Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected- trojan horse generic20.clel


  • This topic is locked This topic is locked
14 replies to this topic

#1 turketron

turketron

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 07 February 2011 - 09:34 PM

Beginning yesterday afternoon AVG has been popping up a message every 10 minutes or so showing the following infections:

c:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\QADBL0YE\cbta[1].exe
c:\Documents and Settings\Owner\Application Data\AbOfAjooHe.exe

The name of the .exe's are a different random combo of letters every time it pops up. It lists both as "Trojan Horse Generic2.CLEL".
When I go to remove the infections the 2nd of the two is always quarantined successfully, but the result for the 1st is always listed as "Object is inaccessible."


It seems to be blocking any web browser access as well- Firefox won't even open, and any website I try to access in Chrome either times out or I get the "aw, snap!" crash page. I've ran Malwarebytes and it removes everything it detects, but every time I run it they pop back up.


I ran DDS, the log is below. I downloaded GMER but when I unzipped it AVG popped up warning that it was a "Trojan Horse Generic21.OB". When I tried to run the extracted gmer.exe I received an error window saying "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."

Let me know if there's any other info you need. Thanks!




the following is my DDS.txt log:


DDS (Ver_10-12-12.02) - NTFSx86
Run by Owner at 18:00:10.46 on Mon 02/07/2011
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.860 [GMT -6:00]

AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MiserWare\Granola\granola.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Pidgin\pidgin.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\System32\WScript.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\MiserWare\Granola\GranolaManager.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\WScript.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Granola] "c:\program files\miserware\granola\granola.exe"
uRun: [Startup] c:\documents and settings\owner\application data\Startup.js
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [TrojanScanner] c:\program files\trojan remover\Trjscan.exe /boot
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
uExplorerRun: [Startup] c:\documents and settings\owner\application data\temp.js
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\pidgin.lnk - c:\program files\pidgin\pidgin.exe
StartupFolder: c:\documents and settings\owner\start menu\programs\startup\PowerReg Scheduler V3.exe
StartupFolder: c:\documents and settings\owner\start menu\programs\startup\Startup.js
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240380938515
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} - hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli c:\windows\system32\mepolove.dll c:\windows\system32\vomusuna.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\2pixzovl.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\documents and settings\owner\application data\move networks\plugins\npqmp071705000014.dll
FF - plugin: c:\documents and settings\owner\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1601.7122\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Auto Shutdown: amin.eft_Shutdown@gmail.com - %profile%\extensions\amin.eft_Shutdown@gmail.com
FF - Ext: Forecastfox: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} - %profile%\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Wikipedia Lookup Add-on: {246B0AC1-31AB-4786-A4CC-A6AF89647D7F} - %profile%\extensions\{246B0AC1-31AB-4786-A4CC-A6AF89647D7F}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: All-in-One Gestures: {8b86149f-01fb-4842-9dd8-4d7eb02fd055} - %profile%\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg9\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-7-30 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-24 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-24 29584]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-24 243024]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-7-17 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-17 308136]
R2 Granola PM Manager;Granola PM Manager;c:\program files\miserware\granola\GranolaManager.exe [2010-12-10 423152]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-7-12 1375992]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-4-22 10384]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2010-10-17 124648]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1c9e7f770d67ad4;Google Update Service (gupdate1c9e7f770d67ad4);c:\program files\google\update\GoogleUpdate.exe [2009-6-7 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-4-22 1684736]
S3 ATICDSDr;ATICDSDr;\??\c:\docume~1\owner\locals~1\temp\aticdsdr.sys --> c:\docume~1\owner\locals~1\temp\ATICDSDr.sys [?]
S3 kbeepm;kbeepm;c:\docume~1\owner\locals~1\temp\kbeepm.sys [2003-10-9 15872]
S3 pbfilter;pbfilter;c:\program files\peerblock\pbfilter.sys [2010-7-8 14424]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-10-15 11520]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2011-02-07 23:59:04 227840 ----a-w- c:\docume~1\owner\applic~1\bVWxie.exe
2011-02-07 23:50:11 54016 ----a-w- c:\windows\system32\drivers\oiqycair.sys
2011-02-06 20:27:07 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2011-02-06 20:27:07 75264 ----a-w- c:\windows\system32\unacev2.dll
2011-02-06 20:27:07 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2011-02-06 20:27:07 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2011-02-06 20:27:07 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2011-02-06 20:27:05 -------- d-----w- c:\program files\Trojan Remover
2011-02-06 20:27:05 -------- d-----w- c:\docume~1\owner\applic~1\Simply Super Software
2011-02-06 20:27:05 -------- d-----w- c:\docume~1\alluse~1\applic~1\Simply Super Software
2011-01-29 18:37:27 -------- d-----w- c:\docume~1\alluse~1\applic~1\MiserWare
2011-01-29 18:36:55 4273664 ----a-w- c:\documents and settings\owner\Granola-3.1.3.msi
2011-01-28 23:58:17 101904 ----a-r- c:\windows\system32\drivers\AtiHdmi.sys
2011-01-28 06:12:50 -------- d-----w- c:\program files\ATI Technologies
2011-01-28 06:12:21 -------- d-----w- C:\ATI
2011-01-28 05:48:58 -------- d-----w- c:\program files\Phyxion.net

==================== Find3M ====================

2011-01-05 03:13:02 57344 ----a-w- c:\windows\system32\aticalrt.dll
2011-01-05 03:12:52 53248 ----a-w- c:\windows\system32\aticalcl.dll
2011-01-05 03:11:42 4489216 ----a-w- c:\windows\system32\aticaldd.dll
2011-01-05 03:11:14 17084416 ----a-w- c:\windows\system32\atioglxx.dll
2011-01-05 03:00:30 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-01-05 02:59:24 302080 ----a-w- c:\windows\system32\ati2dvag.dll
2011-01-05 02:53:36 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2011-01-05 02:53:16 4021984 ----a-w- c:\windows\system32\ati3duag.dll
2011-01-05 02:46:12 1112576 ----a-w- c:\windows\system32\ativvamv.dll
2011-01-05 02:39:46 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2011-01-05 02:39:32 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2011-01-05 02:39:22 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2011-01-05 02:39:14 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-01-05 02:39:02 188416 ----a-w- c:\windows\system32\ati2evxx.dll
2011-01-05 02:37:32 638976 ----a-w- c:\windows\system32\ati2evxx.exe
2011-01-05 02:36:54 2670464 ----a-w- c:\windows\system32\ativvaxx.dll
2011-01-05 02:36:00 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2011-01-05 02:35:12 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2011-01-05 02:31:10 651264 ----a-w- c:\windows\system32\atikvmag.dll
2011-01-05 02:29:18 196608 ----a-w- c:\windows\system32\atiadlxx.dll
2011-01-05 02:28:52 17408 ----a-w- c:\windows\system32\atitvo32.dll
2011-01-05 02:28:18 471040 ----a-w- c:\windows\system32\atiok3x2.dll
2011-01-05 02:22:50 851968 ----a-w- c:\windows\system32\ati2cqag.dll
2011-01-05 02:20:56 64512 ----a-w- c:\windows\system32\atimpc32.dll
2011-01-05 02:20:56 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll

=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: Hitachi_HDP725050GLA360 rev.GM4OA5CA -> Harddisk0\DR0 -> \Device\Ide\IdePort2 P2T0L0-7

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A53D5DC]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a5437b8]; MOV EAX, [0x8a543834]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x8A4CAAB8]
3 CLASSPNP[0xBA108FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\00000075[0x8A5899E8]
5 ACPI[0xB9E74620] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x8A59B940]
\Driver\atapi[0x8A585B10] -> IRP_MJ_CREATE -> 0x8A53D5DC
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP2T0L0-7 -> \??\IDE#DiskHitachi_HDP725050GLA360_________________GM4OA5CA#5&2ea7e938&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A53D422
IoDeviceObjectType -> ParseProcedure -> 0xacea0160
\Device\Harddisk0\DR0 -> ParseProcedure -> 0xacea0160
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !

============= FINISH: 18:01:31.01 ===============

Attached Files


Edited by turketron, 07 February 2011 - 09:35 PM.


BC AdBot (Login to Remove)

 


#2 Shannon2012

Shannon2012

  • Security Colleague
  • 3,657 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina, USA
  • Local time:06:51 PM

Posted 11 February 2011 - 04:29 PM

Hi,

Welcome to Bleeping Computer.

My name is Shannon and I will be working with you to remove the malware that is on your machine.

I apologize for the delay in replying to your post, but this forum is extremely busy.

Please Track this topic - On the top right on this tread, click on the Option button, and, in the drop-down list, click on 'Track this topic'. Under Subscription Information, click on 'Immediate Email Notification' and then click on the Proceed button at the bottom.

Do Not make any changes on your own to the infected computer.

Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Now, let's look more thoroughly at the infected computer -

We need to see some information about what is happening in your machine. Please perform the following scan:
  • We need to create an OTL Report
  • Please download OTL from here:
  • Main Mirror
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Change the "Extra Registry" option to "Use SafeList"
  • Push the Posted Image button.
  • Two reports will open, copy and paste them into your reply:
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Once you have the above logs, click on the Add Reply button below, copy in the contents of the two OTL logs. Also include any comments that you might have concerning the infection(s) and the infected computer.
Shannon

#3 turketron

turketron
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 11 February 2011 - 08:24 PM

Hi Shannon, thanks for the reply!

I said in my initial post that it is blocking any web browser access; I found that I can use Firefox just fine in safe mode however. I tried running GMER in safe mode, and while it does allow me to access the program it closes once I try to start a scan. Dunno if this helps at all. Let me know if there's any other info that you need.



Here is OTL.txt:


OTL logfile created on: 2/11/2011 18:53:02 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 16.82 Gb Free Space | 3.61% Space Free | Partition Type: NTFS
Drive D: | 493.80 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: NICK | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/02/11 18:34:43 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2010/12/10 14:03:14 | 000,745,192 | ---- | M] () -- C:\Program Files\MiserWare\Granola\granola.exe
PRC - [2010/12/10 12:58:40 | 000,423,152 | ---- | M] () -- C:\Program Files\MiserWare\Granola\GranolaManager.exe
PRC - [2010/11/24 17:43:54 | 002,069,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/11/24 17:43:51 | 000,725,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/10/17 16:42:38 | 000,075,496 | ---- | M] (SANDBOXIE L.T.D) -- C:\Program Files\Sandboxie\SbieSvc.exe
PRC - [2010/10/16 17:52:23 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
PRC - [2010/09/23 16:08:15 | 000,621,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/07/21 16:49:17 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010/07/17 12:11:45 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/07/17 12:11:43 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/07/17 12:11:39 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2009/03/02 08:23:10 | 000,045,603 | ---- | M] (The Pidgin developer community) -- C:\Program Files\Pidgin\pidgin.exe
PRC - [2009/02/18 23:33:08 | 000,809,488 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/02/18 23:28:52 | 000,076,304 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2008/04/14 04:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/02/11 18:34:43 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
MOD - [2010/08/23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2009/07/12 01:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
MOD - [2009/02/18 23:31:16 | 000,045,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\lgscroll.dll
MOD - [2009/02/18 23:26:28 | 000,064,016 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\GameHook.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (userinit)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Auto | Stopped] -- -- (ATI Smart)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2010/12/10 12:58:40 | 000,423,152 | ---- | M] () [Auto | Running] -- C:\Program Files\MiserWare\Granola\GranolaManager.exe -- (Granola PM Manager)
SRV - [2010/11/25 22:55:17 | 001,375,992 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2010/10/17 16:42:38 | 000,075,496 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV - [2010/07/21 16:49:17 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/17 12:11:43 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/03/18 16:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 13:16:28 | 000,124,240 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2009/02/18 23:30:20 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)


========== Driver Services (SafeList) ==========

DRV - [2011/01/04 21:34:28 | 005,656,576 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2010/11/05 22:06:54 | 000,015,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)
DRV - [2010/10/17 16:42:34 | 000,124,648 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV - [2010/07/17 12:11:47 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/07/17 12:11:40 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/07/12 02:55:39 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2010/06/02 16:47:16 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010/05/10 12:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/04/08 02:11:36 | 000,101,904 | R--- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2010/02/17 12:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/11/05 17:41:12 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009/09/28 01:02:44 | 000,014,424 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\PeerBlock\pbfilter.sys -- (pbfilter)
DRV - [2009/04/22 00:42:59 | 005,030,912 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/04/22 00:42:56 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2009/04/22 00:42:55 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2009/02/13 10:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2008/12/18 22:44:00 | 000,028,816 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2008/12/18 22:43:48 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008/12/18 22:43:40 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008/12/18 22:43:18 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2008/12/18 22:43:06 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2008/09/25 07:51:42 | 000,115,328 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/04/13 21:06:06 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/12/17 03:14:06 | 000,012,400 | R--- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO)
DRV - [2004/08/13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2003/10/09 16:04:44 | 000,015,872 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\Owner\Local Settings\Temp\kbeepm.sys -- (kbeepm)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1993962763-1580818891-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1993962763-1580818891-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.21.1
FF - prefs.js..extensions.enabledItems: amin.eft_Shutdown@gmail.com:3.6.2C
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.7
FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:0.9.10.2
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.50
FF - prefs.js..extensions.enabledItems: {246B0AC1-31AB-4786-A4CC-A6AF89647D7F}:0.3.8
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..keyword.URL: "http://www.google.com/search?q="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/11/24 17:44:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/09 19:25:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/02 17:19:38 | 000,000,000 | ---D | M]

[2009/04/22 00:23:10 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/12/19 04:33:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions
[2010/02/28 14:24:46 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2009/07/03 14:22:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/09/02 17:20:43 | 000,000,000 | ---D | M] (Wikipedia Lookup Add-on) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{246B0AC1-31AB-4786-A4CC-A6AF89647D7F}
[2010/02/28 14:24:29 | 000,000,000 | ---D | M] (NoScript) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/09/02 17:20:43 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2010/02/28 14:24:30 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/02/28 14:24:42 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/02/28 14:24:28 | 000,000,000 | ---D | M] (Auto Shutdown) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\amin.eft_Shutdown@gmail.com
[2010/12/19 01:24:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/01/15 12:58:13 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/11/24 17:44:03 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
[2009/06/06 16:56:18 | 000,151,552 | ---- | M] (PopCap Games) -- C:\Program Files\Mozilla Firefox\plugins\nppopcaploader.dll

O1 HOSTS File: ([2010/08/24 18:10:08 | 000,000,355 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKU\S-1-5-19..\Run: [siniveloha] File not found
O4 - HKU\S-1-5-20..\Run: [siniveloha] File not found
O4 - HKU\S-1-5-21-1993962763-1580818891-839522115-1003..\Run: [Granola] C:\Program Files\MiserWare\Granola\granola.exe ()
O4 - HKU\S-1-5-21-1993962763-1580818891-839522115-1003..\Run: [Startup] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoi

Attached Files


Edited by turketron, 11 February 2011 - 08:27 PM.


#4 Shannon2012

Shannon2012

  • Security Colleague
  • 3,657 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina, USA
  • Local time:06:51 PM

Posted 12 February 2011 - 05:50 PM

Hi-

Thank you for the logs. You do have several infections which need to be cleaned off. We will start with ComboFix. You can download it in safe mode but try to run it in normal mode. If it won't run in normal mode, then run it in safe mode.

Please, download Combofix from either of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: how-to-use-combofix

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

How to Temporarily Disable your Anti-virusl


Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please copy the "C:\ComboFix.txt" into your reply.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall


In your reply, please copy in the ComboFix log.
Shannon

#5 turketron

turketron
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 12 February 2011 - 09:03 PM

After some difficulties uninstalling AVG, I was able to get combofix running in regular windows. While it was running it detected rootkit activity and needed to restart, and that I should write down the following info:

service: sptd
file: C:\WINDOWS\system 32\drivers\sptd.sys


Below is the contents of combofix.txt:

ComboFix 11-02-12.01 - Owner 02/12/2011 19:38:23.1.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1691 [GMT -6:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\.wtav
C:\Install.exe
c:\windows\assembly\GAC\__AssemblyInfo__.ini
c:\windows\run.log
c:\windows\system32\drivers\vbma7f61.sys
c:\windows\system32\exefile.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
c:\windows\WinSxS\x86_Microsoft.Windows.Shell.HWEventDetector_6595b64144ccf1df_5.2.2.3_x-ww_5390e909\shsvcs.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_USERINIT
-------\Service_userinit
-------\Service_vbma7f61


((((((((((((((((((((((((( Files Created from 2011-01-13 to 2011-02-13 )))))))))))))))))))))))))))))))
.

2011-02-13 01:24 . 2011-02-13 01:24 -------- d-----w- C:\32788R22FWJFW
2011-02-09 23:16 . 2011-02-09 23:16 -------- d-----w- c:\documents and settings\Administrator
2011-02-09 01:24 . 2011-02-09 01:24 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-02-08 00:27 . 2011-02-08 00:27 -------- d-s---w- c:\documents and settings\NetworkService\UserData
2011-02-06 20:28 . 2011-02-10 01:12 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-02-06 20:27 . 2006-06-19 18:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2011-02-06 20:27 . 2006-05-25 20:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2011-02-06 20:27 . 2005-08-26 06:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2011-02-06 20:27 . 2003-02-03 01:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2011-02-06 20:27 . 2002-03-06 06:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2011-02-06 20:27 . 2011-02-06 20:27 -------- d-----w- c:\program files\Trojan Remover
2011-02-06 20:27 . 2011-02-06 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2011-02-06 06:39 . 2011-02-06 06:39 -------- d-s---w- c:\documents and settings\LocalService\UserData
2011-02-06 05:53 . 2011-02-06 05:53 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-02-06 05:53 . 2011-02-06 05:53 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer
2011-01-29 18:37 . 2011-01-29 18:37 -------- d-----w- c:\documents and settings\All Users\Application Data\MiserWare
2011-01-29 18:36 . 2011-01-29 18:36 4273664 ----a-w- c:\documents and settings\Owner\Granola-3.1.3.msi
2011-01-28 23:58 . 2010-04-08 08:11 101904 ----a-r- c:\windows\system32\drivers\AtiHdmi.sys
2011-01-28 06:12 . 2011-01-28 06:19 -------- d-----w- c:\program files\ATI Technologies
2011-01-28 06:12 . 2011-01-28 06:12 -------- d-----w- C:\ATI
2011-01-28 05:58 . 2011-01-28 05:58 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2011-01-28 05:48 . 2011-01-28 05:48 -------- d-----w- c:\program files\Phyxion.net
2011-01-28 02:07 . 2011-01-28 02:07 -------- d-----w- c:\program files\Microsoft.NET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-05 03:34 . 2008-12-01 22:13 5656576 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2011-01-05 03:13 . 2010-07-21 22:52 57344 ----a-w- c:\windows\system32\aticalrt.dll
2011-01-05 03:12 . 2010-07-21 22:52 53248 ----a-w- c:\windows\system32\aticalcl.dll
2011-01-05 03:11 . 2010-07-21 22:52 4489216 ----a-w- c:\windows\system32\aticaldd.dll
2011-01-05 02:59 . 2010-07-21 22:52 302080 ----a-w- c:\windows\system32\ati2dvag.dll
2011-01-05 02:53 . 2010-07-21 22:52 4021984 ----a-w- c:\windows\system32\ati3duag.dll
2011-01-05 02:39 . 2008-12-01 20:40 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2011-01-05 02:39 . 2008-12-01 20:40 188416 ----a-w- c:\windows\system32\ati2evxx.dll
2011-01-05 02:36 . 2010-07-21 22:52 2670464 ----a-w- c:\windows\system32\ativvaxx.dll
2011-01-05 02:35 . 2010-07-21 22:52 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2011-01-05 02:31 . 2010-07-21 22:52 651264 ----a-w- c:\windows\system32\atikvmag.dll
2011-01-05 02:29 . 2008-12-01 19:52 196608 ----a-w- c:\windows\system32\atiadlxx.dll
2011-01-05 02:28 . 2010-07-21 22:52 471040 ----a-w- c:\windows\system32\atiok3x2.dll
2011-01-05 02:22 . 2010-07-21 22:52 851968 ----a-w- c:\windows\system32\ati2cqag.dll
2011-01-05 02:20 . 2010-07-21 22:52 64512 ----a-w- c:\windows\system32\atimpc32.dll
2011-01-05 02:20 . 2008-12-01 19:57 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2010-12-21 00:09 . 2010-07-31 11:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 00:08 . 2010-07-31 11:32 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-18 18:12 . 2009-04-21 22:59 81920 ----a-w- c:\windows\system32\isign32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-07-01 133104]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-03 15028104]
"Granola"="c:\program files\MiserWare\Granola\granola.exe" [2010-12-10 745192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-12-19 76304]
"RTHDCPL"="RTHDCPL.EXE" [2009-04-22 18085888]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-22 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-05 98304]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2010-11-24 1233856]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-4-22 809488]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-19 05:30 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprecovr \systemroot\sprecovr.txt\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-06-15 21:33 141624 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 10:42 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 02:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-06-08 05:09 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Spooler"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"AntiSpywareOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.9.9551-to-3.1.0.9767-enUS-downloader.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\RTHDCPL.EXE"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\mass effect\\Binaries\\MassEffect.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\torchlight\\Torchlight.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\swkotor\\swkotor.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\amd driver updater, xp, 32 bit\\Setup.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\dark forces\\DosBox\\dosbox.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\jedi knight mysteries of the sith\\JKM.EXE"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\star wars jedi knight\\JK.EXE"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\jedi outcast\\GameData\\jk2sp.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\jedi outcast\\GameData\\jk2mp.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\jedi academy\\GameData\\jasp.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\jedi academy\\GameData\\jamp.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Apps\\2.0\\MTZ7X9H8.67A\\CZEEW7LC.JNN\\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\\CurseClient.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\mass effect 2\\Binaries\\MassEffect2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\mass effect 2\\MassEffect2Launcher.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\mass effect 2\\docs\\EA Help\\Electronic_Arts_Technical_Support.htm"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\turketron\\counter-strike source\\hl2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9e7f770d67ad4;Google Update Service (gupdate1c9e7f770d67ad4);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-08 133104]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-11-26 1375992]
R3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-04-22 1684736]
R3 ATICDSDr;ATICDSDr;c:\docume~1\Owner\LOCALS~1\Temp\ATICDSDr.sys [x]
R3 kbeepm;kbeepm;c:\docume~1\Owner\LOCALS~1\Temp\kbeepm.sys [x]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [2010-11-06 15264]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2009-09-28 14424]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-07-12 64288]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-06 691696]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 Granola PM Manager;Granola PM Manager;c:\program files\MiserWare\Granola\GranolaManager.exe [2010-12-10 423152]
S2 LBeepKE;LBeepKE;c:\windows\system32\Drivers\LBeepKE.sys [2008-12-19 10384]

.
Contents of the 'Scheduled Tasks' folder

2011-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 04:55]

2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-08 05:10]

2011-02-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-08 05:10]

2011-02-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1580818891-839522115-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-29 03:44]

2011-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1580818891-839522115-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-29 03:44]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Auto Shutdown: amin.eft_Shutdown@gmail.com - %profile%\extensions\amin.eft_Shutdown@gmail.com
FF - Ext: Forecastfox: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} - %profile%\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Wikipedia Lookup Add-on: {246B0AC1-31AB-4786-A4CC-A6AF89647D7F} - %profile%\extensions\{246B0AC1-31AB-4786-A4CC-A6AF89647D7F}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: All-in-One Gestures: {8b86149f-01fb-4842-9dd8-4d7eb02fd055} - %profile%\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHANS REMOVED - - - -

Notify-avgrsstarter - avgrsstx.dll
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-12 19:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1993962763-1580818891-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:fa,28,6c,95,54,f1,c9,1e,dd,ed,15,dc,b1,6b,18,d8,64,26,8f,ce,95,97,b6,
ab,59,7b,58,68,62,41,85,0a,aa,b1,2f,5e,a6,92,44,1a,7b,6a,d1,50,d0,2e,2d,a9,\
"??"=hex:ad,64,9c,09,f6,41,1e,7b,f7,7b,f9,8f,09,97,ef,10

[HKEY_USERS\S-1-5-21-1993962763-1580818891-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:36,d7,d8,90,0a,87,48,fc,ef,14,db,f3,62,54,f6,89,e5,31,4d,65,93,
dd,17,cd,97,b0,de,c9,7d,e9,06,a7,69,5e,63,9f,bd,f7,90,a3,b6,ef,87,75,2f,04,\
"rkeysecu"=hex:f9,e6,b6,73,e1,16,ac,3c,c6,e6,f6,69,5b,12,f4,2d

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(756)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(2592)
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Sandboxie\SbieSvc.exe
c:\windows\RTHDCPL.EXE
c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
c:\program files\Pidgin\pidgin.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\System32\WScript.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\iPod\bin\iPodService.exe
c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\Download\{6418F4E0-5B85-480A-90C7-0EEBC2D7AA82}\chrome_updater.exe
c:\documents and settings\Owner\Local Settings\Temp\CR_12.tmp\setup.exe
.
**************************************************************************
.
Completion time: 2011-02-12 19:57:50 - machine was rebooted
ComboFix-quarantined-files.txt 2011-02-13 01:57

Pre-Run: 18,859,954,176 bytes free
Post-Run: 21,906,964,480 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - EB518E1D682389387AE1D72970605D93

Attached Files



#6 Shannon2012

Shannon2012

  • Security Colleague
  • 3,657 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina, USA
  • Local time:06:51 PM

Posted 13 February 2011 - 01:15 PM

Hi-

Need to check some files for infections.

First, before we start, please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows


Please click this link-->Jotti
When the Jotti page has finished loading, click Jotti's Browse button and navigate to the following files in turn and click the Submit file button within Jotti.

c:\documents and settings\Owner\Local Settings\Temp\ATICDSDr.sys
c:\documents and settings\Owner\Local Settings\Temp\kbeepm.sys
C:\Documents and Settings\Owner\Application Data\VN1d9Tscj.js
C:\Documents and Settings\Owner\Application Data\OcaK1yN8.js


If Jotti reports that the file has been scanned before and gives you those results, click on the Scan Again button.
To scan the next file, click on the Next File button.
Please post back the results of the scan in your next post.
If Jotti is busy, try the same at Virustotal

In your reply please let me know how the Jotti checks went. You can copy in the link to each report.
Shannon

#7 turketron

turketron
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 13 February 2011 - 01:34 PM

I can now access the internet via Firefox when booting up windows normally, instead of just in safe mode.

The first two files (ATICDSDr.sys and kbeepm.sys) are not listed in the c:\documents and settings\Owner\Local Settings\Temp folder.
as for the other two:




Filename: VN1d9Tscj.js
Status:
Scan finished. 4 out of 19 scanners reported malware.
Scan taken on: Sun 13 Feb 2011 19:28:27 (CET) Permalink
http://virusscan.jotti.org/en/scanresult/185c42aab51aff6627e66fc2dc6c49b7a7db318b/554d4b7c14a8f8d95c57ae44d9ea7c6ab322e3f6



Filename: OcaK1yN8.js
Status:
Scan finished. 4 out of 19 scanners reported malware.
Scan taken on: Sun 13 Feb 2011 19:29:23 (CET)

http://virusscan.jotti.org/en/scanresult/e8ebdd65ecc59164e0e8afbd3678b4e493135f94/d4b4241c9e324959b2b45cc3940e9ef0848123e4

Edited by turketron, 13 February 2011 - 01:56 PM.


#8 Shannon2012

Shannon2012

  • Security Colleague
  • 3,657 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina, USA
  • Local time:06:51 PM

Posted 13 February 2011 - 04:39 PM

Hi-

Thank you for the Jotti info. Need to do some clean up.

  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
:OTL
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKU\S-1-5-19..\Run: [siniveloha] File not found
O4 - HKU\S-1-5-20..\Run: [siniveloha]  File not found
O4 - HKU\S-1-5-21-1993962763-1580818891-839522115-1003..\Run: [Startup]  File not found
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Startup.js ()
O7 - HKU\S-1-5-21-1993962763-1580818891-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Startup = C:\Documents and Settings\Owner\Application Data\temp.js[2011/02/11 18:40:22 | 000,227,840 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\xhFZ1V.exe
[2011/02/11 18:40:14 | 000,010,473 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\ttWxdcLV08.js
[2011/02/11 18:40:05 | 000,053,888 | ---- | M] () -- C:\WINDOWS\System32\drivers\vbma7f61.sys
[2003/03/31 06:00:00 | 000,735,664 | ---- | C] () -- C:\WINDOWS\System32\msvkgpfa.dll
[2011/02/11 18:01:54 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\DFlj20Bk.js
[2011/02/09 19:56:19 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\cuuEn7.js
[2011/02/09 17:15:18 | 000,010,475 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Vkq4U0.js
[2011/02/08 22:06:52 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\bymjMzpR.js
[2011/02/08 21:42:52 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\ieC9pu.js
[2011/02/08 21:10:52 | 000,010,475 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\rHaGweEQtn.js
[2011/02/08 20:42:33 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\V0k6rp.js
[2011/02/08 20:37:15 | 000,010,473 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\mudig.js
[2011/02/08 20:31:10 | 000,010,475 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\fJw4EB2.js
[2011/02/08 20:24:47 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\CKyen1l0.js
[2011/02/08 20:15:54 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Ty0PW9.js
[2011/02/08 19:43:29 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\q9MIkrGsT.js
[2011/02/08 19:34:14 | 000,000,732 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\.wtav
[2011/02/08 19:26:03 | 000,010,474 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\wkT88zK9.js
[2011/02/08 18:54:01 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\QXl8rdI.js
[2011/02/08 18:43:54 | 000,010,474 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\RkzlYf5.js
[2011/02/07 22:37:33 | 000,010,475 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\bq2ltI.js
[2011/02/07 22:12:33 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\UWf8pzT.js
[2011/02/07 22:01:32 | 000,010,473 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\DPK008PfY5.js
[2011/02/07 21:41:33 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\aqAkq5lU2.js
[2011/02/07 21:15:32 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\USnG8.js
[2011/02/07 21:01:32 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\stgZr.js
[2011/02/07 20:46:33 | 000,010,475 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\cfKYogKaS.js
[2011/02/07 20:41:43 | 000,010,473 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\FV4bq1Rr.js
[2011/02/07 20:26:08 | 000,010,474 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\VN1d9Tscj.js
[2011/02/07 19:58:02 | 000,010,474 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\zEOWJ.js
[2011/02/07 19:35:56 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\qxn9uZal5.js
[2011/02/07 19:33:51 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\qCN7822.js
[2011/02/07 19:14:54 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Brdgq.js
[2011/02/07 19:05:53 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\ldfGS.js
[2011/02/07 18:52:55 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\If6d8grlJH.js
[2011/02/07 18:30:53 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\PHcnT5HS.js
[2011/02/07 17:58:51 | 000,010,473 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\jAbUi2t5.js
[2011/02/07 17:33:48 | 000,010,475 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\lD9X8n.js
[2011/02/06 22:24:40 | 000,010,475 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\tQ83Qq07.js
[2011/02/06 14:21:28 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\naZtVwJ.js
[2011/02/06 14:20:30 | 000,010,474 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\pz6Rh.js
[2011/02/06 14:18:35 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\R4hShl.js
[2011/02/06 13:58:30 | 000,010,474 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\cETXLgNoj.js
[2011/02/06 13:53:32 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\yZFkBBMSi.js
[2011/02/06 13:47:29 | 000,010,474 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\RgEgVOluq.js
[2011/02/06 13:45:34 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\OcaK1yN8.js
[2011/02/06 13:36:05 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Hh2tOnF.js
[2011/02/06 13:29:30 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\pn9HQVYTG5.js
[2011/02/06 13:24:30 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\uh83nlyy.js
[2011/02/06 13:17:28 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\jGR0fNpus.js
[2011/02/06 13:13:33 | 000,010,474 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\OmtF4Udeq.js
[2011/02/06 13:05:30 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\g6Cc2cs.js
[2011/02/06 13:02:31 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\MWUrYarzI.js
[2011/02/06 13:00:27 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\VGe2ky.js
[2011/02/06 12:50:34 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\JKcSAGWw.js
[2011/02/06 12:44:31 | 000,010,475 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\ZctWb4bQ.js
[2011/02/06 12:36:03 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\HLqxni.js
[2011/02/06 12:32:29 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\m0awmDbnS.js
[2011/02/06 12:26:27 | 000,010,477 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\QUtc3K.js
[2011/02/06 12:14:29 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\UKWGaB.js
[2011/02/06 12:11:31 | 000,010,473 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\NHuBj2XsR.js
[2011/02/06 12:11:27 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\BYAxumulAi.js
[2011/02/06 11:58:29 | 000,010,472 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\gSU671GD.js
[2011/02/06 11:54:27 | 000,010,476 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Ss56znTWGW.js
:commands
[emptytemp]
[resethosts]
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click Posted Image.
  • A report will open. Copy and Paste that report in your next reply.
  • If you have to reboot, once back up, open the C:\_OTL\MovedFiles folder and copy the newest log into your next reply.
Please run Malwarebytes' Anti-Malware (MBAM)
  • Click on the Update tab and click the Check for Updates button.
  • When the update is finished, click on the Scanner tab.
  • Select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy & Paste the entire report in your next reply.

In your reply, please copy in the OTL fix report and the MBAM report. Are you still getting the warning messages on infected files?
Shannon

#9 turketron

turketron
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 13 February 2011 - 07:31 PM

Ran OTL and MBAM, and after rebooting and letting it sit for about 45 minutes no AVG warnings have popped up yet; before I would've seen it at least once or twice by now.

here is the OTL report:All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck not found.
Registry key HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry value HKEY_USERS\S-1-5-21-1993962763-1580818891-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\Startup not found.
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Startup.js moved successfully.
Registry value HKEY_USERS\S-1-5-21-1993962763-1580818891-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\Startup not found.
File C:\Documents and Settings\Owner\Application Data\temp.js[2011/02/11 18:40:22 | 000,227,840 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\xhFZ1V.exe not found.
C:\Documents and Settings\Owner\Application Data\ttWxdcLV08.js moved successfully.
File C:\WINDOWS\System32\drivers\vbma7f61.sys not found.
C:\WINDOWS\system32\msvkgpfa.dll moved successfully.
C:\Documents and Settings\Owner\Application Data\DFlj20Bk.js moved successfully.
C:\Documents and Settings\Owner\Application Data\cuuEn7.js moved successfully.
C:\Documents and Settings\Owner\Application Data\Vkq4U0.js moved successfully.
C:\Documents and Settings\Owner\Application Data\bymjMzpR.js moved successfully.
C:\Documents and Settings\Owner\Application Data\ieC9pu.js moved successfully.
C:\Documents and Settings\Owner\Application Data\rHaGweEQtn.js moved successfully.
C:\Documents and Settings\Owner\Application Data\V0k6rp.js moved successfully.
C:\Documents and Settings\Owner\Application Data\mudig.js moved successfully.
C:\Documents and Settings\Owner\Application Data\fJw4EB2.js moved successfully.
C:\Documents and Settings\Owner\Application Data\CKyen1l0.js moved successfully.
C:\Documents and Settings\Owner\Application Data\Ty0PW9.js moved successfully.
C:\Documents and Settings\Owner\Application Data\q9MIkrGsT.js moved successfully.
File C:\Documents and Settings\All Users\Application Data\.wtav not found.
C:\Documents and Settings\Owner\Application Data\wkT88zK9.js moved successfully.
C:\Documents and Settings\Owner\Application Data\QXl8rdI.js moved successfully.
C:\Documents and Settings\Owner\Application Data\RkzlYf5.js moved successfully.
C:\Documents and Settings\Owner\Application Data\bq2ltI.js moved successfully.
C:\Documents and Settings\Owner\Application Data\UWf8pzT.js moved successfully.
C:\Documents and Settings\Owner\Application Data\DPK008PfY5.js moved successfully.
C:\Documents and Settings\Owner\Application Data\aqAkq5lU2.js moved successfully.
C:\Documents and Settings\Owner\Application Data\USnG8.js moved successfully.
C:\Documents and Settings\Owner\Application Data\stgZr.js moved successfully.
C:\Documents and Settings\Owner\Application Data\cfKYogKaS.js moved successfully.
C:\Documents and Settings\Owner\Application Data\FV4bq1Rr.js moved successfully.
C:\Documents and Settings\Owner\Application Data\VN1d9Tscj.js moved successfully.
C:\Documents and Settings\Owner\Application Data\zEOWJ.js moved successfully.
C:\Documents and Settings\Owner\Application Data\qxn9uZal5.js moved successfully.
C:\Documents and Settings\Owner\Application Data\qCN7822.js moved successfully.
C:\Documents and Settings\Owner\Application Data\Brdgq.js moved successfully.
C:\Documents and Settings\Owner\Application Data\ldfGS.js moved successfully.
C:\Documents and Settings\Owner\Application Data\If6d8grlJH.js moved successfully.
C:\Documents and Settings\Owner\Application Data\PHcnT5HS.js moved successfully.
C:\Documents and Settings\Owner\Application Data\jAbUi2t5.js moved successfully.
C:\Documents and Settings\Owner\Application Data\lD9X8n.js moved successfully.
C:\Documents and Settings\Owner\Application Data\tQ83Qq07.js moved successfully.
C:\Documents and Settings\Owner\Application Data\naZtVwJ.js moved successfully.
C:\Documents and Settings\Owner\Application Data\pz6Rh.js moved successfully.
C:\Documents and Settings\Owner\Application Data\R4hShl.js moved successfully.
C:\Documents and Settings\Owner\Application Data\cETXLgNoj.js moved successfully.
C:\Documents and Settings\Owner\Application Data\yZFkBBMSi.js moved successfully.
C:\Documents and Settings\Owner\Application Data\RgEgVOluq.js moved successfully.
C:\Documents and Settings\Owner\Application Data\OcaK1yN8.js moved successfully.
C:\Documents and Settings\Owner\Application Data\Hh2tOnF.js moved successfully.
C:\Documents and Settings\Owner\Application Data\pn9HQVYTG5.js moved successfully.
C:\Documents and Settings\Owner\Application Data\uh83nlyy.js moved successfully.
C:\Documents and Settings\Owner\Application Data\jGR0fNpus.js moved successfully.
C:\Documents and Settings\Owner\Application Data\OmtF4Udeq.js moved successfully.
C:\Documents and Settings\Owner\Application Data\g6Cc2cs.js moved successfully.
C:\Documents and Settings\Owner\Application Data\MWUrYarzI.js moved successfully.
C:\Documents and Settings\Owner\Application Data\VGe2ky.js moved successfully.
C:\Documents and Settings\Owner\Application Data\JKcSAGWw.js moved successfully.
C:\Documents and Settings\Owner\Application Data\ZctWb4bQ.js moved successfully.
C:\Documents and Settings\Owner\Application Data\HLqxni.js moved successfully.
C:\Documents and Settings\Owner\Application Data\m0awmDbnS.js moved successfully.
C:\Documents and Settings\Owner\Application Data\QUtc3K.js moved successfully.
C:\Documents and Settings\Owner\Application Data\UKWGaB.js moved successfully.
C:\Documents and Settings\Owner\Application Data\NHuBj2XsR.js moved successfully.
C:\Documents and Settings\Owner\Application Data\BYAxumulAi.js moved successfully.
C:\Documents and Settings\Owner\Application Data\gSU671GD.js moved successfully.
C:\Documents and Settings\Owner\Application Data\Ss56znTWGW.js moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 34953 bytes
->Flash cache emptied: 41 bytes

User: Administrator.NICK
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41 bytes

User: Administrator.NICK.000
->Temp folder emptied: 1001375 bytes
->Temporary Internet Files folder emptied: 439007 bytes
->Java cache emptied: 4373 bytes
->FireFox cache emptied: 102400991 bytes
->Flash cache emptied: 6093 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 2146438 bytes
->Java cache emptied: 4415 bytes
->Flash cache emptied: 9270 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 21725 bytes

User: Owner
->Temp folder emptied: 2577201 bytes
->Temporary Internet Files folder emptied: 11674714 bytes
->Java cache emptied: 1 bytes
->FireFox cache emptied: 78164989 bytes
->Google Chrome cache emptied: 79061285 bytes
->Flash cache emptied: 39619 bytes

%systemdrive% .tmp files removed: 256512 bytes
%systemroot% .tmp files removed: 1138887 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33488 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 266.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.20.6 log created on 02132011_154526

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...




and here is the MBAM report:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5755

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

2/13/2011 17:48:31
mbam-log-2011-02-13 (17-48-31).txt

Scan type: Full scan (C:\|)
Objects scanned: 323022
Time elapsed: 1 hour(s), 54 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 31

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\Owner\application data\lc7lw5ddt0.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\system32\Drivers\vbma7f61.sys.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\WinSxS\x86_microsoft.windows.shell.hweventdetector_6595b64144ccf1df_5.2.2.3_x-ww_5390e909\shsvcs.dll.vir (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0229518.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0230518.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0231518.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0232518.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0233533.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0233542.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0234542.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0235542.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0236555.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0236563.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0236577.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0236586.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0236615.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0236632.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0232533.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0236570.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP450\A0236624.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP451\A0236659.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP451\A0237659.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP451\A0237688.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP451\A0237813.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP451\A0237799.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP451\A0237934.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP451\A0237958.dll (Trojan.Agent.Max) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP453\A0238215.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP453\A0238216.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP453\A0238217.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d6f46907-adfb-44fb-8384-a0f56331f7ec}\RP453\A0238220.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

#10 Shannon2012

Shannon2012

  • Security Colleague
  • 3,657 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina, USA
  • Local time:06:51 PM

Posted 13 February 2011 - 09:10 PM

Hi-

Glad to hear that the AVG warnings are under control. What problems are left?

Most of what MBAM found were already in quarantine.

I'd like for you to scan your machine with ESET OnlineScan
  • Hold down Control key and click on the following link to open ESET OnlineScan in a new window.
  • ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip the next two steps)
  • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image

In your reply, please let me know how the computer is running and copy in the ESET OnlineScan report.
Shannon

#11 turketron

turketron
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 13 February 2011 - 11:32 PM

Everything appears to be running as normal, haven't had a single AVG warning yet. Below is the ESET logfile. Again, it looks like most of what it found was already quarantined by OTL.

C:\Documents and Settings\Owner\My Documents\Downloads\Setup_FreeBurner.exe Win32/Adware.Toolbar.Dealio application deleted - quarantined
C:\Qoobox\Quarantine\C\WINDOWS\system32\exefile.exe.vir Win32/Small.NIY trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{D6F46907-ADFB-44FB-8384-A0F56331F7EC}\RP451\A0237957.exe Win32/Small.NIY trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\aqAkq5lU2.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\bq2ltI.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\Brdgq.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\BYAxumulAi.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\bymjMzpR.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\cETXLgNoj.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\cfKYogKaS.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\CKyen1l0.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\cuuEn7.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\DFlj20Bk.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\DPK008PfY5.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\fJw4EB2.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\FV4bq1Rr.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\g6Cc2cs.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\gSU671GD.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\Hh2tOnF.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\HLqxni.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\ieC9pu.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\If6d8grlJH.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\jAbUi2t5.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\jGR0fNpus.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\JKcSAGWw.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\lD9X8n.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\ldfGS.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\m0awmDbnS.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\mudig.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\MWUrYarzI.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\naZtVwJ.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\NHuBj2XsR.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\OcaK1yN8.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\OmtF4Udeq.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\PHcnT5HS.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\pn9HQVYTG5.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\pz6Rh.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\q9MIkrGsT.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\qCN7822.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\QUtc3K.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\QXl8rdI.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\qxn9uZal5.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\R4hShl.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\RgEgVOluq.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\rHaGweEQtn.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\RkzlYf5.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\Ss56znTWGW.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\stgZr.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\tQ83Qq07.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\ttWxdcLV08.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\Ty0PW9.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\uh83nlyy.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\UKWGaB.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\USnG8.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\UWf8pzT.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\V0k6rp.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\VGe2ky.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\Vkq4U0.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\VN1d9Tscj.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\wkT88zK9.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\yZFkBBMSi.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\ZctWb4bQ.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\02132011_154526\C_Documents and Settings\Owner\Application Data\zEOWJ.js JS/TrojanDownloader.Agent.NWG trojan cleaned by deleting - quarantined



Thank you for all your help!

#12 Shannon2012

Shannon2012

  • Security Colleague
  • 3,657 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina, USA
  • Local time:06:51 PM

Posted 14 February 2011 - 12:36 PM

Hi-

Before we wrap things up, you need to install some updates.

Your Adobe Reader is out of date. You can download the latest version - Adobe Reader X

Your Java runtimes are out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version here - Java Runtime Environment (JRE) Version 6
  • Scroll down to where it says "JDK 6 Update 23 (JRE) ...allows end-users to run Java applications".
  • Click the "Download JRE" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u23-windows-i586.exe to install the newest version.
Next, do a new OTL scan.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • A report will open, copy and paste it into your reply:
  • OTL.txt <-- Will be the opened report
In your reply, please copy in the OTL report.

Thanks.
Shannon

#13 turketron

turketron
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:51 PM

Posted 14 February 2011 - 10:49 PM

Adobe/Java updates complete. Below is the OTL report.



OTL logfile created on: 2/14/2011 21:41:50 - Run 2
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 63.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 18.45 Gb Free Space | 3.96% Space Free | Partition Type: NTFS
Drive D: | 493.80 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: NICK | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/02/11 18:34:43 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2011/01/07 01:22:54 | 002,747,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011/01/07 01:22:44 | 001,084,256 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/01/07 01:22:12 | 001,052,512 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgemcx.exe
PRC - [2011/01/06 15:23:20 | 000,737,872 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011/01/06 15:23:18 | 006,128,720 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2010/12/10 14:03:14 | 000,745,192 | ---- | M] () -- C:\Program Files\MiserWare\Granola\granola.exe
PRC - [2010/12/10 12:58:40 | 000,423,152 | ---- | M] () -- C:\Program Files\MiserWare\Granola\GranolaManager.exe
PRC - [2010/12/05 16:26:40 | 000,654,176 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/12/05 16:26:12 | 000,650,592 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2010/10/22 04:58:18 | 000,265,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2010/10/22 04:56:58 | 000,845,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2010/10/17 16:42:40 | 000,404,200 | ---- | M] (SANDBOXIE L.T.D) -- C:\Program Files\Sandboxie\SbieCtrl.exe
PRC - [2010/10/17 16:42:38 | 000,075,496 | ---- | M] (SANDBOXIE L.T.D) -- C:\Program Files\Sandboxie\SbieSvc.exe
PRC - [2010/10/16 17:52:23 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
PRC - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2009/03/02 08:23:10 | 000,045,603 | ---- | M] (The Pidgin developer community) -- C:\Program Files\Pidgin\pidgin.exe
PRC - [2009/02/18 23:33:08 | 000,809,488 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/02/18 23:28:52 | 000,076,304 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2008/04/14 04:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/02/11 18:34:43 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
MOD - [2010/08/23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2009/07/12 01:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
MOD - [2009/02/18 23:31:16 | 000,045,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\lgscroll.dll
MOD - [2009/02/18 23:26:28 | 000,064,016 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\GameHook.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Auto | Stopped] -- -- (ATI Smart)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/01/06 15:23:18 | 006,128,720 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2010/12/10 12:58:40 | 000,423,152 | ---- | M] () [Auto | Running] -- C:\Program Files\MiserWare\Granola\GranolaManager.exe -- (Granola PM Manager)
SRV - [2010/11/25 22:55:17 | 001,375,992 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2010/10/22 04:58:18 | 000,265,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2010/10/17 16:42:38 | 000,075,496 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV - [2010/06/10 20:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/03/18 16:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 13:16:28 | 000,124,240 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2009/02/18 23:30:20 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)


========== Driver Services (SafeList) ==========

DRV - [2011/01/04 21:34:28 | 005,656,576 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2010/12/08 04:12:38 | 000,251,728 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010/11/12 13:19:38 | 000,299,984 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2010/11/05 22:06:54 | 000,015,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)
DRV - [2010/10/17 16:42:34 | 000,124,648 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV - [2010/09/13 15:27:24 | 000,025,680 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2010/09/07 03:48:56 | 000,034,384 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2010/09/07 03:48:50 | 000,026,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2010/08/03 15:23:36 | 000,026,192 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2010/08/03 15:23:34 | 000,123,472 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2010/08/03 15:23:32 | 000,030,288 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2010/07/12 02:55:39 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2010/05/10 12:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/04/08 02:11:36 | 000,101,904 | R--- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2010/02/17 12:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/11/05 23:41:12 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009/09/28 01:02:44 | 000,014,424 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\PeerBlock\pbfilter.sys -- (pbfilter)
DRV - [2009/04/22 00:42:59 | 005,030,912 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/04/22 00:42:56 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2009/04/22 00:42:55 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2009/02/13 10:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2008/12/18 22:44:00 | 000,028,816 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2008/12/18 22:43:48 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008/12/18 22:43:40 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008/12/18 22:43:18 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2008/12/18 22:43:06 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2008/09/25 07:51:42 | 000,115,328 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/04/13 21:06:06 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2007/12/17 03:14:06 | 000,012,400 | R--- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO)
DRV - [2004/08/13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1993962763-1580818891-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1993962763-1580818891-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.21.1
FF - prefs.js..extensions.enabledItems: amin.eft_Shutdown@gmail.com:3.6.2C
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.7
FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:0.9.10.2
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.50
FF - prefs.js..extensions.enabledItems: {246B0AC1-31AB-4786-A4CC-A6AF89647D7F}:0.3.8
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..keyword.URL: "http://www.google.com/search?q="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2011/02/13 12:40:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/09 19:25:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/02/14 21:41:06 | 000,000,000 | ---D | M]

[2009/04/22 00:23:10 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/02/13 12:34:37 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions
[2010/02/28 14:24:46 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2009/07/03 14:22:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/09/02 17:20:43 | 000,000,000 | ---D | M] (Wikipedia Lookup Add-on) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{246B0AC1-31AB-4786-A4CC-A6AF89647D7F}
[2010/02/28 14:24:29 | 000,000,000 | ---D | M] (NoScript) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/09/02 17:20:43 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2010/02/28 14:24:30 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/02/28 14:24:42 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/02/28 14:24:28 | 000,000,000 | ---D | M] (Auto Shutdown) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2pixzovl.default\extensions\amin.eft_Shutdown@gmail.com
[2011/02/14 21:38:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/01/15 12:58:13 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/02/14 21:38:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2011/02/14 21:38:47 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/06/06 16:56:18 | 000,151,552 | ---- | M] (PopCap Games) -- C:\Program Files\Mozilla Firefox\plugins\nppopcaploader.dll

O1 HOSTS File: ([2011/02/13 15:46:56 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-1993962763-1580818891-839522115-1003..\Run: [Granola] C:\Program Files\MiserWare\Granola\granola.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\pidgin.lnk = C:\Program Files\Pidgin\pidgin.exe (The Pidgin developer community)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1993962763-1580818891-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1993962763-1580818891-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1993962763-1580818891-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1993962763-1580818891-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240380938515 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} http://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab (CTAdjust Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/21 17:00:13 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/11/09 22:10:28 | 000,000,041 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2008/08/30 14:18:26 | 000,360,960 | R--- | M] () - D:\Autorun.exe -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (sprecovr \systemroot\sprecovr.txt) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/02/14 21:40:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2011/02/14 21:39:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2011/02/14 21:39:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011/02/14 21:38:57 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2011/02/14 21:38:57 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011/02/14 21:38:57 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011/02/14 21:38:57 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011/02/14 21:38:57 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011/02/14 20:12:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN
[2011/02/14 18:15:16 | 016,561,952 | ---- | C] (Sun Microsystems, Inc.) -- C:\Documents and Settings\Owner\Desktop\jre-6u23-windows-i586.exe
[2011/02/13 20:21:21 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/02/13 15:51:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/02/13 15:51:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/02/13 15:51:47 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/02/13 15:51:47 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/02/13 15:46:56 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/02/13 15:45:26 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/02/13 12:42:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\AVG10
[2011/02/13 12:41:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/02/13 12:40:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011
[2011/02/13 12:40:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\AVG
[2011/02/13 12:40:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2011/02/13 12:34:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2011/02/12 19:57:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/02/12 19:27:34 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/02/12 19:24:10 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2011/02/12 19:16:37 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/02/12 19:16:36 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/02/12 19:16:36 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/02/12 19:16:36 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/02/12 19:16:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/02/12 18:48:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\AVG8
[2011/02/12 18:27:06 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/02/11 18:45:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\AVG9
[2011/02/11 18:34:58 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/02/08 20:19:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/02/08 19:24:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2011/02/08 19:24:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Sun
[2011/02/06 14:28:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2011/02/06 14:27:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\Simply Super Software
[2011/02/06 14:27:05 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2011/02/06 14:27:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Simply Super Software
[2011/02/06 12:21:40 | 010,905,616 | ---- | C] (Simply Super Software ) -- C:\Documents and Settings\Owner\Desktop\trjsetup682.exe
[2011/02/05 23:53:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer
[2011/02/05 23:53:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Apple Computer
[2011/02/05 23:49:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/02/05 23:48:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/01/29 12:37:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\MiserWare
[2011/01/29 12:37:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MiserWare
[2011/01/28 17:58:17 | 000,101,904 | R--- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\drivers\AtiHdmi.sys
[2011/01/28 00:19:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Catalyst Control Center
[2011/01/28 00:13:19 | 017,084,416 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\atioglxx.dll
[2011/01/28 00:13:19 | 001,112,576 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\WINDOWS\System32\ativvamv.dll
[2011/01/28 00:13:19 | 000,462,848 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\ATIDEMGX.dll
[2011/01/28 00:13:19 | 000,311,296 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atiiiexx.dll
[2011/01/28 00:13:19 | 000,212,992 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\atipdlxx.dll
[2011/01/28 00:13:19 | 000,053,248 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2erec.dll
[2011/01/28 00:13:19 | 000,053,248 | ---- | C] ( ATI Technologies Inc.) -- C:\WINDOWS\System32\ATIDDC.DLL
[2011/01/28 00:13:19 | 000,043,520 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ati2edxx.dll
[2011/01/28 00:13:19 | 000,026,112 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\Ati2mdxx.exe
[2011/01/28 00:13:19 | 000,024,064 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\ativcoxx.dll
[2011/01/28 00:13:19 | 000,017,408 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\atitvo32.dll
[2011/01/28 00:13:09 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2011/01/28 00:12:50 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2011/01/28 00:12:21 | 000,000,000 | ---D | C] -- C:\ATI
[2011/01/28 00:00:50 | 000,041,984 | ---- | C] (Microsoft) -- C:\Documents and Settings\Owner\Desktop\~WebUpdateHelper.exe
[2011/01/27 23:58:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ATI
[2011/01/27 23:49:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Phyxion.net
[2011/01/27 23:48:58 | 000,000,000 | ---D | C] -- C:\Program Files\Phyxion.net
[2011/01/27 20:07:57 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET

========== Files - Modified Within 30 Days ==========

[2011/02/14 21:41:06 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/02/14 21:38:47 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011/02/14 21:38:47 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011/02/14 21:38:47 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011/02/14 21:38:47 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011/02/14 21:38:46 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2011/02/14 21:36:39 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/02/14 21:36:17 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/14 21:36:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/02/14 21:17:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/14 20:57:00 | 000,000,978 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1580818891-839522115-1003UA.job
[2011/02/14 20:12:06 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2011/02/14 18:57:01 | 000,000,926 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-1580818891-839522115-1003Core.job
[2011/02/14 18:15:44 | 016,561,952 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\Owner\Desktop\jre-6u23-windows-i586.exe
[2011/02/14 18:13:14 | 106,123,791 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/02/14 18:08:27 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/02/14 18:08:23 | 000,119,744 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/02/14 00:04:01 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/02/13 20:20:39 | 002,672,312 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\esetsmartinstaller_enu.exe
[2011/02/13 15:51:51 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/13 15:46:56 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2011/02/13 12:40:58 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/02/13 12:37:09 | 000,000,171 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\3051.bat
[2011/02/13 12:24:52 | 000,000,171 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\8269.bat
[2011/02/13 11:36:36 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/02/12 19:57:45 | 000,002,284 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Google Chrome.lnk
[2011/02/12 19:57:45 | 000,002,262 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/02/12 19:52:30 | 000,000,171 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\6040.bat
[2011/02/12 19:27:40 | 000,000,327 | -H-- | M] () -- C:\boot.ini
[2011/02/12 19:22:11 | 000,000,169 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\7353.bat
[2011/02/12 18:48:24 | 000,000,171 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\2339.bat
[2011/02/12 18:17:27 | 004,267,194 | R--- | M] () -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/02/12 18:17:27 | 004,267,194 | ---- | M] () -- C:\ComboFix.exe
[2011/02/11 18:36:26 | 000,052,741 | ---- | M] () -- C:\topic114351.html
[2011/02/11 18:34:43 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/02/11 18:34:06 | 000,031,489 | ---- | M] () -- C:\page__p__2130507__hl__clel__fromsearch__1.htm
[2011/02/08 22:14:56 | 000,006,656 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/08 18:44:35 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/02/07 22:09:24 | 000,002,155 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes (2).lnk
[2011/02/07 17:51:48 | 000,624,128 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/02/06 12:16:36 | 000,720,369 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\iExplore.exe
[2011/02/06 12:16:20 | 010,905,616 | ---- | M] (Simply Super Software ) -- C:\Documents and Settings\Owner\Desktop\trjsetup682.exe
[2011/01/30 11:28:24 | 000,458,282 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/01/30 11:28:24 | 000,076,762 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/01/29 12:36:55 | 004,273,664 | ---- | M] () -- C:\Documents and Settings\Owner\Granola-3.1.3.msi
[2011/01/28 00:00:50 | 000,041,984 | ---- | M] (Microsoft) -- C:\Documents and Settings\Owner\Desktop\~WebUpdateHelper.exe
[2011/01/27 23:49:00 | 000,000,798 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Driver Sweeper.lnk
[2011/01/21 08:44:37 | 008,462,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell32.dll
[2011/01/21 08:44:37 | 000,439,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shimgvw.dll

========== Files Created - No Company Name ==========

[2011/02/14 21:41:06 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/02/14 21:41:06 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/02/14 20:12:06 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2011/02/14 18:13:14 | 106,123,791 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/02/13 20:20:31 | 002,672,312 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\esetsmartinstaller_enu.exe
[2011/02/13 15:51:51 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/13 12:40:58 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/02/13 12:37:09 | 000,000,171 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\3051.bat
[2011/02/13 12:24:52 | 000,000,171 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\8269.bat
[2011/02/13 12:23:51 | 000,000,868 | ---- | C] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/02/12 19:52:30 | 000,000,171 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\6040.bat
[2011/02/12 19:27:39 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/02/12 19:27:37 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/02/12 19:22:11 | 000,000,169 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\7353.bat
[2011/02/12 19:16:37 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/02/12 19:16:36 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/02/12 19:16:36 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/02/12 19:16:36 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/02/12 19:16:36 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/02/12 18:48:24 | 000,000,171 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\2339.bat
[2011/02/12 18:26:41 | 004,267,194 | R--- | C] () -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/02/12 18:22:48 | 004,267,194 | ---- | C] () -- C:\ComboFix.exe
[2011/02/11 18:36:25 | 000,052,741 | ---- | C] () -- C:\topic114351.html
[2011/02/11 18:33:59 | 000,031,489 | ---- | C] () -- C:\page__p__2130507__hl__clel__fromsearch__1.htm
[2011/02/07 17:55:46 | 000,624,128 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/02/06 12:21:40 | 000,720,369 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\iExplore.exe
[2011/01/29 12:36:55 | 004,273,664 | ---- | C] () -- C:\Documents and Settings\Owner\Granola-3.1.3.msi
[2011/01/28 00:13:19 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011/01/28 00:13:19 | 000,538,880 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.cap
[2011/01/28 00:13:19 | 000,022,280 | ---- | C] () -- C:\WINDOWS\atiogl.xml
[2011/01/28 00:13:19 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011/01/28 00:06:16 | 000,226,857 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011/01/27 23:49:00 | 000,000,798 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Driver Sweeper.lnk
[2010/11/28 14:08:48 | 000,068,576 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/08/23 20:50:50 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\housecall.guid.cache
[2010/08/23 18:13:33 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\GIF89.DLL
[2010/08/23 18:13:31 | 000,484,352 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2009/07/25 14:51:11 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2009/07/18 20:50:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iplayer.INI
[2009/05/15 17:23:40 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009/04/22 06:38:25 | 000,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll
[2009/04/22 06:38:25 | 000,012,400 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys
[2009/04/22 06:38:22 | 000,011,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys
[2009/04/22 06:38:22 | 000,010,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys
[2009/04/22 00:43:11 | 000,001,746 | ---- | C] () -- C:\WINDOWS\Language_trs.ini
[2009/04/22 00:27:43 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/04/22 00:08:16 | 000,033,166 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2009/04/22 00:07:35 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/04/22 00:07:21 | 000,032,805 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009/04/22 00:07:21 | 000,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/04/21 22:33:57 | 000,002,534 | ---- | C] () -- C:\WINDOWS\Sandboxie.ini
[2009/04/21 22:26:41 | 000,006,656 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/21 22:06:13 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2009/04/21 09:54:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/10/28 16:40:48 | 000,173,552 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9

< End of report >

#14 Shannon2012

Shannon2012

  • Security Colleague
  • 3,657 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina, USA
  • Local time:06:51 PM

Posted 15 February 2011 - 10:07 AM

Hi-

It is time to clear off the tools that we used and for me to leave you with some words of advice.

First, to re-enable your Emulation drivers, double click Defogger to run the tool.
  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • Defogger will now ask to reboot the machine - click OK

Next, we will uninstall ComboFix
  • Click on the Start button in your system tray
  • click on Run
  • key in the following in bold type:
    • combofix /Uninstall
  • click on Ok

Then, we should remove the tools we used and we will do that with OTL-
  • Double click on the Posted Image icon on your desktop.
  • Click the "CleanUp" button.
  • Restart your computer when prompted.

Please take the time to read below to secure your machine and take the necessary steps to keep it clean.

One of the most common questions found when cleaning Spyware or other Malware is "how did my machine get infected?". There are a variety of reasons, but the most common ones are that you are going to sites that you are not practicing Safe Internet, you are not running the proper security software, and that your computer's security settings are set too low.

Below I have outlined a series of categories that outline how you can increase the security of your computer so that you will not be infected again in the future.

Practice Safe Internet

One of the main reasons people get infected in the first place is that they are not practicing Safe Internet. You practice Safe Internet when you educate yourself on how to properly use the Internet through the use of security tools and good practice. Knowing how you can get infected and what types of files and sites to avoid will be the most crucial step in keeping your computer malware free. The reality is that the majority of people who are infected with malware are ones who click on things they shouldn't be clicking on. Whether these things are files or sites it doesn't really matter. If something is out to get you, and you click on it, it most likely will. Below are a list of simple precautions to take to keep your computer clean and running securely:
  • If you receive an attachment from someone you do not know, DO NOT OPEN IT! Simple as that. Opening attachments from people you do not know is a very common method for viruses or worms to infect your computer.
  • If you receive an attachment and it ends with a .exe, .com, .bat, or .pif do not open the attachment unless you know for a fact that it is clean. For the casual computer user, you will almost never receive a valid attachment of this type.
  • If you receive an attachment from someone you know, and it looks suspicious, then it probably is. The email could be from someone you know infected with a malware that is trying to infect everyone in their address book.
  • If you are browsing the Internet and a pop up appears saying that you are infected, ignore it!. These are, as far as I am concerned, scams that are being used to scare you into purchasing a piece of software. For an example of these types of pop ups, or Foistware, you should read this article: Foistware, And how to avoid it.

    There are also programs that disguise themselves as Anti-Spyware or security products but are instead scams. For a list of these types of programs we recommend you visit this link: Rogue/Suspect Anti-Spyware Products & Web Sites
  • Another tactic to fool you on the web is when a site displays a pop up that looks like a normal Windows message or alert. When you click on them, though, they instead bring you to another site that is trying to push a product on you. We suggest that you close these windows by clicking on the X instead of the OK button. Alternatively, you can check to see if it's a real alert by right-clicking on the window. If there is a menu that comes up saying Add to Favorites... you know it's a fake.
  • Do not go to adult sites. I know this may bother some of you, but the fact is that a large amount of malware is pushed through these types of sites. I am not saying all adult sites do this, but a lot do.
  • When using an Instant Messaging program be cautious about clicking on links people send to you. It is not uncommon for infections to send a message to everyone in the infected person's contact list that contains a link to an infection. Instead when you receive a message that contains a link, message back to the person asking if it is legit before you click on it.
  • Stay away from Warez and Crack sites! In addition to the obvious copyright issues, the downloads from these sites are typically overrun with infections.
  • Be careful of what you download off of web sites and Peer-2-Peer networks. Some sites disguise malware as legitimate software to trick you into installing them and Peer-2-Peer networks are crawling with it. If you want to download a piece of software a from a site, and are not sure if they are legitimate, you can use McAfee Siteadvisor to look up info on the site.
  • DO NOT INSTALL any software without first reading the End User License Agreement, otherwise known as the EULA. A tactic that some developers use is to offer their software for free, but have spyware and other programs you do not want bundled with it. This is where they make their money. By reading the agreement there is a good chance you can spot this and not install the software.

Visit Microsoft's Windows Update Site Frequently

It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Update your AntiVirus Software

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. If you use a commercial antivirus program you must make sure you keep renewing your subscription. Otherwise, once your subscription runs out, you may not be able to update the programs virus definitions.

Make sure your applications have all of their updates

It is also possible for other programs on your computer to have security vulnerability that can allow malware to infect you. Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Install an AntiSpyware Program

A highly recommended AntiSpyware program is SuperAntiSpyware. You can download the free Home Version. or the Pro version for a 15 day trial period. nother recommended, and free, AntiSpyware program is Malwarebytes' Anti-Malware (MBAM).

Installing these programs will provide spyware & hijacker protection on your computer alongside your virus protection. You should scan your computer with an AntiSpyware program on a regular basis just as you would an antivirus software.

Install SpywareBlaster

SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Update all these programs regularly
Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Update your Java runtimes regularly

Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.
Download the latest version here - http://java.sun.com/javase/downloads/index.jsp. You want to select the JRE version.
Follow this list and your potential for being infected again will reduce dramatically.

Good Luck!!

Shannon

#15 Shannon2012

Shannon2012

  • Security Colleague
  • 3,657 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina, USA
  • Local time:06:51 PM

Posted 24 February 2011 - 11:34 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.
Shannon




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users