Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Vista virus of some kind shutting down ALL malware removal programs and altering system processes


  • This topic is locked This topic is locked
33 replies to this topic

#1 Kristen.Love

Kristen.Love

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:08:34 AM

Posted 04 September 2011 - 06:46 AM

Here is my original topic in the "Am I Infected, What Do I Do?" Forum, describing all my original symptoms:
http://www.bleepingcomputer.com/forums/topic417241.html

Since the last post, the virus has completely disabled Firefox, even upon uninstalling, manually deleting all Mozilla-related files, restarting, and reinstalling, it still won't work. It gives me the same "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item". Even when I had uninstalled Firefox I noticed there was a firefox.exe without the firefox logo still in the Programs\Mozilla Firefox folder. Deleted that, tried removing everything again and reinstalling, still can't get firefox open. Now this thing is starting to piss me off. I have MOST of my bookmarks backed up but not all (I know, I know...) It tried doing it with iTunes as well, but when I removed all iTunes and its services from my computer and reinstalled it now runs fine and even saved my library and play counts and everything. It seems the virus has not currently hijacked my Apple Mobile Device, Bonjour, or, iTunes, iTunesHelper services at the moment, so I'm going to re-do a scan of MiniToolBox to see if we get some different results since it showed an error in those processes, and I'll post all the required log files that I can, but anything that requires anything besides just a diagnostic scan my computer seems to kill permanently at this point. And every time I restart newer, more evil symptoms keep popping up, so I kinda feel like the clock is ticking to get this baby fixed. As I said in my original thread I take online classes and without my computer I am SO SCREWED.

GMER will not run, as stated in original thread. Window pops up for about two seconds and then shuts down and I have to uninstall and reinstall only to have the exact same thing happen all over again.

But here is the DDS log:
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by Kristen at 5:09:27 on 2011-09-04
Microsoft« Windows VistaÖ Home Premium 6.0.6002.2.1252.1.1033.18.2814.1492 [GMT -6:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\2258203590:965502585.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Users\Kristen\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\Program Files\Flip Video\FlipShareServer\FlipShareServer.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\SMINST\BLService.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\Taskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes2\iTunesHelper.exe
C:\Program Files\iTunes2\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\Program Files\MSN\Toolbar\3.0.0541.0\msntask.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10p_ActiveX.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\Kristen\Downloads\Defogger.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"
mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter"
mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\2.0"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"
mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [<NO NAME>]
mRun: [VirtualCloneDrive] "c:\program files\elaborate bytes\virtualclonedrive\VCDDaemon.exe" /s
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes2\iTunesHelper.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: mswsock.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{D60A6BDB-9AFA-4CF2-931D-44358FD3AA4F} : DhcpNameServer = 192.168.0.1
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath -
.
============= SERVICES / DRIVERS ===============
.
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-9-3 165456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-9-3 17744]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-9-3 50256]
R2 BackupService;BackupService;c:\users\kristen\appdata\roaming\hp simplesave application\uUACTokenSvc.exe [2011-6-10 83512]
R2 FlipShareServer;FlipShare Server;c:\program files\flip video\flipshareserver\FlipShareServer.exe [2011-5-6 1085440]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2009-4-20 365952]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-5-9 43040]
S2 !SASCORE;SAS Core Service;"c:\program files\superantispyware\sascore.exe" --> c:\program files\superantispyware\SASCORE.EXE [?]
S2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2011-9-3 40384]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 Norton Internet Security;Norton Internet Security;"c:\program files\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 --> c:\program files\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2011-9-3 40384]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2011-9-3 40384]
S3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-4-20 193840]
S3 pbfilter;pbfilter;c:\program files\peerblock\pbfilter.sys [2011-6-10 20080]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2011-9-4 27192]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-1-20 16896]
.
=============== Created Last 30 ================
.
2011-09-04 10:58:03 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-09-04 10:58:03 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2011-09-04 10:55:26 -------- d-----w- c:\program files\Bonjour
2011-09-04 10:14:12 -------- d-----w- c:\users\kristen\appdata\local\VS Revo Group
2011-09-04 10:14:08 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys
2011-09-04 10:14:07 -------- d-----w- c:\program files\VS Revo Group
2011-09-04 09:27:00 43408 --sha-w- c:\windows\system32\c_77044.nl_
2011-09-04 01:31:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-09-03 12:29:10 -------- d-----w- C:\32b4ef8b9086343f930000
2011-09-03 11:42:32 -------- d-----w- c:\users\kristen\appdata\roaming\SUPERAntiSpyware.com
2011-09-03 11:42:04 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-09-03 11:42:04 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-09-03 10:01:38 -------- d-----w- c:\program files\iTunes
2011-09-03 09:58:20 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll
2011-09-03 09:58:20 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll
2011-09-03 09:58:20 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll
2011-09-03 09:58:20 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll
2011-09-03 09:58:20 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll
2011-09-03 09:58:20 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll
2011-09-03 09:58:20 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll
2011-09-03 09:14:34 50256 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-09-03 09:14:02 38848 ----a-w- c:\windows\avastSS.scr
2011-09-03 08:50:33 -------- d-----w- c:\windows\pss
2011-09-02 14:52:07 -------- d-----w- c:\program files\CCleaner
2011-09-02 14:35:32 -------- d-----w- c:\programdata\Malwarebytes
2011-09-02 13:56:10 -------- d-----w- c:\programdata\Alwil Software
2011-09-02 13:07:21 -------- d--h--w- c:\programdata\Common Files
2011-09-02 13:03:35 -------- d-----w- c:\programdata\MFAData
2011-09-02 09:55:37 7152464 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{8d41cccc-bc5c-4321-9525-7623e4b2e2cc}\mpengine.dll
2011-09-02 09:27:58 4194304 ----a-w- c:\windows\system32\qnbwvoto.dll
2011-08-11 08:25:06 905104 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-08-11 02:56:20 -------- d-----w- c:\users\kristen\appdata\roaming\Flip Video
2011-08-11 02:55:51 -------- d-----w- c:\programdata\Flip Video
2011-08-11 02:55:47 -------- d-----w- c:\program files\Flip Video
2011-08-06 12:17:52 -------- d-----w- c:\programdata\PopCap Games
2011-08-06 11:03:07 274432 ----a-w- c:\windows\TLCUninstall.exe
2011-08-06 11:03:05 -------- d-----w- c:\program files\The Learning Company
.
==================== Find3M ====================
.
2011-07-28 02:15:13 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-07-12 17:20:54 83816 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 17:20:54 73064 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 17:20:54 50536 ----a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 17:20:54 178536 ----a-w- c:\windows\system32\dnssdX.dll
2011-07-06 00:37:00 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-06 00:37:00 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-06-11 02:55:00 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
============= FINISH: 5:10:21.45 ===============


And here is the MiniToolBox log now that iTunes processes' don't seem to be infected for the moment (it seems that as soon as my computer restarts, of my own will or not, they will be corrupted again):

MiniToolBox by Farbar
Ran by Kristen (administrator) on 04-09-2011 at 05:40:12
Windows Vista ™ Home Premium Service Pack 2 (X86)

***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.
========================= Hosts content: =================================

::1 localhost

127.0.0.1 localhost

========================= IP Configuration: ================================The following helper DLL cannot be loaded: WSHELPER.DLL.
The following helper DLL cannot be loaded: IFMON.DLL.
The following command was not found: int ip dump.

Windows IP Configuration

Host Name . . . . . . . . . . . . : Kristen-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : hsd1.co.comcast.net.

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : NVIDIA nForce 10/100/1000 Mbps Networking Controller
Physical Address. . . . . . . . . : 00-1F-16-E9-0D-C8
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : hsd1.co.comcast.net.
Description . . . . . . . . . . . : Atheros AR5007 802.11b/g WiFi Adapter
Physical Address. . . . . . . . . : 00-26-5E-7C-0D-15
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::8014:2329:6394:8278%10(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.195(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Sunday, September 04, 2011 4:22:15 AM
Lease Expires . . . . . . . . . . : Monday, September 05, 2011 4:22:16 AM
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 218113630
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-15-7D-A7-7A-00-26-5E-7C-0D-15
DNS Servers . . . . . . . . . . . : 192.168.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 6:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : hsd1.co.comcast.net.
Description . . . . . . . . . . . : isatap.hsd1.co.comcast.net.
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 7:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:1c7f:3748:b3e6:2cb2(Preferred)
Link-local IPv6 Address . . . . . : fe80::1c7f:3748:b3e6:2cb2%12(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Local Area Connection* 11:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{98E455EA-51A6-441E-9D7E-99CAD4796DCE}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes


Pinging google.com [74.125.127.106] with 32 bytes of data:

Reply from 74.125.127.106: bytes=32 time=79ms TTL=49

Reply from 74.125.127.106: bytes=32 time=157ms TTL=49



Ping statistics for 74.125.127.106:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 79ms, Maximum = 157ms, Average = 118ms



Pinging yahoo.com [67.195.160.76] with 32 bytes of data:

Reply from 67.195.160.76: bytes=32 time=56ms TTL=50

Reply from 67.195.160.76: bytes=32 time=73ms TTL=50



Ping statistics for 67.195.160.76:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 56ms, Maximum = 73ms, Average = 64ms



Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
11 ...00 1f 16 e9 0d c8 ...... NVIDIA nForce 10/100/1000 Mbps Networking Controller
10 ...00 26 5e 7c 0d 15 ...... Atheros AR5007 802.11b/g WiFi Adapter
1 ........................... Software Loopback Interface 1
14 ...00 00 00 00 00 00 00 e0 isatap.hsd1.co.comcast.net.
12 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
13 ...00 00 00 00 00 00 00 e0 isatap.{98E455EA-51A6-441E-9D7E-99CAD4796DCE}
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.195 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.0.0 255.255.255.0 On-link 192.168.0.195 281
192.168.0.195 255.255.255.255 On-link 192.168.0.195 281
192.168.0.255 255.255.255.255 On-link 192.168.0.195 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.0.195 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.0.195 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
12 18 ::/0 On-link
1 306 ::1/128 On-link
12 18 2001::/32 On-link
12 266 2001:0:4137:9e76:1c7f:3748:b3e6:2cb2/128
On-link
10 281 fe80::/64 On-link
12 266 fe80::/64 On-link
12 266 fe80::1c7f:3748:b3e6:2cb2/128
On-link
10 281 fe80::8014:2329:6394:8278/128
On-link
1 306 ff00::/8 On-link
12 266 ff00::/8 On-link
10 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

========================= Event log errors: ===============================

Application errors:
==================
Error: (09/04/2011 05:40:24 AM) (Source: Application Error) (User: )
Description: Faulting application nslookup.exe, version 6.0.6002.18005, time stamp 0x49e01d63, faulting module ntdll.dll, version 6.0.6002.18327, time stamp 0x4cb73436, exception code 0xc0000138, fault offset 0x00009f7d,
process id 0x1a78, application start time 0xnslookup.exe0.

Error: (09/04/2011 05:40:16 AM) (Source: Application Error) (User: )
Description: Faulting application nslookup.exe, version 6.0.6002.18005, time stamp 0x49e01d63, faulting module ntdll.dll, version 6.0.6002.18327, time stamp 0x4cb73436, exception code 0xc0000138, fault offset 0x00009f7d,
process id 0xf00, application start time 0xnslookup.exe0.

Error: (09/04/2011 04:50:24 AM) (Source: MsiInstaller) (User: Kristen)Kristen
Description: Product: iTunes -- Error 1719. The Windows Installer Service could not be accessed. This can occur if you are running Windows in safe mode, or if the Windows Installer is not correctly installed. Contact your support personnel for assistance.

Error: (09/04/2011 04:24:19 AM) (Source: Application Error) (User: )
Description: Faulting application mscorsvw.exe, version 4.0.30319.1, time stamp 0x4ba1da21, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x10012815,
process id 0x968, application start time 0xmscorsvw.exe0.

Error: (09/04/2011 04:22:17 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/04/2011 03:58:13 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/04/2011 03:52:50 AM) (Source: MsiInstaller) (User: Kristen)Kristen
Description: Product: Apple Mobile Device Support -- Error 1704. An installation for Microsoft .NET Framework 4 Client Profile is currently suspended. You must undo the changes made by that installation to continue. Do you want to undo those changes?

Error: (09/04/2011 03:50:18 AM) (Source: MsiInstaller) (User: Kristen)Kristen
Description: Product: iTunes -- Error 1704. An installation for Microsoft .NET Framework 4 Client Profile is currently suspended. You must undo the changes made by that installation to continue. Do you want to undo those changes?

Error: (09/04/2011 03:46:54 AM) (Source: Application Error) (User: )
Description: Faulting application SASCORE.EXE, version 1.0.0.1066, time stamp 0x4e441778, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x004096da,
process id 0x1778, application start time 0xSASCORE.EXE0.

Error: (09/04/2011 03:39:07 AM) (Source: Application Error) (User: )
Description: Faulting application mscorsvw.exe, version 4.0.30319.1, time stamp 0x4ba1da21, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x10012815,
process id 0xb50, application start time 0xmscorsvw.exe0.


System errors:
=============
Error: (09/04/2011 04:52:15 AM) (Source: Service Control Manager) (User: )
Description: 1Restart the serviceWindows Installer%%1056

Error: (09/04/2011 04:52:09 AM) (Source: Service Control Manager) (User: )
Description: Apple Mobile Device1600001Restart the service

Error: (09/04/2011 04:50:15 AM) (Source: Service Control Manager) (User: )
Description: Windows Installer11200001Restart the service

Error: (09/04/2011 04:24:33 AM) (Source: Service Control Manager) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86

Error: (09/04/2011 04:23:18 AM) (Source: DCOM) (User: SYSTEM)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (09/04/2011 04:22:17 AM) (Source: Service Control Manager) (User: )
Description: SRTSP
SRTSPX

Error: (09/04/2011 04:22:17 AM) (Source: Service Control Manager) (User: )
Description: Norton Internet Security%%3

Error: (09/04/2011 04:22:17 AM) (Source: Service Control Manager) (User: )
Description: SAS Core Service%%2

Error: (09/04/2011 04:22:17 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (09/04/2011 04:22:17 AM) (Source: Service Control Manager) (User: )
Description: avast! Antivirus%%5


Microsoft Office Sessions:
=========================

=========================== Installed Programs ============================

ÁTorrent (Version: 2.2.1)
32 Bit HP CIO Components Installer (Version: 7.1.8)
Acrobat.com (Version: 0.0.0)
Acrobat.com (Version: 1.1.377)
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
ActiveCheck component for HP Active Support Library (Version: 3.0.0.2)
Adobe AIR (Version: 1.0.4990)
Adobe AIR (Version: 1.0.8.4990)
Adobe Flash Player 10 ActiveX (Version: 10.2.159.1)
Adobe Flash Player 10 Plugin (Version: 10.3.181.22)
Adobe Photoshop 7.0 (Version: 7.0)
Adobe Reader 9 (Version: 9.0.0)
Adobe Shockwave Player (Version: 11.0)
Apple Application Support (Version: 1.5.2)
Apple Mobile Device Support (Version: 3.4.1.2)
Apple Software Update (Version: 2.1.3.127)
Atheros Driver Installation Program (Version: 5.2)
Bonjour (Version: 3.0.0.2)
BufferChm (Version: 140.0.212.000)
C310 (Version: 140.0.304.000)
CCleaner (Version: 3.10)
Compatibility Pack for the 2007 Office system (Version: 12.0.4518.1014)
Conexant HD Audio (Version: 4.58.1.0)
CyberLink DVD Suite (Version: 6.0.2203)
CyberLink YouCam (Version: 2.0.2328)
Destinations (Version: 140.0.77.000)
DeviceDiscovery (Version: 140.0.212.000)
ESU for Microsoft Vista (Version: 1.0.0)
FlipShare (Version: 5.12.3.0)
GPBaseService2 (Version: 140.0.211.000)
HDAUDIO Soft Data Fax Modem with SmartCP
HP Active Support Library (Version: 3.1.9.1)
HP Customer Experience Enhancements (Version: 5.7.0.2664)
HP Doc Viewer (Version: 1.03.0001)
HP DVD Play 3.7 (Version: 3.7.0.5723)
HP Help and Support (Version: 2.1.1.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HP Photo Creations (Version: 1.0.0.2024)
HP Photosmart Prem C310 All-In-One Driver Software 14.0 Rel. 7 (Version: 14.0)
HP Quick Launch Buttons 6.40 H2 (Version: 6.40 H2)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Solution Center 14.0 (Version: 14.0)
HP Total Care Advisor (Version: 2.4.4941.2798)
HP Total Care Setup (Version: 1.1.1983.2818)
HP Update (Version: 5.003.001.001)
HP User Guides 0118 (Version: 1.01.0000)
HP Wireless Assistant (Version: 3.00 K2)
HPAppStudio (Version: 140.0.95.000)
HPAsset component for HP Active Support Library (Version: 3.0.0.3)
HPNetworkAssistant (Version: 1.1.70)
HPPhotoGadget (Version: 140.0.524.000)
HPProductAssistant (Version: 140.0.212.000)
iTunes (Version: 10.4.1.10)
Java Auto Updater (Version: 2.0.5.1)
Java™ 6 Update 26 (Version: 6.0.260)
Java™ 6 Update 7 (Version: 1.6.0.70)
LabelPrint (Version: 2.5.0926)
Last.fm 1.5.4.27091
LightScribe System Software 1.14.17.1 (Version: 1.14.17.1)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Live Search Toolbar (Version: 3.0.541.0)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Home and Student 2007 (Version: 12.0.4518.1014)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.4518.1014)
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.4518.1014)
Microsoft Silverlight (Version: 4.0.60531.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Works (Version: 9.7.0621)
Monopoly Here & Now Edition (Version: 1.0.18.272)
Mozilla Firefox 7.0 (x86 en-US) (Version: 7.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
muvee Reveal (Version: 7.0.35.6951)
My HP Games (Version: 1.0.0.62)
Network (Version: 140.0.215.000)
Norton Internet Security (Version: 16.0.0.125)
NVIDIA Drivers (Version: 1.5)
Oblivion (Version: 1.00.0000)
Oregon Trail 5
PeerBlock 1.1 (r518) (Version: 1.1.0.518)
Power2Go (Version: 6.0.2202)
PowerDirector (Version: 7.0.2201)
PS_AIO_07_C310_SW_Min (Version: 140.0.304.000)
PVSonyDll (Version: 1.00.0001)
QuickTime (Version: 7.70.80.34)
QuickTransfer (Version: 140.0.98.000)
Realtek USB 2.0 Card Reader (Version: 3.0.1.3)
Scan (Version: 140.0.80.000)
SmartWebPrinting (Version: 140.0.186.000)
SolutionCenter (Version: 140.0.214.000)
Status (Version: 140.0.256.000)
Synaptics Pointing Device Driver (Version: 11.1.3.0)
System Requirements Lab CYRI (Version: 4.4.26.0)
Toolbox (Version: 140.0.428.000)
TrayApp (Version: 140.0.212.000)
VirtualCloneDrive
VLC media player 1.1.7 (Version: 1.1.7)
WebReg (Version: 140.0.212.017)
WinRAR archiver
Yahoo! Messenger
Yahoo! Software Update

========================= Memory info: ===================================

Percentage of memory in use: 50%
Total physical RAM: 2813.69 MB
Available physical RAM: 1390.02 MB
Total Pagefile: 5865.89 MB
Available Pagefile: 4445.96 MB
Total Virtual: 2047.88 MB
Available Virtual: 1963.47 MB

========================= Partitions: =====================================

1 Drive c: () (Fixed) (Total:287.17 GB) (Free:6.61 GB) NTFS
2 Drive d: (RECOVERY) (Fixed) (Total:10.92 GB) (Free:1.79 GB) NTFS

========================= Users: ========================================

User accounts for \\KRISTEN-PC

Administrator Guest Kristen
Kristen_2


**** End of log ****

And now as you can see they aren't listed in the errors, but there are other files that are there that weren't before (this log can be found in my original post)

Please, please, please help. I'm desperate at this point, as I said I feel like the clock is ticking on this one...

Thanks in advance.
Peace&Love
Kristen

Attached Files



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:34 AM

Posted 04 September 2011 - 11:36 PM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

  • Do not run any other tool untill instructed to do so!
  • please Do not Attach logs or put in code boxes.
  • Tell me about any problems that have occurred during the fix.
  • Tell me of any other symptoms you may be having as these can help also.
  • Do not run anything while running a fix.
  • Do not run any other tool untill instructed to do so!


Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 Kristen.Love

Kristen.Love
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:08:34 AM

Posted 05 September 2011 - 02:40 AM

It found 2 Rootkits. One was Rootkit.ZeroAccess and the other one just said ROOTKIT. I actually had to run combofix twice, the first time it got past step 50, said some .dll wasn't found, started freaking out and was all "Access Denied!" like 5 times, then restarted to normal windows. So I ran it again and this time it ran through fine and here is the log:

ComboFix 11-09-04.03 - Kristen 09/05/2011 0:49.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2814.2173 [GMT -6:00]
Running from: c:\users\Kristen\pc n phone programs\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Kristen\Desktop\Security Protection.lnk
c:\windows\system32\c_77044.nls
c:\windows\system32\qnbwvoto.dll
.
Infected copy of c:\windows\system32\Drivers\dfsc.sys was found and disinfected
Restored copy from - The cat found it :)
Infected copy of c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe was found and disinfected
Restored copy from - c:\combofix\HarddiskVolumeShadowCopy3_!Program Files!Common Files!Apple!Mobile Device Support!AppleMobileDeviceService.exe
.
c:\users\Kristen\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe . . . is infected!!
.
Infected copy of c:\program files\Bonjour\mDNSResponder.exe was found and disinfected
Restored copy from - c:\combofix\HarddiskVolumeShadowCopy3_!Program Files!Bonjour!mDNSResponder.exe
.
Infected copy of c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe was found and disinfected
Restored copy from - c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
.
c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe . . . is infected!!
.
c:\program files\Flip Video\FlipShare\FlipShareService.exe . . . is infected!!
.
c:\program files\Flip Video\FlipShareServer\FlipShareServer.exe . . . is infected!!
.
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe . . . is infected!!
.
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe . . . is infected!!
.
c:\program files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe . . . is infected!!
.
c:\program files\Common Files\LightScribe\LSSrvc.exe . . . is infected!!
.
Infected copy of c:\windows\system32\nvvsvc.exe was found and disinfected
Restored copy from - c:\windows\System32\DriverStore\FileRepository\nvhm.inf_5d3a6405\nvvsvc.exe
.
c:\program files\SMINST\BLService.exe . . . is infected!!
.
Infected copy of c:\windows\system32\DRIVERS\xaudio.exe was found and disinfected
Restored copy from - c:\windows\System32\DriverStore\FileRepository\hpqherzm.inf_8705e467\XAudio.exe
.
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2011-08-05 to 2011-09-05 )))))))))))))))))))))))))))))))
.
.
2011-09-05 07:06 . 2011-09-05 07:08 -------- d-----w- c:\users\Kristen\AppData\Local\temp
2011-09-05 07:06 . 2011-09-05 07:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-05 06:46 . 2009-04-11 03:14 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-09-05 02:14 . 2011-09-05 02:14 -------- d-----w- c:\program files\Apple Software Update
2011-09-05 02:13 . 2011-09-05 02:13 -------- d-----w- c:\users\Kristen\AppData\Local\Mozilla
2011-09-05 02:11 . 2011-09-05 07:03 -------- d-----w- c:\program files\Bonjour
2011-09-04 10:14 . 2011-09-04 10:14 -------- d-----w- c:\users\Kristen\AppData\Local\VS Revo Group
2011-09-04 10:14 . 2009-12-30 17:21 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys
2011-09-04 10:14 . 2011-09-04 10:14 -------- d-----w- c:\program files\VS Revo Group
2011-09-04 09:27 . 2011-09-04 09:27 43408 --sha-w- c:\windows\system32\c_77044.nl_
2011-09-04 01:31 . 2011-09-04 09:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-09-03 12:29 . 2011-09-03 12:29 -------- d-----w- C:\32b4ef8b9086343f930000
2011-09-03 11:42 . 2011-09-03 11:42 -------- d-----w- c:\users\Kristen\AppData\Roaming\SUPERAntiSpyware.com
2011-09-03 11:42 . 2011-09-04 09:47 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-09-03 11:42 . 2011-09-03 11:42 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-09-03 10:01 . 2011-09-05 02:31 -------- d-----w- c:\program files\iTunes
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2011-09-03 09:57 . 2011-09-03 09:57 -------- d-----w- c:\program files\QuickTime
2011-09-03 09:53 . 2011-09-05 02:31 -------- d-----w- c:\program files\Common Files\Apple
2011-09-03 09:14 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-03 09:14 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-03 09:14 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-03 09:14 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-03 09:14 . 2010-06-28 20:32 50256 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-09-03 09:14 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2011-09-02 14:52 . 2011-09-02 14:52 -------- d-----w- c:\program files\CCleaner
2011-09-02 14:35 . 2011-09-02 14:35 -------- d-----w- c:\programdata\Malwarebytes
2011-09-02 13:56 . 2011-09-03 09:13 -------- d-----w- c:\programdata\Alwil Software
2011-09-02 13:56 . 2011-09-02 13:56 -------- d-----w- c:\program files\Alwil Software
2011-09-02 13:07 . 2011-09-02 13:07 -------- d--h--w- c:\programdata\Common Files
2011-09-02 13:03 . 2011-09-02 13:09 -------- d-----w- c:\programdata\MFAData
2011-09-02 09:55 . 2011-08-16 14:48 7152464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8D41CCCC-BC5C-4321-9525-7623E4B2E2CC}\mpengine.dll
2011-08-13 21:49 . 2011-08-13 21:49 -------- d-----w- c:\windows\Sun
2011-08-11 08:25 . 2011-06-17 20:13 905104 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-08-11 02:56 . 2011-08-11 02:56 -------- d-----w- c:\users\Kristen\AppData\Roaming\Flip Video
2011-08-11 02:55 . 2011-08-11 02:56 -------- d-----w- c:\programdata\Flip Video
2011-08-11 02:55 . 2011-08-11 02:55 -------- d-----w- c:\program files\Flip Video
2011-08-06 12:17 . 2011-08-06 18:46 -------- d-----w- c:\programdata\PopCap Games
2011-08-06 11:03 . 2002-05-08 09:09 274432 ----a-w- c:\windows\TLCUninstall.exe
2011-08-06 11:03 . 2011-08-06 11:03 -------- d-----w- c:\program files\The Learning Company
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-05 04:00 . 2011-06-05 21:16 66560 ----a-w- c:\windows\system32\drivers\smb.sys
2011-07-28 02:15 . 2011-07-28 02:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-07-12 17:20 . 2011-07-12 17:20 83816 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 17:20 . 2011-07-12 17:20 73064 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 17:20 . 2011-07-12 17:20 50536 ----a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 17:20 . 2011-07-12 17:20 178536 ----a-w- c:\windows\system32\dnssdX.dll
2011-07-06 00:37 . 2011-07-06 00:37 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-06 00:37 . 2011-07-06 00:37 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-06-11 02:55 . 2011-06-11 02:55 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-31 01:30 . 2011-09-05 02:13 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-06-10 399736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-11-15 218408]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-23 13797920]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-06 421888]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-6-25 113664]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Users^Kristen^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Kristen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 09:38 34672 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2008-10-09 14:58 75008 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
2008-09-30 23:56 972080 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-06-09 17:16 2363392 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 16:17 5252408 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-08-01 23:14 202032 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-06-10 23:12 399736 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]
R2 BackupService;BackupService;c:\users\Kristen\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe [x]
R2 FlipShareServer;FlipShare Server;c:\program files\Flip Video\FlipShareServer\FlipShareServer.exe [x]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [x]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [x]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 20080]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2009-03-30 66368]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-05-09 43040]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Kristen\AppData\Roaming\Mozilla\Firefox\Profiles\c5m9vy9x.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\SUPERAntiSpyware\SASSEH.DLL
Notify-!SASWinLogon - c:\program files\SUPERAntiSpyware\SASWINLO.DLL
MSConfigStartUp-Security Protection - c:\users\Kristen\AppData\Roaming\defender.exe
.
.
.
**************************************************************************
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files:
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1577775151-2128661079-328475723-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*L*Îd¹!]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1577775151-2128661079-328475723-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*L*Îd¹!\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1577775151-2128661079-328475723-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*L*Îd¹!]
@Allowed: (Read) (RestrictedCode)
"0"=hex:43,3a,5c,55,73,65,72,73,5c,4b,72,69,73,74,65,6e,5c,44,6f,77,6e,6c,6f,
61,64,73,5c,47,61,6d,65,2e,6f,66,2e,54,68,72,6f,6e,65,73,2e,53,30,31,45,30,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Alwil Software\Avast5\AvastUI.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\windows\system32\rundll32.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Completion time: 2011-09-05 01:13:29 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-05 07:13
.
Pre-Run: 9,686,528,000 bytes free
Post-Run: 9,440,477,184 bytes free
.
Current=1 Default=1 Failed=0 LastKnownGood=10 Sets=1,2,3,4,5,6,7,8,9,10
- - End Of File - - BAD9CDD6F29CED97CA8CE7887A3ED14E


Only problems left: Avast and iTunes are both screwed. They both claim to be uninstalled and are not. They both have folders in C:\Program Files and it says I don't have permission to access any of the files when I try deleting them. Even tried the FileAssassin built into MalwareBytes, it told me I didn't have permission. Also, what do I do about all those infected files up there in the logfile that weren't able to be replaced? The programs that I know of connected with them don't run.

All the redirecting is gone, MalwareBytes can run scans, Firefox is working fine... it's just those last few couple of issues.

Edited by Kristen.Love, 05 September 2011 - 02:48 AM.


#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:34 AM

Posted 05 September 2011 - 02:43 AM

Greetings

Good That cleaned up some bad guys but I see some other stuff that we need to go after, so I want you to run this custom script for me.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

File::
c:\windows\system32\c_77044.nl_


Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 Kristen.Love

Kristen.Love
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:08:34 AM

Posted 05 September 2011 - 04:30 AM

ComboFix 11-09-04.03 - Kristen 09/05/2011 2:47.3.2 - x86
Microsoft« Windows VistaÖ Home Premium 6.0.6002.2.1252.1.1033.18.2814.1518 [GMT -6:00]
Running from: c:\users\Kristen\pc n phone programs\ComboFix.exe
Command switches used :: c:\users\Kristen\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\c_77044.nl_"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\c_77044.nl_
.
.
((((((((((((((((((((((((( Files Created from 2011-08-05 to 2011-09-05 )))))))))))))))))))))))))))))))
.
.
2011-09-05 08:56 . 2011-09-05 08:56 -------- d-----w- c:\users\Kristen\AppData\Local\temp
2011-09-05 08:56 . 2011-09-05 08:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-05 08:40 . 2008-05-13 23:23 417792 ----a-w- c:\program files\Windows Media Player\Plugins\wmp_scrobbler.dll
2011-09-05 08:40 . 2011-09-05 08:40 -------- d-----w- c:\programdata\Last.fm
2011-09-05 08:39 . 2011-09-05 08:39 -------- d-----w- c:\program files\Last.fm
2011-09-05 08:30 . 2009-05-18 19:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-09-05 08:30 . 2008-04-17 18:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2011-09-05 08:29 . 2011-09-05 08:29 -------- d-----w- c:\program files\iPod
2011-09-05 08:28 . 2011-09-05 08:28 -------- d-----w- c:\program files\Apple Software Update
2011-09-05 08:27 . 2011-09-05 08:27 -------- d-----w- c:\program files\Bonjour
2011-09-05 08:27 . 2011-09-05 08:29 -------- d-----w- c:\program files\Common Files\Apple
2011-09-05 08:20 . 2011-07-04 11:36 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-05 08:17 . 2011-07-04 11:32 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-09-05 08:17 . 2011-07-04 11:36 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-09-05 08:16 . 2011-07-04 11:32 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-09-05 08:16 . 2011-07-04 11:35 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-09-05 08:16 . 2011-07-04 11:32 54104 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-09-05 08:15 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-09-05 08:15 . 2011-07-04 11:43 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-09-05 08:13 . 2011-09-05 08:13 -------- d-----w- c:\program files\Flip Video
2011-09-05 07:18 . 2011-09-05 07:18 -------- d-----w- c:\users\Kristen\AppData\Roaming\Malwarebytes
2011-09-05 07:18 . 2011-07-07 01:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-05 07:18 . 2011-07-07 01:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-05 06:46 . 2009-04-11 03:14 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys
2011-09-05 02:13 . 2011-09-05 02:13 -------- d-----w- c:\users\Kristen\AppData\Local\Mozilla
2011-09-04 10:14 . 2011-09-04 10:14 -------- d-----w- c:\users\Kristen\AppData\Local\VS Revo Group
2011-09-04 10:14 . 2009-12-30 17:21 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys
2011-09-04 10:14 . 2011-09-04 10:14 -------- d-----w- c:\program files\VS Revo Group
2011-09-04 01:31 . 2011-09-05 07:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-09-03 12:29 . 2011-09-03 12:29 -------- d-----w- C:\32b4ef8b9086343f930000
2011-09-03 11:42 . 2011-09-03 11:42 -------- d-----w- c:\users\Kristen\AppData\Roaming\SUPERAntiSpyware.com
2011-09-03 11:42 . 2011-09-04 09:47 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-09-03 11:42 . 2011-09-03 11:42 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-09-03 10:01 . 2011-09-05 07:30 -------- d-----w- c:\program files\iTunes
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2011-09-03 09:58 . 2011-09-03 09:58 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2011-09-03 09:57 . 2011-09-03 09:57 -------- d-----w- c:\program files\QuickTime
2011-09-02 14:52 . 2011-09-02 14:52 -------- d-----w- c:\program files\CCleaner
2011-09-02 14:35 . 2011-09-02 14:35 -------- d-----w- c:\programdata\Malwarebytes
2011-09-02 13:56 . 2011-09-03 09:13 -------- d-----w- c:\programdata\Alwil Software
2011-09-02 13:56 . 2011-09-05 08:15 -------- d-----w- c:\program files\Alwil Software
2011-09-02 13:07 . 2011-09-02 13:07 -------- d--h--w- c:\programdata\Common Files
2011-09-02 13:03 . 2011-09-02 13:09 -------- d-----w- c:\programdata\MFAData
2011-09-02 09:55 . 2011-08-16 14:48 7152464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8D41CCCC-BC5C-4321-9525-7623E4B2E2CC}\mpengine.dll
2011-08-13 21:49 . 2011-08-13 21:49 -------- d-----w- c:\windows\Sun
2011-08-11 08:25 . 2011-06-17 20:13 905104 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-08-11 02:56 . 2011-08-11 02:56 -------- d-----w- c:\users\Kristen\AppData\Roaming\Flip Video
2011-08-11 02:55 . 2011-08-11 02:56 -------- d-----w- c:\programdata\Flip Video
2011-08-06 12:17 . 2011-08-06 18:46 -------- d-----w- c:\programdata\PopCap Games
2011-08-06 11:03 . 2002-05-08 09:09 274432 ----a-w- c:\windows\TLCUninstall.exe
2011-08-06 11:03 . 2011-08-06 11:03 -------- d-----w- c:\program files\The Learning Company
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-05 04:00 . 2011-06-05 21:16 66560 ----a-w- c:\windows\system32\drivers\smb.sys
2011-07-28 02:15 . 2011-07-28 02:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-07-12 17:20 . 2011-07-12 17:20 83816 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 17:20 . 2011-07-12 17:20 73064 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 17:20 . 2011-07-12 17:20 50536 ----a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 17:20 . 2011-07-12 17:20 178536 ----a-w- c:\windows\system32\dnssdX.dll
2011-07-06 00:37 . 2011-07-06 00:37 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-06 00:37 . 2011-07-06 00:37 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-06-11 02:55 . 2011-06-11 02:55 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-31 01:30 . 2011-09-05 02:13 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2010-06-28 20:58 81072 ------w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-06-10 399736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-11-15 218408]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-23 13797920]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-06 421888]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]
"iTunesHelper"="c:\program files\iTunes2\iTunesHelper.exe" [2011-08-19 421736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"aswAhAScr.dll"="c:\program files\Alwil Software\Avast5\aswRegSvr.exe" [2010-06-28 22016]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-6-25 113664]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Users^Kristen^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Kristen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 09:38 34672 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2008-10-09 14:58 75008 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
2008-09-30 23:56 972080 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 16:17 5252408 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-08-01 23:14 202032 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-06-10 23:12 399736 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
R1 aswSnx;aswSnx; [x]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]
R2 BackupService;BackupService;c:\users\Kristen\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe [x]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [x]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [x]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]
R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 20080]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-07-04 54104]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2009-03-30 66368]
S2 FlipShareServer;FlipShare Server;c:\program files\Flip Video\FlipShareServer\FlipShareServer.exe [2011-05-06 1085440]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-05-09 43040]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWMONFLT
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Kristen\AppData\Roaming\Mozilla\Firefox\Profiles\c5m9vy9x.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-LightScribe Control Panel - c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-05 02:56
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1577775151-2128661079-328475723-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*L*╬d╣!]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1577775151-2128661079-328475723-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*L*╬d╣!\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1577775151-2128661079-328475723-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*L*╬d╣!]
@Allowed: (Read) (RestrictedCode)
"0"=hex:43,3a,5c,55,73,65,72,73,5c,4b,72,69,73,74,65,6e,5c,44,6f,77,6e,6c,6f,
61,64,73,5c,47,61,6d,65,2e,6f,66,2e,54,68,72,6f,6e,65,73,2e,53,30,31,45,30,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-09-05 02:58:41
ComboFix-quarantined-files.txt 2011-09-05 08:58
ComboFix2.txt 2011-09-05 07:13
.
Pre-Run: 9,590,751,232 bytes free
Post-Run: 9,764,110,336 bytes free
.
- - End Of File - - 88EA762E8E733686613156B9FFCFBBB7


Got iTunes reinstalled by calling the installation directory iTunes2, but I still have the other directory with its files and can't delete it. Otherwise it's working great. You're a lifesaver :D

#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:34 AM

Posted 05 September 2011 - 04:54 AM

Please do the following:

Step One
Please download Junction.zip and save it to your desktop.
Unzip it and extract junction.exe to your C:\ drive.

Step Two
Now copy (Ctrl +C) and paste (Ctrl +V) the text inside the code box below into Notepad.

@ECHO OFF
cd c:\
junction -s c:\>log.txt
start log.txt
del %0
Save it to your desktop as File name: junc.bat
Save as type: All Files

Step Three
Double click junc.bat to run it. A log will be presented. Copy and paste or attach the content of the log in your next reply.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 Kristen.Love

Kristen.Love
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:08:34 AM

Posted 05 September 2011 - 03:22 PM

I get an error that flashes up on the screen just for half a second when I try to run the batch file (and I tried doing all the steps three different times to make sure it wasn't something I was doing). I managed to get a prtscrn of the error message, it's attached.

Attached Files



#8 Kristen.Love

Kristen.Love
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:08:34 AM

Posted 05 September 2011 - 11:39 PM

Also I should say, I ran a really hardcore scan of my computer with Avast, and it's coming up with a lot of Trojans and Rootkits in my system still, some of which it doesn't have permission to remove.

The ones it found are:
Win32:Alureon-AJI7(Rtk)
Win32:Patched-WQ (Trj)
Win32:Tiny-AMB (Rtk)
Win32:Sirefef-F (Drp)
JS:Pdfka-gen (Expl)
Java:Agent-AP (Trj)
PDF:CVE-2010-0188 (Expl)

and it claims it put everything in the virus chest except the very first one.

#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:34 AM

Posted 06 September 2011 - 07:52 AM

is the junction.exe on the C drive?


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 Kristen.Love

Kristen.Love
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:08:34 AM

Posted 06 September 2011 - 09:52 PM

Yes.

I see a log file there and it says:

"
Junction v1.06 - Windows junction creator and reparse point viewer
Copyright © 2000-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

\\?\c:\\Documents and Settings: JUNCTION
Print Name : C:\Users
Substitute Name: C:\Users


Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process.


...

...

...

...

...

...

...

...

...

...

."

#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:34 AM

Posted 07 September 2011 - 08:44 AM

Hello

Please save this file to your desktop. Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK.

"%userprofile%\desktop\win32kdiag.exe" -f -r

When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 Kristen.Love

Kristen.Love
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:08:34 AM

Posted 07 September 2011 - 10:11 PM

As soon as I run the command for the program I get the little black box but then Windows pops up and says the program has stopped responding, does its little searching for a solution thing, then says I have to close the program. However the program hasn't stopped responding. If I click on the window the little cursor flashes and I can scroll up and down, I just can't do anything until I close the Windows error box. And as soon as I do that it shuts down the program. So there isn't a log. I tried this maybe 20 times, always the same result.

#13 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:34 AM

Posted 07 September 2011 - 10:21 PM

Hello


so the place we are at now is that we can't remove some files for Itunes correct


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#14 Kristen.Love

Kristen.Love
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:08:34 AM

Posted 09 September 2011 - 11:22 PM

Yes, and I apparently still have one rootkit that avast is finding "Win32:Alureon-AJI7(Rtk)" but cannot remove due to inadequate privileges.

#15 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:34 AM

Posted 09 September 2011 - 11:52 PM

does it tell you lacation because that is very important


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users