a------- c:\windows\system32\wrap_oal.dll
2009-01-31 15:31 110,592 a------- c:\windows\system32\OpenAL32.dll
2008-12-13 02:40 3,593,216 a------- c:\windows\system32\dllcache\mshtml.dll
2008-12-11 07:57 333,184 -------- c:\windows\system32\dllcache\srv.sys
2007-12-26 16:05 22,328 a------- c:\docume~1\kevin\applic~1\PnkBstrK.sys
2004-07-22 11:51 3,432,656 a------- c:\program files\ManagedDX.CAB
2004-07-19 23:58 1,156,363 a------- c:\program files\BDANT.cab
2004-07-19 23:53 976,020 a------- c:\program files\BDAXP.cab
2004-07-09 15:17 13,265,040 a------- c:\program files\dxnt.cab
2004-07-09 10:13 15,493,481 a------- c:\program files\DirectX.cab
2004-07-09 10:13 703,080 a------- c:\program files\BDA.cab
2004-07-09 05:08 472,576 a------- c:\program files\dxsetup.exe
2004-07-09 05:08 2,242,560 a------- c:\program files\dsetup32.dll
2004-07-09 04:03 62,976 a------- c:\program files\DSETUP.dll
2003-04-09 14:48 3,759,264 a------- c:\documents and settings\kevin\setup.exe
2007-07-11 12:52 104 ---shr-- c:\windows\system32\77DC10F2E5.sys
2007-07-17 22:03 88 ---shr-- c:\windows\system32\E9269B9401.sys
2007-07-17 22:03 10,954 a--sh--- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 14:01:19.92 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Members
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:08:03 PM

Posted 22 March 2009 - 12:47 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

R,
K
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)

#3 Sickoota

Sickoota
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:08:03 PM

Posted 23 March 2009 - 07:41 PM

My problem is that my google search results are being misdirected towards ad/malware sites.


DDS (Ver_09-03-16.01) - NTFSx86
Run by Kevin at 20:32:23.78 on Mon 03/23/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_02
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2045.1093 [GMT -4:00]

AV: Kaspersky Internet Security *On-access scanning enabled* (Updated)
FW: Kaspersky Internet Security *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaSafeConnectWatcher.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\Program Files\Sana Security\Primary Response SafeConnect\agent\bin\SanaAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Sana Security\Primary Response SafeConnect\agent\bin\SanaSafeConnect.exe
C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\WINDOWS\system32\dlcxcoms.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Sana Security\Primary Response SafeConnect\agent\bin\SanaMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\CO2 Saver\CO2Saver.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Audacity 1.3 Beta (Unicode)\audacity.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Image-Line\FL Studio 8\FL.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\FirstClass\fcc32.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Steam\Steam.exe
C:\WINDOWS\system32\mspaint.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Kevin\My Documents\My Pictures\MySTyle\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NVRaidService] c:\windows\system32\nvraidservice.exe
mRun: [CTDVDDET] "c:\program files\creative\sound blaster x-fi\dvdaudio\CTDVDDET.EXE"
mRun: [VolPanel] "c:\program files\creative\sound blaster x-fi\volume panel\VolPanel.exe" /r
mRun: [AudioDrvEmulator] "c:\program files\creative\shared files\module loader\dllml.exe" -1 audiodrvemulator "c:\program files\creative\shared files\module loader\audio emulator\AudDrvEm.dll"
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [SanaSafeConnect] "c:\program files\sana security\primary response safeconnect\agent\bin\SanaSafeConnect.exe"
mRun: [FaxCenterServer] "c:\program files\dell pc fax\fm3032.exe" /s
mRun: [dlcxmon.exe] "c:\program files\dell photo aio printer 926\dlcxmon.exe"
mRun: [DLCXCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCXtime.dll,_RunDLLEntry@16
mRun: [EnGraph QuickTimeKiller] c:\program files\engraph\quicktimekiller\QuickTimeKiller.exe
mRun: [CTXFIHLP] CTXFIHLP.EXE
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [34e35348] rundll32.exe "c:\windows\system32\nmlfeycn.dll",b
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRunOnce: [RealUpgradeHelper] "c:\program files\common files\real\update_ob\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\co2sav~1.lnk - c:\program files\co2 saver\CO2Saver.exe
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: Add to Banner Ad Blocker - c:\program files\kaspersky lab\kaspersky internet security 2009\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by134fd.bay134.hotmail.msn.com/resources/MsnPUpld.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - hxxp://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
Notify: klogon - c:\windows\system32\klogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kevin\applic~1\mozilla\firefox\profiles\3d24uqo7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll

============= SERVICES / DRIVERS ===============

R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-2-15 33808]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-2-15 226832]
R2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe [2008-11-11 206088]
R2 SanaSafeConnectAgent;SanaSafeConnectAgent;c:\program files\sana security\primary response safeconnect\agent\bin\SanaAgent.exe [2008-3-21 4937240]
R2 SanaSafeConnectWatcher;SanaSafeConnectWatcher;c:\program files\sana security\primary response safeconnect\agent\bin\SanaSafeConnectWatcher.exe [2008-3-21 539160]
R3 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592]
R3 SanaSafeConnectDriver;SanaSafeConnectDriver;c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\SafeConnectDriver.sys [2008-3-21 161304]
S3 SanaSafeConnectFilter;SanaSafeConnectFilter;c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\SafeConnectFilter.sys [2008-3-21 29720]
S3 SanaSafeConnectShim;SanaSafeConnectShim;c:\program files\sana security\primary response safeconnect\agent\driver\platform_xp\SafeConnectShim.sys [2008-3-21 27376]
S3 XDva121;XDva121; [x]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2009-03-16 16:46 <DIR> --d----- c:\documents and settings\kevin\Tracing
2009-03-16 16:44 <DIR> --d----- c:\program files\Microsoft
2009-03-16 16:44 <DIR> --d----- c:\program files\Windows Live SkyDrive
2009-03-16 16:41 <DIR> --d----- c:\program files\common files\Windows Live
2009-03-13 17:18 <DIR> --d----- c:\program files\Lame for Audacity
2009-03-12 16:00 <DIR> --d----- c:\program files\Outsim
2009-03-12 15:49 <DIR> --d----- c:\program files\fruity loops studio 8.0.2 xxl producer edition with fix
2009-03-11 03:02 <DIR> --d----- c:\program files\MSXML 6.0
2009-03-10 13:31 <DIR> a-dshr-- C:\cmdcons
2009-03-10 13:30 161,792 a------- c:\windows\SWREG.exe
2009-03-10 13:30 98,816 a------- c:\windows\sed.exe
2009-03-10 13:30 388,608 a------- c:\windows\system32\CF4447.exe
2009-03-10 13:30 <DIR> --d----- C:\ComboFix
2009-03-10 13:03 <DIR> --d----- c:\windows\system32\NtmsData
2009-03-06 15:38 <DIR> --d----- c:\windows\system32\XPSViewer
2009-03-06 15:37 14,048 -------- c:\windows\system32\spmsg2.dll
2009-03-06 15:32 507,400 a------- c:\windows\system32\XAudio2_1.dll
2009-03-06 15:32 65,032 a------- c:\windows\system32\XAPOFX1_0.dll
2009-03-06 15:32 3,850,760 a------- c:\windows\system32\D3DX9_38.dll
2009-03-06 15:32 1,491,992 a------- c:\windows\system32\D3DCompiler_38.dll
2009-03-06 15:32 479,752 a------- c:\windows\system32\XAudio2_0.dll
2009-03-06 15:32 467,984 a------- c:\windows\system32\d3dx10_38.dll
2009-03-06 15:32 238,088 a------- c:\windows\system32\xactengine3_1.dll
2009-03-06 15:32 238,088 a------- c:\windows\system32\xactengine3_0.dll
2009-03-06 15:32 25,608 a------- c:\windows\system32\X3DAudio1_4.dll
2009-03-06 15:32 25,608 a------- c:\windows\system32\X3DAudio1_3.dll
2009-03-06 15:31 <DIR> --d----- c:\windows\Logs
2009-03-06 00:08 <DIR> --d----- c:\program files\iPod
2009-03-06 00:08 <DIR> --d----- c:\program files\iTunes
2009-03-06 00:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-03-06 00:07 <DIR> --d----- c:\program files\Bonjour
2009-02-27 18:43 189,072 a------- c:\windows\system32\PnkBstrB.xtr

==================== Find3M ====================

2009-03-22 22:33 189,072 a------- c:\windows\system32\PnkBstrB.exe
2009-03-22 22:32 138,920 a------- c:\windows\system32\drivers\PnkBstrK.sys
2009-03-20 22:21 999,456 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2009-03-20 22:21 4,496 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2009-03-19 20:26 77,241 a------- c:\windows\War3Unin.dat
2009-03-15 22:49 8,053,280 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-03-15 22:49 63,996 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-02-27 18:33 75,064 a------- c:\windows\system32\PnkBstrA.exe
2009-02-15 16:33 33,808 a------- c:\windows\system32\drivers\klbg.sys
2009-02-15 16:33 101,287 a------- c:\windows\system32\drivers\klin.dat
2009-02-15 16:33 89,601 a------- c:\windows\system32\drivers\klick.dat
2009-02-09 06:19 1,846,272 a------- c:\windows\system32\win32k.sys
2009-02-09 06:19 1,846,272 -------- c:\windows\system32\dllcache\win32k.sys
2009-02-06 18:52 49,504 a------- c:\windows\system32\sirenacm.dll
2009-01-31 15:31 413,696 a------- c:\windows\system32\wrap_oal.dll
2009-01-31 15:31 110,592 a------- c:\windows\system32\OpenAL32.dll
2009-01-16 21:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
2007-12-26 16:05 22,328 a------- c:\docume~1\kevin\applic~1\PnkBstrK.sys
2004-07-22 11:51 3,432,656 a------- c:\program files\ManagedDX.CAB
2004-07-19 23:58 1,156,363 a------- c:\program files\BDANT.cab
2004-07-19 23:53 976,020 a------- c:\program files\BDAXP.cab
2004-07-09 15:17 13,265,040 a------- c:\program files\dxnt.cab
2004-07-09 10:13 15,493,481 a------- c:\program files\DirectX.cab
2004-07-09 10:13 703,080 a------- c:\program files\BDA.cab
2004-07-09 05:08 472,576 a------- c:\program files\dxsetup.exe
2004-07-09 05:08 2,242,560 a------- c:\program files\dsetup32.dll
2004-07-09 04:03 62,976 a------- c:\program files\DSETUP.dll
2003-04-09 14:48 3,759,264 a------- c:\documents and settings\kevin\setup.exe
2007-07-11 12:52 104 ---shr-- c:\windows\system32\77DC10F2E5.sys
2007-07-17 22:03 88 ---shr-- c:\windows\system32\E9269B9401.sys
2007-07-17 22:03 10,954 a--sh--- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 20:33:23.76 ===============

Attached Files



#4 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:03 PM

Posted 24 March 2009 - 04:10 PM

Hello. I am PropagandaPanda (Panda or PP for short), and I will be helping you.

Yup, a lot of these.

Disable Realtime Protection
Antimalware programs can interfere with ComboFix and other tools we need to run. Please temporarily disable all realtime protections you have enabled. Refer to this page, if you are unsure how.

Download and Run ComboFix
Download Combofix by sUBs from any of the links below, and save it to your desktop.
Link 1, Link 2, Link 3
  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Double click on ComboFix.exe and follow the prompts. If you are using Windows Vista, right click the icon and select "Run as Administrator". You will not recieve the prompts below if you are not using Windows XP. ComboFix will check to see if you have the Windows Recovery Console installed.
  • If you did not have it installed, you will see the prompt below. Choose YES.
    Posted ImagePosted Image

  • When the Recovery Console has been installed, you will see the prompt below. Choose YES.
    Posted Image
  • When finished, ComboFix will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Download and Run Scan with GMER
We will use GMER to scan for rootkits.

Please download GMER.zip to your desktop from any of the links below:
LINK1, LINK2
  • Right click on GMER.zip and select "Extract All".
  • Close all other open programs as there is a slight chance your computer will crash.
  • Double click GMER.exe. Your security programs may detect GMER's driver trying to load. Allow it.
  • You may see a warning saying "GMER has detected rootkit activity". If so, select NO.
  • Leaving the settings at default, click Scan.
  • When the scan is complete, click Save and save the log onto your desktop.
Please include the log in your next reply.
In your next reply include:
-the ComboFix log
-the GMER scan log

Please also tell me of any changes you have made to your computer since you started your topic.

With Regards,
The Panda

#5 Sickoota

Sickoota
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:08:03 PM

Posted 25 March 2009 - 09:43 PM

The GMer scaan keeps crashing, I'm going to try and run another one overnight. In the interim here's the combofix log



ComboFix 09-03-23.01 - Kevin 2009-03-24 17:27:46.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2045.1269 [GMT -4:00]
Running from: c:\documents and settings\Kevin\My Documents\My Pictures\MySTyle\ComboFix1.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\program files\QUAD Utilities
c:\program files\QUAD Utilities\QUAD Registry Cleaner\program.log
c:\program files\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner.exe
c:\program files\QUAD Utilities\QUAD Registry Cleaner\Styles\Vista.cjstyles
c:\windows\system32\byrlhlwt.ini
c:\windows\system32\drivers\senekayovkypxo.sys
c:\windows\system32\Filnqtwa.ini
c:\windows\system32\Filnqtwa.ini2
c:\windows\system32\ncyeflmn.ini
c:\windows\system32\okfhgvnt.ini
c:\windows\system32\twain32
c:\windows\system32\twain32\local.ds
c:\windows\system32\twain32\user.ds
c:\windows\system32\twain32\user.ds.lll
c:\windows\system32\uniq.tll

.
((((((((((((((((((((((((( Files Created from 2009-02-24 to 2009-03-24 )))))))))))))))))))))))))))))))
.

2009-03-23 21:02 . 2009-03-23 21:02 <DIR> d-------- c:\program files\Ask.com
2009-03-23 21:02 . 2009-03-23 21:02 775,168 --a------ c:\windows\isRS-000.tmp
2009-03-23 21:01 . 2009-03-23 21:01 <DIR> d-------- c:\program files\Webroot
2009-03-23 21:01 . 2009-03-23 21:01 <DIR> d-------- c:\program files\MSSOAP
2009-03-23 21:01 . 2009-03-23 21:01 <DIR> d-------- c:\documents and settings\Kevin\Application Data\Webroot
2009-03-23 21:01 . 2009-03-23 21:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\Webroot
2009-03-23 21:01 . 2009-03-05 17:10 1,553,784 --a------ c:\windows\WRSetup.dll
2009-03-23 21:00 . 2009-03-23 21:00 164 --a------ c:\windows\install.dat
2009-03-16 16:46 . 2009-03-23 23:24 <DIR> d-------- c:\documents and settings\Kevin\Tracing
2009-03-16 16:44 . 2009-03-16 16:44 <DIR> d-------- c:\program files\Windows Live SkyDrive
2009-03-16 16:44 . 2009-03-16 16:44 <DIR> d-------- c:\program files\Microsoft
2009-03-16 16:41 . 2009-03-16 16:41 <DIR> d-------- c:\program files\Common Files\Windows Live
2009-03-13 17:18 . 2009-03-13 17:18 <DIR> d-------- c:\program files\Lame for Audacity
2009-03-12 16:00 . 2009-03-12 16:00 <DIR> d-------- c:\program files\Outsim
2009-03-12 15:49 . 2008-11-02 02:26 <DIR> d-------- c:\program files\fruity loops studio 8.0.2 xxl producer edition with fix
2009-03-11 03:02 . 2009-03-11 03:02 <DIR> d-------- c:\program files\MSXML 6.0
2009-03-10 13:30 . 2009-03-24 17:26 <DIR> d-------- C:\ComboFix
2009-03-10 13:03 . 2009-03-10 13:29 <DIR> d-------- c:\windows\system32\NtmsData
2009-03-06 15:39 . 2009-03-06 15:39 <DIR> d-------- c:\program files\MSBuild
2009-03-06 15:38 . 2009-03-06 15:38 <DIR> d-------- c:\windows\system32\XPSViewer
2009-03-06 15:37 . 2009-03-06 15:37 <DIR> d-------- c:\program files\Reference Assemblies
2009-03-06 15:37 . 2006-06-29 14:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-03-06 15:32 . 2008-05-30 15:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll
2009-03-06 15:32 . 2008-05-30 15:11 1,491,992 --a------ c:\windows\system32\D3DCompiler_38.dll
2009-03-06 15:32 . 2008-05-30 15:19 507,400 --a------ c:\windows\system32\XAudio2_1.dll
2009-03-06 15:32 . 2008-03-05 17:03 479,752 --a------ c:\windows\system32\XAudio2_0.dll
2009-03-06 15:32 . 2008-05-30 15:11 467,984 --a------ c:\windows\system32\d3dx10_38.dll
2009-03-06 15:32 . 2008-05-30 15:18 238,088 --a------ c:\windows\system32\xactengine3_1.dll
2009-03-06 15:32 . 2008-03-05 17:03 238,088 --a------ c:\windows\system32\xactengine3_0.dll
2009-03-06 15:32 . 2008-05-30 15:17 65,032 --a------ c:\windows\system32\XAPOFX1_0.dll
2009-03-06 15:32 . 2008-05-30 15:17 25,608 --a------ c:\windows\system32\X3DAudio1_4.dll
2009-03-06 15:32 . 2008-03-05 17:00 25,608 --a------ c:\windows\system32\X3DAudio1_3.dll
2009-03-06 15:31 . 2009-03-06 15:31 <DIR> d-------- c:\windows\Logs
2009-03-06 00:08 . 2009-03-06 00:08 <DIR> d-------- c:\program files\iTunes
2009-03-06 00:08 . 2009-03-06 00:08 <DIR> d-------- c:\program files\iPod
2009-03-06 00:08 . 2009-03-06 00:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-03-06 00:07 . 2009-03-06 00:07 <DIR> d-------- c:\program files\Bonjour
2009-03-06 00:06 . 2009-03-06 00:06 <DIR> d-------- c:\program files\QuickTime
2009-02-27 18:43 . 2009-03-22 22:33 189,072 --a------ c:\windows\system32\PnkBstrB.xtr
2009-02-25 15:24 . 2009-02-25 15:24 176,752 --a------ c:\windows\system32\drivers\ssidrv.sys
2009-02-25 15:24 . 2009-02-25 15:24 29,808 --a------ c:\windows\system32\drivers\ssfs0bbc.sys
2009-02-25 15:24 . 2009-02-25 15:24 23,152 --a------ c:\windows\system32\drivers\sshrmd.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-24 21:25 4,608 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-03-24 21:25 1,032,224 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-03-24 20:51 --------- d-----w c:\program files\Steam
2009-03-24 05:00 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-24 01:23 --------- d-----w c:\program files\dl_cats
2009-03-24 01:23 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-03-24 01:20 8,053,280 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-24 01:20 63,996 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-24 01:15 --------- d-----w c:\documents and settings\Kevin\Application Data\Audacity
2009-03-23 02:33 189,072 ----a-w c:\windows\system32\PnkBstrB.exe
2009-03-23 02:32 138,920 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-20 03:40 --------- d-----w c:\program files\Warcraft III
2009-03-16 20:43 --------- d-----w c:\program files\Windows Live
2009-03-12 20:01 --------- d-----w c:\program files\Vstplugins
2009-03-12 20:01 --------- d-----w c:\program files\Image-Line
2009-03-11 07:10 --------- d-----w c:\program files\Microsoft Silverlight
2009-03-06 04:09 --------- d-----w c:\program files\Apple Software Update
2009-03-06 04:08 --------- d-----w c:\program files\Common Files\Apple
2009-02-27 22:33 75,064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-02-19 03:36 --------- d-----w c:\program files\Google
2009-02-19 02:06 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-02-19 02:05 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-19 02:01 --------- d-----w c:\documents and settings\All Users\Application Data\NortonInstaller
2009-02-16 23:07 --------- d-----w c:\program files\Audacity 1.3 Beta (Unicode)
2009-02-15 20:33 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-15 20:33 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-15 20:33 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-02-15 20:31 --------- d-----w c:\program files\HTTP-Tunnel
2009-02-15 18:53 --------- d-----w c:\program files\Kaspersky Lab
2009-02-15 18:36 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-02-10 22:01 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-10 22:01 --------- d-----w c:\documents and settings\Kevin\Application Data\Malwarebytes
2009-02-10 22:01 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-09 10:19 1,846,272 ----a-w c:\windows\system32\win32k.sys
2009-02-09 10:19 1,846,272 ------w c:\windows\system32\dllcache\win32k.sys
2009-02-07 22:07 --------- d-----w c:\program files\AML Products
2009-02-06 22:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-01-31 19:32 --------- d-----w c:\program files\Trials 2 Second Edition
2009-01-31 19:31 413,696 ----a-w c:\windows\system32\wrap_oal.dll
2009-01-31 19:31 110,592 ----a-w c:\windows\system32\OpenAL32.dll
2009-01-31 19:31 --------- d-----w c:\program files\OpenAL
2009-01-31 17:10 --------- d-----w c:\program files\Sana Security
2009-01-31 17:09 --------- d-----w c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-01-25 15:38 --------- d-----w c:\program files\Veoh Networks
2009-01-25 15:37 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-24 01:39 --------- d-----w c:\program files\Starcraft
2009-01-17 01:35 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll
2007-12-26 20:05 22,328 ----a-w c:\documents and settings\Kevin\Application Data\PnkBstrK.sys
2004-07-22 15:51 3,432,656 ----a-w c:\program files\ManagedDX.CAB
2004-07-20 03:58 1,156,363 ----a-w c:\program files\BDANT.cab
2004-07-20 03:53 976,020 ----a-w c:\program files\BDAXP.cab
2004-07-09 19:17 13,265,040 ----a-w c:\program files\dxnt.cab
2004-07-09 14:13 703,080 ----a-w c:\program files\BDA.cab
2004-07-09 14:13 15,493,481 ----a-w c:\program files\DirectX.cab
2004-07-09 09:08 472,576 ----a-w c:\program files\dxsetup.exe
2004-07-09 09:08 2,242,560 ----a-w c:\program files\dsetup32.dll
2004-07-09 08:03 62,976 ----a-w c:\program files\DSETUP.dll
2003-04-09 18:48 3,759,264 ----a-w c:\documents and settings\Kevin\setup.exe
2007-07-11 16:52 104 --sh--r c:\windows\system32\77DC10F2E5.sys
2007-07-18 02:03 88 --sh--r c:\windows\system32\E9269B9401.sys
2007-07-18 02:03 10,954 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-02-09 15:06 764296 --a------ c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-04 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2006-08-03 137216]
"CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"SanaSafeConnect"="c:\program files\Sana Security\Primary Response SafeConnect\agent\bin\SanaSafeConnect.exe" [2008-03-21 1378840]
"FaxCenterServer"="c:\program files\Dell PC Fax\fm3032.exe" [2006-06-15 307200]
"dlcxmon.exe"="c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe" [2006-06-14 286720]
"DLCXCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-06-07 106496]
"EnGraph QuickTimeKiller"="c:\program files\EnGraph\QuickTimeKiller\QuickTimeKiller.exe" [2005-03-20 45056]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-15 206088]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-03-05 6308728]
"CTXFIHLP"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe" [2008-10-09 136768]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
CO2 Saver.lnk - c:\program files\CO2 Saver\CO2Saver.exe [2007-06-22 229448]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=c:\windows\pss\Google Updater.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BITTORRENT]
--a------ 2008-03-24 19:25 587568 c:\program files\BitTorrent\bittorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 07:00 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a------ 2005-10-05 05:12 94208 c:\program files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-06-10 10:44 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-06-10 10:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2009-01-06 14:06 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MemoryCardManager]
--a------ 2006-06-27 07:34 299008 c:\program files\Dell Photo AIO Printer 926\memcard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-05 17:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 04:00 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-04-04 05:47 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 03:00 90112 c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2005-11-08 14:30 16384 c:\windows\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-10-04 18:14 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RetroWDSvc"=2 (0x2)
"RetroLauncher"=2 (0x2)
"Retrospect Helper"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\dlcxcoms.exe"=
"c:\\PROGRAM FILES\\BITTORRENT\\BITTORRENT.EXE"= c:\\Program Files\\BitTorrent\\bittorrent.exe
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\LimePower\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Flagship Studios\\Hellgate London Demo\\Launcher.exe"=
"c:\\Program Files\\Unreal Tournament 3 Demo\\Binaries\\UT3Demo.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3sp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv\\Civilization4.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\fallout 3\\FalloutLauncher.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-02-15 33808]
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-02-25 29808]
R2 SanaSafeConnectAgent;SanaSafeConnectAgent;c:\program files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaAgent.exe [2008-03-21 4937240]
R2 SanaSafeConnectWatcher;SanaSafeConnectWatcher;c:\program files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaSafeConnectWatcher.exe [2008-03-21 539160]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [2009-03-23 1178728]
R3 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
R3 SanaSafeConnectDriver;SanaSafeConnectDriver;c:\program files\Sana Security\Primary Response SafeConnect\agent\driver\platform_XP\SafeConnectDriver.sys [2008-03-21 161304]
S3 SanaSafeConnectFilter;SanaSafeConnectFilter;c:\program files\Sana Security\Primary Response SafeConnect\agent\driver\platform_XP\SafeConnectFilter.sys [2008-03-21 29720]
S3 SanaSafeConnectShim;SanaSafeConnectShim;c:\program files\Sana Security\Primary Response SafeConnect\agent\driver\platform_XP\SafeConnectShim.sys [2008-03-21 27376]
S3 XDva121;XDva121; [x]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5
*NewlyCreated* - GUSVC
*NewlyCreated* - SSFS0BBC
*NewlyCreated* - SSHRMD
*NewlyCreated* - SSIDRV
*NewlyCreated* - WEBROOTSPYSWEEPERSERVICE
*NewlyCreated* - WRCONSUMERSERVICE
.
Contents of the 'Scheduled Tasks' folder

2009-03-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]

2009-03-24 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-23 23:59]

2009-03-24 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-02-09 15:06]

2009-03-24 c:\windows\Tasks\wrSpySweeper_LEBE1AEDE08434E358979555E43CF8EA6.job
- c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe [2009-03-05 17:10]

2009-03-24 c:\windows\Tasks\wrSpySweeper_LEBE1AEDE08434E358979555E43CF8EA6.job
- c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe [2009-03-05 17:10]

2009-03-24 c:\windows\Tasks\wrSpySweeper_LEBE1AEDE08434E358979555E43CF8EA6.job
- C:\ [2009-03-24 17:27]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-34e35348 - c:\windows\system32\nmlfeycn.dll


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\3d24uqo7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=WBR&o=13993&locale=en_US&q=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
.
.
------- File Associations -------
.
regfile="regedit.exe" "%1"
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-24 17:32:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3079613058-3876417152-2091376438-1007\Software\Cryptic\KRCOH]
@Denied: (Read) (Administrators)
"Locale"=dword:00000000
"accountName"=""
"gamma"="1.000000"
"fxSoundVolume"="1.000000"
"musicSoundVolume"="0.600000"
"dontSaveName"="0"
"reverseMouseButtons"="0"
"screenX"="1024"
"screenY"="768"
"refreshRate"="60"
"screenX_pos"="0"
"screenY_pos"="0"
"maximized"="0"
"fullScreen"="1"
"mipLevel"="-1"
"characterMipLevel"="0"
"texLodBias"="2"
"texAniso"="4"
"worldDetailLevel"="1.000000"
"entityDetailLevel"="1.000000"
"shadowsOn"="1"
"physicsOn"="1"
"maxParticles"="50000"
"maxParticleFill"="10.000000"
"suppressFx"="0"
"forceSoftwareAudio"="0"
"enableVBOs"="1"
"enableJoystick"="1"
"enable3DSound"="0"
"renderScaleX"="1.000000"
"renderScaleY"="1.000000"
"useRenderScale"="0"
"shaderDetail"="3"
"useWater"="2"
"useBloom"="1"
"bloomMagnitude"="1.000000"
"useDOF"="1"
"dofMagnitude"="1.000000"
"antiAliasing"="1"
"useLightmaps"="0"
"useVSync"="1"
.
Completion time: 2009-03-24 17:36:27
ComboFix-quarantined-files.txt 2009-03-24 21:35:42

Pre-Run: 15,200,202,752 bytes free
Post-Run: 15,228,534,784 bytes free

402 --- E O F --- 2009-03-16 02:49:28

Attached Files



#6 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:03 PM

Posted 26 March 2009 - 07:25 AM

Hello.

Let's try RootRepeal then. I see evidence of rootkit activity.

Download and Run Scan with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop:
  • Extract RootRepeal.exe from the zip archive.
  • Open RootRepea.exe on your desktop.
  • Click the Report tab.
  • Click the Scan button.
  • Check all six boxes.
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.
With Regards,
The Panda

#7 Sickoota

Sickoota
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:08:03 PM

Posted 27 March 2009 - 10:45 PM

Root repeal gives me some blue screen whenever I run it.

#8 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:03 PM

Posted 28 March 2009 - 09:30 AM

Hello.

Install ERUNT
This tool will create a complete backup of your registry. After every reboot, a new backup is created to ensure we have a safety net after each step. Do not delete these backups until we are finished.

Do not use the NTREGOPT that comes with the installation package.
  • Please download erunt-setup.exe to your desktop.
  • Double click erunt-setup.exe. If you are using Windows Vista, right click the icon and select "Run As Administrator." Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes only if you are using Windows XP. You can delete the installation file after use.
  • Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.
You can find a complete guide to using the program here:
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

When we are finished, you may, remove ERUNT using Add/Remove Programs.

Download The Avenger and Run Script
Please download The Avenger by Swandog46 to your Desktop.
  • Right click avenger.zip and extract the contents to your desktop
  • Start the Avenger.exe.
  • Copy all the text contained in the qoute box below to your Clipboard by highlighting it, right clicking and selecting Copy:
    Drivers to delete:
    seneka
  • Click Posted Image to paste the script from the clipboard.
  • Check the Disable rookits automatically box.
  • Click the Execute button
  • Answer Yes twice when prompted.
The process is completely automatic. Do not touch your computer until a log file opens.

The Avenger will do the following:
  • It will Restart your computer. (In cases where the code to execute contains "Drivers to Unload", the Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt (considering your operating drive is C:). Post back with it in your next reply.
After, run ComboFix again and post back that log too.

With Regards,
The Panda

#9 Sickoota

Sickoota
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:08:03 PM

Posted 05 April 2009 - 12:31 AM

I forgot to save the avenger log, but it basically said the file was not found.

Here's the combofix



ComboFix 09-04-04.01 - Kevin 2009-04-05 0:54:40.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2045.1422 [GMT -4:00]
Running from: c:\documents and settings\Kevin\My Documents\My Pictures\MySTyle\ComboFix2.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\system\

.
((((((((((((((((((((((((( Files Created from 2009-03-05 to 2009-04-05 )))))))))))))))))))))))))))))))
.

2009-04-04 22:40 . 2009-04-04 22:40 <DIR> d-------- c:\program files\ERUNT
2009-03-26 17:20 . 2009-03-26 17:20 20 --a------ c:\windows\system32\SYSTEM
2009-03-26 17:17 . 2009-03-26 17:17 <DIR> d--hs---- C:\found.000
2009-03-23 21:02 . 2009-03-23 21:02 <DIR> d-------- c:\program files\Ask.com
2009-03-23 21:01 . 2009-03-23 21:01 <DIR> d-------- c:\program files\MSSOAP
2009-03-23 21:00 . 2009-03-23 21:00 164 --a------ c:\windows\install.dat
2009-03-16 16:46 . 2009-04-02 22:40 <DIR> d-------- c:\documents and settings\Kevin\Tracing
2009-03-16 16:44 . 2009-03-16 16:44 <DIR> d-------- c:\program files\Windows Live SkyDrive
2009-03-16 16:44 . 2009-03-16 16:44 <DIR> d-------- c:\program files\Microsoft
2009-03-16 16:41 . 2009-03-16 16:41 <DIR> d-------- c:\program files\Common Files\Windows Live
2009-03-13 17:18 . 2009-03-13 17:18 <DIR> d-------- c:\program files\Lame for Audacity
2009-03-12 16:00 . 2009-03-12 16:00 <DIR> d-------- c:\program files\Outsim
2009-03-12 15:49 . 2008-11-02 02:26 <DIR> d-------- c:\program files\fruity loops studio 8.0.2 xxl producer edition with fix
2009-03-11 03:02 . 2009-03-11 03:02 <DIR> d-------- c:\program files\MSXML 6.0
2009-03-10 13:03 . 2009-03-10 13:29 <DIR> d-------- c:\windows\system32\NtmsData
2009-03-06 15:39 . 2009-03-06 15:39 <DIR> d-------- c:\program files\MSBuild
2009-03-06 15:38 . 2009-03-06 15:38 <DIR> d-------- c:\windows\system32\XPSViewer
2009-03-06 15:37 . 2009-03-06 15:37 <DIR> d-------- c:\program files\Reference Assemblies
2009-03-06 15:37 . 2006-06-29 14:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-03-06 15:32 . 2008-05-30 15:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll
2009-03-06 15:32 . 2008-05-30 15:11 1,491,992 --a------ c:\windows\system32\D3DCompiler_38.dll
2009-03-06 15:32 . 2008-05-30 15:19 507,400 --a------ c:\windows\system32\XAudio2_1.dll
2009-03-06 15:32 . 2008-03-05 17:03 479,752 --a------ c:\windows\system32\XAudio2_0.dll
2009-03-06 15:32 . 2008-05-30 15:11 467,984 --a------ c:\windows\system32\d3dx10_38.dll
2009-03-06 15:32 . 2008-05-30 15:18 238,088 --a------ c:\windows\system32\xactengine3_1.dll
2009-03-06 15:32 . 2008-03-05 17:03 238,088 --a------ c:\windows\system32\xactengine3_0.dll
2009-03-06 15:32 . 2008-05-30 15:17 65,032 --a------ c:\windows\system32\XAPOFX1_0.dll
2009-03-06 15:32 . 2008-05-30 15:17 25,608 --a------ c:\windows\system32\X3DAudio1_4.dll
2009-03-06 15:32 . 2008-03-05 17:00 25,608 --a------ c:\windows\system32\X3DAudio1_3.dll
2009-03-06 15:31 . 2009-03-06 15:31 <DIR> d-------- c:\windows\Logs
2009-03-06 00:08 . 2009-03-06 00:08 <DIR> d-------- c:\program files\iTunes
2009-03-06 00:08 . 2009-03-06 00:08 <DIR> d-------- c:\program files\iPod
2009-03-06 00:08 . 2009-03-06 00:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-03-06 00:07 . 2009-03-06 00:07 <DIR> d-------- c:\program files\Bonjour
2009-03-06 00:06 . 2009-03-06 00:06 <DIR> d-------- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-05 04:37 189,072 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-05 03:19 138,920 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-04-05 03:18 --------- d-----w c:\program files\Steam
2009-04-05 03:16 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-05 03:15 --------- d-----w c:\program files\dl_cats
2009-04-05 02:44 8,060,448 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-05 02:44 64,052 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-05 02:44 4,636 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-05 02:44 1,040,416 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-04 23:56 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-04 05:28 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-28 17:01 --------- d-----w c:\program files\Warcraft III
2009-03-24 01:15 --------- d-----w c:\documents and settings\Kevin\Application Data\Audacity
2009-03-16 20:43 --------- d-----w c:\program files\Windows Live
2009-03-12 20:01 --------- d-----w c:\program files\Vstplugins
2009-03-12 20:01 --------- d-----w c:\program files\Image-Line
2009-03-11 07:10 --------- d-----w c:\program files\Microsoft Silverlight
2009-03-06 04:09 --------- d-----w c:\program files\Apple Software Update
2009-03-06 04:08 --------- d-----w c:\program files\Common Files\Apple
2009-02-27 22:33 75,064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-02-19 03:36 --------- d-----w c:\program files\Google
2009-02-19 02:06 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-02-19 02:05 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-19 02:01 --------- d-----w c:\documents and settings\All Users\Application Data\NortonInstaller
2009-02-16 23:07 --------- d-----w c:\program files\Audacity 1.3 Beta (Unicode)
2009-02-15 20:33 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-15 20:33 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-15 20:33 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-02-15 20:31 --------- d-----w c:\program files\HTTP-Tunnel
2009-02-15 18:53 --------- d-----w c:\program files\Kaspersky Lab
2009-02-15 18:36 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-02-10 22:01 --------- d-----w c:\documents and settings\Kevin\Application Data\Malwarebytes
2009-02-10 22:01 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-09 10:19 1,846,272 ----a-w c:\windows\system32\win32k.sys
2009-02-09 10:19 1,846,272 ------w c:\windows\system32\dllcache\win32k.sys
2009-02-07 22:07 --------- d-----w c:\program files\AML Products
2009-02-06 22:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-01-31 19:31 413,696 ----a-w c:\windows\system32\wrap_oal.dll
2009-01-31 19:31 110,592 ----a-w c:\windows\system32\OpenAL32.dll
2009-01-17 01:35 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll
2007-12-26 20:05 22,328 ----a-w c:\documents and settings\Kevin\Application Data\PnkBstrK.sys
2004-07-22 15:51 3,432,656 ----a-w c:\program files\ManagedDX.CAB
2004-07-20 03:58 1,156,363 ----a-w c:\program files\BDANT.cab
2004-07-20 03:53 976,020 ----a-w c:\program files\BDAXP.cab
2004-07-09 19:17 13,265,040 ----a-w c:\program files\dxnt.cab
2004-07-09 14:13 703,080 ----a-w c:\program files\BDA.cab
2004-07-09 14:13 15,493,481 ----a-w c:\program files\DirectX.cab
2004-07-09 09:08 472,576 ----a-w c:\program files\dxsetup.exe
2004-07-09 09:08 2,242,560 ----a-w c:\program files\dsetup32.dll
2004-07-09 08:03 62,976 ----a-w c:\program files\DSETUP.dll
2003-04-09 18:48 3,759,264 ----a-w c:\documents and settings\Kevin\setup.exe
2007-07-11 16:52 104 --sh--r c:\windows\system32\77DC10F2E5.sys
2007-07-18 02:03 88 --sh--r c:\windows\system32\E9269B9401.sys
2007-07-18 02:03 10,954 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-03-24_17.34.37.81 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 16:02:28 163,328 ----a-w c:\windows\ERDNT\4-4-2009\ERDNT.EXE
+ 2009-04-05 02:41:22 233,472 ----a-w c:\windows\ERDNT\4-4-2009\Users\00000001\NTUSER.DAT
+ 2009-04-05 02:41:22 8,192 ----a-w c:\windows\ERDNT\4-4-2009\Users\00000002\UsrClass.dat
+ 2009-04-05 02:41:22 233,472 ----a-w c:\windows\ERDNT\4-4-2009\Users\00000003\NTUSER.DAT
+ 2009-04-05 02:41:22 8,192 ----a-w c:\windows\ERDNT\4-4-2009\Users\00000004\UsrClass.dat
+ 2009-04-05 02:41:26 9,138,176 ----a-w c:\windows\ERDNT\4-4-2009\Users\00000005\NTUSER.DAT
+ 2009-04-05 02:41:26 229,376 ----a-w c:\windows\ERDNT\4-4-2009\Users\00000006\UsrClass.dat
- 2009-03-24 01:21:54 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-04-05 03:15:40 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-03-24 01:21:54 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-04-05 03:15:40 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-03-24 01:21:54 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-05 03:15:40 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-03-11 14:33:51 80,508 ----a-w c:\windows\system32\perfc009.dat
+ 2009-04-04 23:24:45 80,508 ----a-w c:\windows\system32\perfc009.dat
- 2009-03-11 14:33:51 463,700 ----a-w c:\windows\system32\perfh009.dat
+ 2009-04-04 23:24:45 463,700 ----a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-02-09 15:06 764296 --a------ c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-04 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2006-08-03 137216]
"CTDVDDET"="c:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 122880]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"SanaSafeConnect"="c:\program files\Sana Security\Primary Response SafeConnect\agent\bin\SanaSafeConnect.exe" [2008-03-21 1378840]
"FaxCenterServer"="c:\program files\Dell PC Fax\fm3032.exe" [2006-06-15 307200]
"dlcxmon.exe"="c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe" [2006-06-14 286720]
"EnGraph QuickTimeKiller"="c:\program files\EnGraph\QuickTimeKiller\QuickTimeKiller.exe" [2005-03-20 45056]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-15 206088]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"DLCXCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-06-07 106496]
"CTXFIHLP"="CTXFIHLP.EXE" [2006-03-02 c:\windows\system32\CTXFIHLP.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe" [2008-10-09 136768]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
CO2 Saver.lnk - c:\program files\CO2 Saver\CO2Saver.exe [2007-06-22 229448]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BITTORRENT]
--a------ 2008-03-24 19:25 587568 c:\program files\BitTorrent\bittorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 07:00 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a------ 2005-10-05 05:12 94208 c:\program files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2005-06-10 10:44 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2005-06-10 10:44 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2009-01-06 14:06 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MemoryCardManager]
--a------ 2006-06-27 07:34 299008 c:\program files\Dell Photo AIO Printer 926\memcard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-05 17:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 04:00 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-04-04 05:47 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 03:00 90112 c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2005-11-08 14:30 16384 c:\windows\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-10-04 18:14 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RetroWDSvc"=2 (0x2)
"RetroLauncher"=2 (0x2)
"Retrospect Helper"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\dlcxcoms.exe"=
"c:\\PROGRAM FILES\\BITTORRENT\\BITTORRENT.EXE"= c:\\Program Files\\BitTorrent\\bittorrent.exe
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\LimePower\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Flagship Studios\\Hellgate London Demo\\Launcher.exe"=
"c:\\Program Files\\Unreal Tournament 3 Demo\\Binaries\\UT3Demo.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3sp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv\\Civilization4.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\fallout 3\\FalloutLauncher.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-02-15 33808]
R2 SanaSafeConnectAgent;SanaSafeConnectAgent;c:\program files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaAgent.exe [2008-03-21 4937240]
R2 SanaSafeConnectWatcher;SanaSafeConnectWatcher;c:\program files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaSafeConnectWatcher.exe [2008-03-21 539160]
R3 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
R3 SanaSafeConnectDriver;SanaSafeConnectDriver;c:\program files\Sana Security\Primary Response SafeConnect\agent\driver\platform_XP\SafeConnectDriver.sys [2008-03-21 161304]
S3 SanaSafeConnectFilter;SanaSafeConnectFilter;c:\program files\Sana Security\Primary Response SafeConnect\agent\driver\platform_XP\SafeConnectFilter.sys [2008-03-21 29720]
S3 SanaSafeConnectShim;SanaSafeConnectShim;c:\program files\Sana Security\Primary Response SafeConnect\agent\driver\platform_XP\SafeConnectShim.sys [2008-03-21 27376]
S3 XDva121;XDva121; [x]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - PNKBSTRB
*NewlyCreated* - PNKBSTRK
.
Contents of the 'Scheduled Tasks' folder

2009-04-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]

2009-04-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-23 23:59]

2009-04-05 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-02-09 15:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\3d24uqo7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=WBR&o=13993&locale=en_US&q=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-05 00:59:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCXCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3079613058-3876417152-2091376438-1007\Software\Cryptic\KRCOH]
@Denied: (Read) (Administrators)
"Locale"=dword:00000000
"accountName"=""
"gamma"="1.000000"
"fxSoundVolume"="1.000000"
"musicSoundVolume"="0.600000"
"dontSaveName"="0"
"reverseMouseButtons"="0"
"screenX"="1024"
"screenY"="768"
"refreshRate"="60"
"screenX_pos"="0"
"screenY_pos"="0"
"maximized"="0"
"fullScreen"="1"
"mipLevel"="-1"
"characterMipLevel"="0"
"texLodBias"="2"
"texAniso"="4"
"worldDetailLevel"="1.000000"
"entityDetailLevel"="1.000000"
"shadowsOn"="1"
"physicsOn"="1"
"maxParticles"="50000"
"maxParticleFill"="10.000000"
"suppressFx"="0"
"forceSoftwareAudio"="0"
"enableVBOs"="1"
"enableJoystick"="1"
"enable3DSound"="0"
"renderScaleX"="1.000000"
"renderScaleY"="1.000000"
"useRenderScale"="0"
"shaderDetail"="3"
"useWater"="2"
"useBloom"="1"
"bloomMagnitude"="1.000000"
"useDOF"="1"
"dofMagnitude"="1.000000"
"antiAliasing"="1"
"useLightmaps"="0"
"useVSync"="1"
.
Completion time: 2009-04-05 1:03:36
ComboFix-quarantined-files.txt 2009-04-05 05:03:21
ComboFix2.txt 2009-03-24 21:36:29

Pre-Run: 15,361,957,888 bytes free
Post-Run: 15,356,796,928 bytes free

371 --- E O F --- 2009-03-16 02:49:28

#10 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:03 PM

Posted 05 April 2009 - 08:40 AM

Hello.

Let's do some updating.

Update Java to Version 6 Update 13
Your current version of Java is outdated. Malware creators can exploit the lesser security of older versions. Please uninstall your current version through Add/Remove Programs. Remove all instances of Java, J2SE Runtime, Java Runtime, and Java Runtime Environment. Restart your computer after uninstalling.

Please download the installer here. Choose "Windows".

Delete the installer after use.

Install From Windows Updates
Whenever a security problem in its software is found, Microsoft will create a patch for it. After the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malware being installed on your computer.

Visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please reboot and repeat this process until there are no more updates to install.

Take a new DDS.txt log after please.

With Regards,
The Panda

Edited by PropagandaPanda, 05 April 2009 - 08:41 AM.


#11 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:03 PM

Posted 17 April 2009 - 04:26 PM

Hello.

There had been no reply from the topic starter in 5 days. Due to inactivity, this topic is now closed.
If you are the topic starter and need this topic reopened, send me a message.

Everyone else, please begin a new topic.

With Regards,
The Panda




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users