Essexboy
Just run Combofix it should not make a problem 
Spyware / Malware / Virus Removal
[Resolved] Malware/Trojans crippling PC
54 min read
Ae3
Double Clicked combofix and i got this Mcafee alert
"Potentially Unwanted Program Detected"
"McAfee has blocked a potentially unwanted program (PUP) on your computer. If you do not recognize it, we recommend that you remove the program.
About this Potentially Unwanted Program
Name: RemAdm-ProcLaunch!171
Location: C:\32788R22FWJFW\psexec.cfexe
Spyware, adware, and other potentially unwanted programs can harm your computer, compromise its security, and damage valuable files."
Options are remove or allow
Essexboy
Allow them otherwise Combofix will not work
Essexboy
Also do you connect to the router by ethernet (cable) or wirelessly
Ae3
fyi…I got that RUNDLL error again while combofix ran, i clicked OK .
Here is the Combofix log:
ComboFix 09-03-14.02 - HP_Administrator 2009-03-15 15:53:44.1 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\HP_Administrator\Application Data\WeatherDPA
c:\documents and settings\HP_Administrator\Application Data\WeatherDPA\Weather\WeatherStartup.xml
c:\windows\IE4 Error Log.txt
c:\windows\system32\init32.exe
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_netlogonehsched
——-\Service_netlogonehsched
——-\Service_System
((((((((((((((((((((((((( Files Created from 2009-02-15 to 2009-03-15 )))))))))))))))))))))))))))))))
.
2009-03-15 13:52 . 2009-03-15 13:52 d——– C:\_OTListIt
2009-03-15 11:40 . 2009-03-15 11:40 d——– c:\program files\Malwarebytes' Anti-Malware
2009-03-15 11:40 . 2009-03-15 11:40 d——– c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2009-03-15 11:40 . 2009-03-15 11:40 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-15 11:40 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-15 11:40 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-03-14 17:56 . 2009-03-14 17:56 d——– c:\program files\ERUNT
2009-03-10 18:18 . 2009-03-15 15:58 10,805 –a—— c:\windows\system32\Config.MPF
2009-03-10 18:17 . 2006-03-03 08:07 143,360 –a—— c:\windows\system32\dunzip32.dll
2009-03-10 18:13 . 2007-11-22 06:44 201,320 –a—— c:\windows\system32\drivers\mfehidk.sys
2009-03-10 18:13 . 2007-07-13 06:20 113,952 –a—— c:\windows\system32\drivers\Mpfp.sys
2009-03-10 18:13 . 2007-11-22 06:44 79,304 –a—— c:\windows\system32\drivers\mfeavfk.sys
2009-03-10 18:13 . 2007-12-02 12:51 40,488 –a—— c:\windows\system32\drivers\mfesmfk.sys
2009-03-10 18:13 . 2007-11-22 06:44 35,240 –a—— c:\windows\system32\drivers\mfebopk.sys
2009-03-10 18:13 . 2007-11-22 06:44 33,832 –a—— c:\windows\system32\drivers\mferkdk.sys
2009-03-10 18:12 . 2009-03-10 18:12 d——– c:\program files\McAfee.com
2009-03-10 18:12 . 2009-03-10 18:13 d——– c:\program files\Common Files\McAfee
2009-03-10 18:11 . 2009-03-11 07:26 d——– c:\program files\McAfee
2009-03-10 17:28 . 2009-03-10 18:18 d——– c:\documents and settings\All Users\Application Data\McAfee
2009-03-09 22:49 . 2009-03-09 22:49 d——– c:\documents and settings\All Users\Application Data\Ascentive
2009-03-09 22:38 . 2009-03-10 17:57 d——– c:\program files\Ascentive
2009-03-09 22:38 . 2008-08-20 17:44 45,056 –a—— c:\windows\system32\CreateLog.dll
2009-03-09 22:38 . 2007-07-03 11:48 20,480 –a—— c:\windows\system32\SysRestore.dll
2009-03-09 21:53 . 2009-03-15 16:01 81,390 –a—— c:\windows\system32\drivers\eccfd102.sys
2009-03-09 18:18 . 2009-03-10 17:59 d——– c:\documents and settings\HP_Administrator\Application Data\Lavasoft
2009-03-07 20:06 . 2009-03-07 20:06 d——– c:\documents and settings\All Users\Application Data\NeptunesAdve
2009-03-07 20:05 . 2009-03-07 21:10 d——– c:\program files\IncrediGames
2009-03-07 20:05 . 2009-03-07 20:05 d——– c:\program files\Common Files\Oberon Media
2009-03-05 01:15 . 2009-03-05 01:15 d——– c:\documents and settings\HP_Administrator\Application Data\Gold Casual Games
2009-03-05 01:15 . 2009-03-05 01:15 d——– c:\documents and settings\All Users\Application Data\Gold Casual Games
2009-03-04 00:11 . 2009-03-04 00:11 d——– c:\documents and settings\All Users\Application Data\FireGlow
2009-03-02 18:42 . 2009-03-02 18:47 d——– c:\documents and settings\HP_Administrator\Application Data\Ancient Quest of Saqqarah__bfg
2009-03-01 19:35 . 2009-03-01 19:36 d——– c:\program files\Solitaire Cruise
2009-02-28 21:41 . 2009-02-28 21:41 d——– c:\documents and settings\HP_Administrator\Application Data\Dreamsdwell Stories
2009-02-24 20:26 . 2009-02-24 20:26 d——– c:\documents and settings\HP_Administrator\Application Data\Artogon
2009-02-22 16:55 . 2009-02-22 16:55 d——– c:\documents and settings\All Users\Application Data\Big Fish Games Vancouver
2009-02-19 11:37 . 2009-02-19 11:37 d——– c:\documents and settings\HP_Administrator\Application Data\ViquaSoft
2009-02-19 10:32 . 2009-02-19 10:32 d——– c:\documents and settings\All Users\Application Data\PrettyGoodGames
2009-02-18 19:30 . 2009-02-18 19:30 d——– c:\documents and settings\All Users\Application Data\HoverBee Studios
2009-02-17 21:42 . 2009-02-17 21:43 d——– c:\program files\Dream Vacation Solitaire
2009-02-17 09:21 . 2009-02-17 09:21 d——– c:\documents and settings\All Users\Application Data\HipSoft
2009-02-17 08:41 . 2009-02-17 08:41 1,409 –a—— c:\windows\system32\tmpC1FDE.FOT
2009-02-17 08:41 . 2009-02-17 08:41 1,409 –a—— c:\windows\system32\tmp8BFDE.FOT
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-15 15:20 ——— d—–w c:\program files\Yahoo!
2009-03-15 15:19 ——— d—–w c:\program files\Ahead
2009-03-15 15:16 ——— d—–w c:\program files\Common Files\AOL
2009-03-15 15:16 ——— d—–w c:\documents and settings\All Users\Application Data\AOL
2009-03-15 00:19 ——— d—–w c:\program files\Trend Micro
2009-03-14 03:58 ——— d—–w c:\program files\Musicmatch
2009-03-14 03:56 ——— d–h–w c:\program files\InstallShield Installation Information
2009-03-14 03:53 ——— d—–w c:\program files\Common Files\Adobe
2009-03-13 04:25 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-11 13:23 ——— d—–w c:\program files\Lexmark 3100 Series
2009-03-11 01:12 ——— d—–w c:\program files\BitTorrent
2009-03-10 21:34 33,280 —-a-w c:\program files\bpxogo1.tmp
2009-03-08 02:07 ——— d—–w c:\program files\Oberon Media
2009-03-06 01:38 ——— d—–w c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-02-22 02:59 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Friday's games
2009-02-15 00:00 ——— d—–w c:\program files\Fairway Solitaire
2009-02-14 03:25 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\BVS Solitaire Collection
2009-02-12 07:15 ——— d—–w c:\program files\Waterscape Solitaire - American Falls
2009-02-11 03:21 ——— d—–w c:\program files\Yahoo! Games
2009-02-07 23:58 ——— d—–w c:\documents and settings\All Users\Application Data\GameXzone
2009-02-04 15:11 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Jetsetter
2009-02-04 05:18 ——— d—–w c:\program files\Brickshooter Egypt
2009-02-02 23:26 ——— d—–w c:\program files\Common Files\SWF Studio
2009-01-30 03:46 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\RobinsonCrusoe
2009-01-30 01:00 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\URSE Games
2009-01-28 05:26 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Island
2009-01-28 05:04 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Sahmon Games
2009-01-27 22:38 ——— d—–w c:\documents and settings\All Users\Application Data\Playrix Entertainment
2009-01-27 16:47 ——— d—–w c:\documents and settings\All Users\Application Data\MumboJumbo
2009-01-26 22:40 ——— d—–w c:\documents and settings\All Users\Application Data\EA
2009-01-24 23:52 ——— d—–w c:\documents and settings\All Users\Application Data\Rumbic Studio
2009-01-21 01:40 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Meridian93
2009-01-17 03:40 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\JewelMatch2
2009-01-17 00:49 ——— d—–w c:\documents and settings\All Users\Application Data\Gogii
2008-07-21 20:55 110,232 —-a-w c:\documents and settings\HP_Administrator\Application Data\GDIPFONTCACHEV1.DAT
2006-02-09 01:36 178 —-a-w c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
2005-11-03 00:38 22 –sha-w c:\windows\SMINST\HPCD.sys
.
——- Sigcheck ——-
2009-03-14 19:20 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\system32\svchost.exe
2009-03-10 17:58 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\system32\dllcache\svchost.exe
2005-03-02 13:19 577024 1800f293bccc8ede8a70e12b88d80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
2004-08-10 14:00 577024 c72661f8552ace7c5c85e16a3cf505c4 c:\windows\$NtUninstallKB890859$\user32.dll
2005-03-02 13:09 577024 de2db164bbb35db061af0997e4499054 c:\windows\system32\user32.dll
2005-03-02 13:09 577024 de2db164bbb35db061af0997e4499054 c:\windows\system32\dllcache\user32.dll
2004-08-10 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\system32\ws2_32.dll
2004-08-10 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\system32\dllcache\ws2_32.dll
2005-05-02 22:57 658944 e1e18136f9dd3df1ad9c82193a5898a6 c:\windows\$hf_mig$\KB883939\SP2QFE\wininet.dll
2005-09-02 18:53 660480 97a6fd7cafd688cf2c78939ebaf0cd0c c:\windows\$hf_mig$\KB896688\SP2QFE\wininet.dll
2004-08-10 14:00 656384 c0823fc5469663ba63e7db88f9919d70 c:\windows\$NtUninstallKB883939$\wininet.dll
2005-05-02 22:52 657920 1a078af3f85d10ba56444c23b3a18e74 c:\windows\$NtUninstallKB896688$\wininet.dll
2005-09-02 18:52 658432 af61ebb1f550175eff406d545d6ab086 c:\windows\system32\wininet.dll
2005-09-02 18:52 658432 af61ebb1f550175eff406d545d6ab086 c:\windows\system32\dllcache\wininet.dll
2005-03-14 03:17 359936 6129e70f3d2f1e60860c930ebeaf92c2 c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2004-08-10 14:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB893066$\tcpip.sys
2005-03-14 02:55 359808 1898df9a9d550da97c2ed41ae3c76a25 c:\windows\system32\dllcache\tcpip.sys
2005-03-14 02:55 359808 1898df9a9d550da97c2ed41ae3c76a25 c:\windows\system32\drivers\tcpip.sys
2004-08-10 14:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\system32\winlogon.exe
2004-08-10 14:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\system32\dllcache\winlogon.exe
2004-08-10 14:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\dllcache\ndis.sys
2004-08-10 14:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\drivers\ndis.sys
2004-08-10 14:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\dllcache\ip6fw.sys
2004-08-10 14:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\drivers\ip6fw.sys
2005-03-01 19:36 2056832 d8aba3eab509627e707a3b14f00fbb6b c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2004-08-04 07:59 2015232 fb142b7007ca2eea76966c6c5cc12150 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
2005-03-01 19:34 2056832 81013f36b21c7f72cf784cc6731e0002 c:\windows\Driver Cache\i386\ntkrnlpa.exe
2005-03-01 19:34 2015232 3cd941e472ddf3534e53038535719771 c:\windows\system32\ntkrnlpa.exe
2005-03-01 20:04 2179456 28187802b7c368c0d3aef7d4c382aabb c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2004-08-04 08:18 2148352 626309040459c3915997ef98ec1c8d40 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
2005-03-01 19:59 2179328 4d4cf2c14550a4b7718e94a6e581856e c:\windows\Driver Cache\i386\ntoskrnl.exe
2005-03-01 19:57 2135552 48b3e89af7074cee0314a3e0c7faffdb c:\windows\system32\ntoskrnl.exe
2004-08-10 14:00 1032192 a0732187050030ae399b241436565e64 c:\windows\explorer.exe
2004-08-10 14:00 1032192 a0732187050030ae399b241436565e64 c:\windows\system32\dllcache\explorer.exe
2004-08-10 14:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\system32\services.exe
2004-08-10 14:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\system32\dllcache\services.exe
2004-08-10 14:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\system32\lsass.exe
2004-08-10 14:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\system32\dllcache\lsass.exe
2004-08-10 14:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\system32\ctfmon.exe
2004-08-10 14:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\system32\dllcache\ctfmon.exe
2005-06-10 19:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2004-08-10 14:00 57856 7435b108b935e42ea92ca94f59c8e717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
2005-06-10 18:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\system32\spoolsv.exe
2005-06-10 18:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\system32\dllcache\spoolsv.exe
2004-08-10 07:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\system32\userinit.exe
2004-08-10 07:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\system32\dllcache\userinit.exe
2004-08-10 14:00 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\$NtUninstallKB895961$\termsrv.dll
2005-03-10 02:49 295424 c29a5286e64d97385178452d5f307b98 c:\windows\system32\termsrv.dll
2005-03-10 02:49 295424 c29a5286e64d97385178452d5f307b98 c:\windows\system32\dllcache\termsrv.dll
2004-08-10 14:00 983552 888190e31455fad793312f8d087146eb c:\windows\system32\kernel32.dll
2004-08-10 14:00 983552 888190e31455fad793312f8d087146eb c:\windows\system32\dllcache\kernel32.dll
2004-08-10 14:00 17408 1b5f6923abb450692e9fe0672c897aed c:\windows\system32\powrprof.dll
2004-08-10 14:00 17408 1b5f6923abb450692e9fe0672c897aed c:\windows\system32\dllcache\powrprof.dll
2004-08-10 14:00 110080 87ca7ce6469577f059297b9d6556d66d c:\windows\system32\imm32.dll
2004-08-10 14:00 110080 87ca7ce6469577f059297b9d6556d66d c:\windows\system32\dllcache\imm32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-07 344064]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"SMSERIAL"="sm56hlpr.exe" [2005-01-24 c:\windows\sm56hlpr.exe]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Planner Reminders Tray Icon.lnk - c:\program files\Sierra\Planner\Plnrnote.exe [2006-12-24 184320]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 282624]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\program files\ffdshow\ffdshow.ax
"vidc.xvid"= xvid.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
R1 b393a234;b393a234; [x]
R1 b9f2003d;b9f2003d; [x]
R1 d3ff6419;d3ff6419; [x]
R1 e1900400;e1900400; [x]
R3 Winkr53;Winkr53; [x]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
— Other Services/Drivers In Memory —
*NewlyCreated* - helpsvc
*Deregistered* - AFD
*Deregistered* - Apple Mobile Device
*Deregistered* - Arp1394
*Deregistered* - Ati HotKey Poller
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - Cdfs
*Deregistered* - DcomLaunch
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - Fastfat
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - iaStor
*Deregistered* - ImapiService
*Deregistered* - IntelIde
*Deregistered* - IpFilterDriver
*Deregistered* - IpNat
*Deregistered* - iPod Service
*Deregistered* - IPSec
*Deregistered* - KSecDD
*Deregistered* - LexBceS
*Deregistered* - mcmscsvc
*Deregistered* - mcnasvc
*Deregistered* - mcproxy
*Deregistered* - mcshield
*Deregistered* - mcsysmon
*Deregistered* - MDM
*Deregistered* - mfeavfk
*Deregistered* - mfebopk
*Deregistered* - mfehidk
*Deregistered* - mfesmfk
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - mpfp
*Deregistered* - mpfservice
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Spooler
*Deregistered* - sptd
*Deregistered* - sr
*Deregistered* - swenum
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - ViaIde
*Deregistered* - VolSnap
*Deregistered* - Wanarp
*Deregistered* - X4HSX32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
sromeg
priocukm
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{369505d2-4bcb-11da-b4b8-806d6172696f}]
\shell\autorun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{faf34d90-4bd4-11da-b4bd-0013d4c27b29}]
\Shell\AutoRun\command - J:\LaunchU3.exe
.
Contents of the 'Scheduled Tasks' folder
2009-03-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-03-10 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
2009-03-10 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Exobenoguq - c:\windows\ugetaxuh.dll
SafeBoot-Winkr53.sys
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://mystart.magentic.com/english/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\t2f2tpvr.Default User\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://mystart.magentic.com/?loc=FF_Magentic_AddressBar&search=
FF - plugin: c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\t2f2tpvr.Default User\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\GameTap\bin\Release\npgametaptool.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-15 16:00:37
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\eccfd102]
"ImagePath"="\SystemRoot\System32\drivers\eccfd102.sys"
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(620)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\LEXBCES.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\LEXPPS.EXE
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MpfSrv.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
.
**************************************************************************
.
Completion time: 2009-03-15 16:05:26 - machine was rebooted [HP_Administrator]
ComboFix-quarantined-files.txt 2009-03-15 21:05:10
Pre-Run: 86,028,865,536 bytes free
Post-Run: 85,927,911,424 bytes free
374
Here is the Combofix log:
ComboFix 09-03-14.02 - HP_Administrator 2009-03-15 15:53:44.1 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\HP_Administrator\Application Data\WeatherDPA
c:\documents and settings\HP_Administrator\Application Data\WeatherDPA\Weather\WeatherStartup.xml
c:\windows\IE4 Error Log.txt
c:\windows\system32\init32.exe
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_netlogonehsched
——-\Service_netlogonehsched
——-\Service_System
((((((((((((((((((((((((( Files Created from 2009-02-15 to 2009-03-15 )))))))))))))))))))))))))))))))
.
2009-03-15 13:52 . 2009-03-15 13:52 d——– C:\_OTListIt
2009-03-15 11:40 . 2009-03-15 11:40 d——– c:\program files\Malwarebytes' Anti-Malware
2009-03-15 11:40 . 2009-03-15 11:40 d——– c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2009-03-15 11:40 . 2009-03-15 11:40 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-15 11:40 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-15 11:40 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-03-14 17:56 . 2009-03-14 17:56 d——– c:\program files\ERUNT
2009-03-10 18:18 . 2009-03-15 15:58 10,805 –a—— c:\windows\system32\Config.MPF
2009-03-10 18:17 . 2006-03-03 08:07 143,360 –a—— c:\windows\system32\dunzip32.dll
2009-03-10 18:13 . 2007-11-22 06:44 201,320 –a—— c:\windows\system32\drivers\mfehidk.sys
2009-03-10 18:13 . 2007-07-13 06:20 113,952 –a—— c:\windows\system32\drivers\Mpfp.sys
2009-03-10 18:13 . 2007-11-22 06:44 79,304 –a—— c:\windows\system32\drivers\mfeavfk.sys
2009-03-10 18:13 . 2007-12-02 12:51 40,488 –a—— c:\windows\system32\drivers\mfesmfk.sys
2009-03-10 18:13 . 2007-11-22 06:44 35,240 –a—— c:\windows\system32\drivers\mfebopk.sys
2009-03-10 18:13 . 2007-11-22 06:44 33,832 –a—— c:\windows\system32\drivers\mferkdk.sys
2009-03-10 18:12 . 2009-03-10 18:12 d——– c:\program files\McAfee.com
2009-03-10 18:12 . 2009-03-10 18:13 d——– c:\program files\Common Files\McAfee
2009-03-10 18:11 . 2009-03-11 07:26 d——– c:\program files\McAfee
2009-03-10 17:28 . 2009-03-10 18:18 d——– c:\documents and settings\All Users\Application Data\McAfee
2009-03-09 22:49 . 2009-03-09 22:49 d——– c:\documents and settings\All Users\Application Data\Ascentive
2009-03-09 22:38 . 2009-03-10 17:57 d——– c:\program files\Ascentive
2009-03-09 22:38 . 2008-08-20 17:44 45,056 –a—— c:\windows\system32\CreateLog.dll
2009-03-09 22:38 . 2007-07-03 11:48 20,480 –a—— c:\windows\system32\SysRestore.dll
2009-03-09 21:53 . 2009-03-15 16:01 81,390 –a—— c:\windows\system32\drivers\eccfd102.sys
2009-03-09 18:18 . 2009-03-10 17:59 d——– c:\documents and settings\HP_Administrator\Application Data\Lavasoft
2009-03-07 20:06 . 2009-03-07 20:06 d——– c:\documents and settings\All Users\Application Data\NeptunesAdve
2009-03-07 20:05 . 2009-03-07 21:10 d——– c:\program files\IncrediGames
2009-03-07 20:05 . 2009-03-07 20:05 d——– c:\program files\Common Files\Oberon Media
2009-03-05 01:15 . 2009-03-05 01:15 d——– c:\documents and settings\HP_Administrator\Application Data\Gold Casual Games
2009-03-05 01:15 . 2009-03-05 01:15 d——– c:\documents and settings\All Users\Application Data\Gold Casual Games
2009-03-04 00:11 . 2009-03-04 00:11 d——– c:\documents and settings\All Users\Application Data\FireGlow
2009-03-02 18:42 . 2009-03-02 18:47 d——– c:\documents and settings\HP_Administrator\Application Data\Ancient Quest of Saqqarah__bfg
2009-03-01 19:35 . 2009-03-01 19:36 d——– c:\program files\Solitaire Cruise
2009-02-28 21:41 . 2009-02-28 21:41 d——– c:\documents and settings\HP_Administrator\Application Data\Dreamsdwell Stories
2009-02-24 20:26 . 2009-02-24 20:26 d——– c:\documents and settings\HP_Administrator\Application Data\Artogon
2009-02-22 16:55 . 2009-02-22 16:55 d——– c:\documents and settings\All Users\Application Data\Big Fish Games Vancouver
2009-02-19 11:37 . 2009-02-19 11:37 d——– c:\documents and settings\HP_Administrator\Application Data\ViquaSoft
2009-02-19 10:32 . 2009-02-19 10:32 d——– c:\documents and settings\All Users\Application Data\PrettyGoodGames
2009-02-18 19:30 . 2009-02-18 19:30 d——– c:\documents and settings\All Users\Application Data\HoverBee Studios
2009-02-17 21:42 . 2009-02-17 21:43 d——– c:\program files\Dream Vacation Solitaire
2009-02-17 09:21 . 2009-02-17 09:21 d——– c:\documents and settings\All Users\Application Data\HipSoft
2009-02-17 08:41 . 2009-02-17 08:41 1,409 –a—— c:\windows\system32\tmpC1FDE.FOT
2009-02-17 08:41 . 2009-02-17 08:41 1,409 –a—— c:\windows\system32\tmp8BFDE.FOT
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-15 15:20 ——— d—–w c:\program files\Yahoo!
2009-03-15 15:19 ——— d—–w c:\program files\Ahead
2009-03-15 15:16 ——— d—–w c:\program files\Common Files\AOL
2009-03-15 15:16 ——— d—–w c:\documents and settings\All Users\Application Data\AOL
2009-03-15 00:19 ——— d—–w c:\program files\Trend Micro
2009-03-14 03:58 ——— d—–w c:\program files\Musicmatch
2009-03-14 03:56 ——— d–h–w c:\program files\InstallShield Installation Information
2009-03-14 03:53 ——— d—–w c:\program files\Common Files\Adobe
2009-03-13 04:25 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-11 13:23 ——— d—–w c:\program files\Lexmark 3100 Series
2009-03-11 01:12 ——— d—–w c:\program files\BitTorrent
2009-03-10 21:34 33,280 —-a-w c:\program files\bpxogo1.tmp
2009-03-08 02:07 ——— d—–w c:\program files\Oberon Media
2009-03-06 01:38 ——— d—–w c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-02-22 02:59 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Friday's games
2009-02-15 00:00 ——— d—–w c:\program files\Fairway Solitaire
2009-02-14 03:25 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\BVS Solitaire Collection
2009-02-12 07:15 ——— d—–w c:\program files\Waterscape Solitaire - American Falls
2009-02-11 03:21 ——— d—–w c:\program files\Yahoo! Games
2009-02-07 23:58 ——— d—–w c:\documents and settings\All Users\Application Data\GameXzone
2009-02-04 15:11 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Jetsetter
2009-02-04 05:18 ——— d—–w c:\program files\Brickshooter Egypt
2009-02-02 23:26 ——— d—–w c:\program files\Common Files\SWF Studio
2009-01-30 03:46 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\RobinsonCrusoe
2009-01-30 01:00 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\URSE Games
2009-01-28 05:26 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Island
2009-01-28 05:04 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Sahmon Games
2009-01-27 22:38 ——— d—–w c:\documents and settings\All Users\Application Data\Playrix Entertainment
2009-01-27 16:47 ——— d—–w c:\documents and settings\All Users\Application Data\MumboJumbo
2009-01-26 22:40 ——— d—–w c:\documents and settings\All Users\Application Data\EA
2009-01-24 23:52 ——— d—–w c:\documents and settings\All Users\Application Data\Rumbic Studio
2009-01-21 01:40 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Meridian93
2009-01-17 03:40 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\JewelMatch2
2009-01-17 00:49 ——— d—–w c:\documents and settings\All Users\Application Data\Gogii
2008-07-21 20:55 110,232 —-a-w c:\documents and settings\HP_Administrator\Application Data\GDIPFONTCACHEV1.DAT
2006-02-09 01:36 178 —-a-w c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
2005-11-03 00:38 22 –sha-w c:\windows\SMINST\HPCD.sys
.
——- Sigcheck ——-
2009-03-14 19:20 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\system32\svchost.exe
2009-03-10 17:58 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\system32\dllcache\svchost.exe
2005-03-02 13:19 577024 1800f293bccc8ede8a70e12b88d80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
2004-08-10 14:00 577024 c72661f8552ace7c5c85e16a3cf505c4 c:\windows\$NtUninstallKB890859$\user32.dll
2005-03-02 13:09 577024 de2db164bbb35db061af0997e4499054 c:\windows\system32\user32.dll
2005-03-02 13:09 577024 de2db164bbb35db061af0997e4499054 c:\windows\system32\dllcache\user32.dll
2004-08-10 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\system32\ws2_32.dll
2004-08-10 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\system32\dllcache\ws2_32.dll
2005-05-02 22:57 658944 e1e18136f9dd3df1ad9c82193a5898a6 c:\windows\$hf_mig$\KB883939\SP2QFE\wininet.dll
2005-09-02 18:53 660480 97a6fd7cafd688cf2c78939ebaf0cd0c c:\windows\$hf_mig$\KB896688\SP2QFE\wininet.dll
2004-08-10 14:00 656384 c0823fc5469663ba63e7db88f9919d70 c:\windows\$NtUninstallKB883939$\wininet.dll
2005-05-02 22:52 657920 1a078af3f85d10ba56444c23b3a18e74 c:\windows\$NtUninstallKB896688$\wininet.dll
2005-09-02 18:52 658432 af61ebb1f550175eff406d545d6ab086 c:\windows\system32\wininet.dll
2005-09-02 18:52 658432 af61ebb1f550175eff406d545d6ab086 c:\windows\system32\dllcache\wininet.dll
2005-03-14 03:17 359936 6129e70f3d2f1e60860c930ebeaf92c2 c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2004-08-10 14:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB893066$\tcpip.sys
2005-03-14 02:55 359808 1898df9a9d550da97c2ed41ae3c76a25 c:\windows\system32\dllcache\tcpip.sys
2005-03-14 02:55 359808 1898df9a9d550da97c2ed41ae3c76a25 c:\windows\system32\drivers\tcpip.sys
2004-08-10 14:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\system32\winlogon.exe
2004-08-10 14:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\system32\dllcache\winlogon.exe
2004-08-10 14:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\dllcache\ndis.sys
2004-08-10 14:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\drivers\ndis.sys
2004-08-10 14:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\dllcache\ip6fw.sys
2004-08-10 14:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\drivers\ip6fw.sys
2005-03-01 19:36 2056832 d8aba3eab509627e707a3b14f00fbb6b c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2004-08-04 07:59 2015232 fb142b7007ca2eea76966c6c5cc12150 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
2005-03-01 19:34 2056832 81013f36b21c7f72cf784cc6731e0002 c:\windows\Driver Cache\i386\ntkrnlpa.exe
2005-03-01 19:34 2015232 3cd941e472ddf3534e53038535719771 c:\windows\system32\ntkrnlpa.exe
2005-03-01 20:04 2179456 28187802b7c368c0d3aef7d4c382aabb c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2004-08-04 08:18 2148352 626309040459c3915997ef98ec1c8d40 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
2005-03-01 19:59 2179328 4d4cf2c14550a4b7718e94a6e581856e c:\windows\Driver Cache\i386\ntoskrnl.exe
2005-03-01 19:57 2135552 48b3e89af7074cee0314a3e0c7faffdb c:\windows\system32\ntoskrnl.exe
2004-08-10 14:00 1032192 a0732187050030ae399b241436565e64 c:\windows\explorer.exe
2004-08-10 14:00 1032192 a0732187050030ae399b241436565e64 c:\windows\system32\dllcache\explorer.exe
2004-08-10 14:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\system32\services.exe
2004-08-10 14:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\system32\dllcache\services.exe
2004-08-10 14:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\system32\lsass.exe
2004-08-10 14:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\system32\dllcache\lsass.exe
2004-08-10 14:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\system32\ctfmon.exe
2004-08-10 14:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\system32\dllcache\ctfmon.exe
2005-06-10 19:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2004-08-10 14:00 57856 7435b108b935e42ea92ca94f59c8e717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
2005-06-10 18:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\system32\spoolsv.exe
2005-06-10 18:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\system32\dllcache\spoolsv.exe
2004-08-10 07:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\system32\userinit.exe
2004-08-10 07:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\system32\dllcache\userinit.exe
2004-08-10 14:00 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\$NtUninstallKB895961$\termsrv.dll
2005-03-10 02:49 295424 c29a5286e64d97385178452d5f307b98 c:\windows\system32\termsrv.dll
2005-03-10 02:49 295424 c29a5286e64d97385178452d5f307b98 c:\windows\system32\dllcache\termsrv.dll
2004-08-10 14:00 983552 888190e31455fad793312f8d087146eb c:\windows\system32\kernel32.dll
2004-08-10 14:00 983552 888190e31455fad793312f8d087146eb c:\windows\system32\dllcache\kernel32.dll
2004-08-10 14:00 17408 1b5f6923abb450692e9fe0672c897aed c:\windows\system32\powrprof.dll
2004-08-10 14:00 17408 1b5f6923abb450692e9fe0672c897aed c:\windows\system32\dllcache\powrprof.dll
2004-08-10 14:00 110080 87ca7ce6469577f059297b9d6556d66d c:\windows\system32\imm32.dll
2004-08-10 14:00 110080 87ca7ce6469577f059297b9d6556d66d c:\windows\system32\dllcache\imm32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-07 344064]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"SMSERIAL"="sm56hlpr.exe" [2005-01-24 c:\windows\sm56hlpr.exe]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Planner Reminders Tray Icon.lnk - c:\program files\Sierra\Planner\Plnrnote.exe [2006-12-24 184320]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 282624]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\program files\ffdshow\ffdshow.ax
"vidc.xvid"= xvid.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
R1 b393a234;b393a234; [x]
R1 b9f2003d;b9f2003d; [x]
R1 d3ff6419;d3ff6419; [x]
R1 e1900400;e1900400; [x]
R3 Winkr53;Winkr53; [x]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
— Other Services/Drivers In Memory —
*NewlyCreated* - helpsvc
*Deregistered* - AFD
*Deregistered* - Apple Mobile Device
*Deregistered* - Arp1394
*Deregistered* - Ati HotKey Poller
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - Cdfs
*Deregistered* - DcomLaunch
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - Fastfat
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - iaStor
*Deregistered* - ImapiService
*Deregistered* - IntelIde
*Deregistered* - IpFilterDriver
*Deregistered* - IpNat
*Deregistered* - iPod Service
*Deregistered* - IPSec
*Deregistered* - KSecDD
*Deregistered* - LexBceS
*Deregistered* - mcmscsvc
*Deregistered* - mcnasvc
*Deregistered* - mcproxy
*Deregistered* - mcshield
*Deregistered* - mcsysmon
*Deregistered* - MDM
*Deregistered* - mfeavfk
*Deregistered* - mfebopk
*Deregistered* - mfehidk
*Deregistered* - mfesmfk
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - mpfp
*Deregistered* - mpfservice
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Spooler
*Deregistered* - sptd
*Deregistered* - sr
*Deregistered* - swenum
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - ViaIde
*Deregistered* - VolSnap
*Deregistered* - Wanarp
*Deregistered* - X4HSX32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
sromeg
priocukm
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{369505d2-4bcb-11da-b4b8-806d6172696f}]
\shell\autorun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{faf34d90-4bd4-11da-b4bd-0013d4c27b29}]
\Shell\AutoRun\command - J:\LaunchU3.exe
.
Contents of the 'Scheduled Tasks' folder
2009-03-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
2009-03-10 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
2009-03-10 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Exobenoguq - c:\windows\ugetaxuh.dll
SafeBoot-Winkr53.sys
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://mystart.magentic.com/english/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\t2f2tpvr.Default User\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://mystart.magentic.com/?loc=FF_Magentic_AddressBar&search=
FF - plugin: c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\t2f2tpvr.Default User\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\GameTap\bin\Release\npgametaptool.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-15 16:00:37
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\eccfd102]
"ImagePath"="\SystemRoot\System32\drivers\eccfd102.sys"
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(620)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\LEXBCES.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\LEXPPS.EXE
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MpfSrv.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
.
**************************************************************************
.
Completion time: 2009-03-15 16:05:26 - machine was rebooted [HP_Administrator]
ComboFix-quarantined-files.txt 2009-03-15 21:05:10
Pre-Run: 86,028,865,536 bytes free
Post-Run: 85,927,911,424 bytes free
374
Ae3
Internet = ethernet
Essexboy
OK that showed something I am not happy with, I will need you to download the following and run it. You may have Virut in which case you will have to backup all of your documents, Photo's as the only sure fire way of killing that is a reformat. But I will need to see the report first. Sality I may be able to fix
I will know for sure after this run
Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
I will know for sure after this run
Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
- Doubleclick the drweb-cureit.exe file and Allow to run the express scan
- This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
- Once the short scan has finished, mark the drives that you want to scan.
- Select all drives. A red dot shows which drives have been chosen.
- Click the green arrow at the right, and the scan will start.
- Click 'Yes to all' if it asks if you want to cure/move the file.
- When the scan has finished, in the menu, click file and choose save report list
- Save the report to your desktop. The report will be called DrWeb.csv
- Close Dr.Web Cureit.
Ae3
It scanned and bottom of the window displayed "Done - No viruses found"
Didn't get an option to mark any drives…or is that in complete scan?
Essexboy
Intriguing as you had some suspect virut/sality drivers. I will kill them now and then look to your connection problems again
1. Please download The Avenger2 by Swandog46 to your Desktop.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
Then retry the internet again
1. Please download The Avenger2 by Swandog46 to your Desktop.
- Right click on the Avenger.zip folder and select "Extract All…"
- Follow the prompts and extract the avenger folder to your desktop
Begin copying here: Drivers to delete: b393a234 b9f2003d d3ff6419 e1900400 Winkr53
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
- Right click on the window under Input script here:, and select Paste.
- You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
- Click on Execute
- Answer "Yes" twice when prompted.
- It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
- After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
- The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
Then retry the internet again
Essexboy
That is the memory scan you should have had an option to do a full scanDidn't get an option to mark any drives…or is that in complete scan?
Ae3
I did an express scan with Dr.Web CureIt but it finished and i got nothing involving drives.
Also, still no internet connection.
Here is the avenger log and the new hjt log.
AVENGER:
Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "b393a234" deleted successfully.
Driver "b9f2003d" deleted successfully.
Driver "d3ff6419" deleted successfully.
Driver "e1900400" deleted successfully.
Driver "Winkr53" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:20:07 PM, on 3/15/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sierra\Planner\Plnrnote.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…arm1=seconduser
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.magentic.com/english/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…arm1=seconduser
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…arm1=seconduser
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [HPHUPD08] "c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (mcnasvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (mcods) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (mcproxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (mcshield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (mcsysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (mpfservice) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\
–
End of file - 6780 bytes
Also, still no internet connection.
Here is the avenger log and the new hjt log.
AVENGER:
Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "b393a234" deleted successfully.
Driver "b9f2003d" deleted successfully.
Driver "d3ff6419" deleted successfully.
Driver "e1900400" deleted successfully.
Driver "Winkr53" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:20:07 PM, on 3/15/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sierra\Planner\Plnrnote.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…arm1=seconduser
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.magentic.com/english/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…arm1=seconduser
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…arm1=seconduser
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [HPHUPD08] "c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (mcnasvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (mcods) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (mcproxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (mcshield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (mcsysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (mpfservice) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\
–
End of file - 6780 bytes
Essexboy
How is your computer running now ?
OK could you go to control panel
Device Manager
And look at your network Adapters does it have a yellow triangle ?
Ae3
I CAN change wallpapers in Control Panel.
I CAN open Task Manager again.
No yellow triangles in Device Manager.
PC seems to run pretty good, no popups or oddities. Just internet connection issue.
Should I try to reinstall our Comcast bits? Should I run a Mcafee scan?
Essexboy
Yes re-install the Comcast as it may be some files were corrupted by the malware and yes run a full scan with McAfee
I am off to bed now I will look in tomorrow
Ae3
Thank you for all the time your giving this.
Okay. So I reinstalled Comcast Internet…no luck, still no connection. When I went to exit Setup, I got this message:
GLJA.tmp - Ordinal Not Found
The ordinal 1365 could not be located in
Dynamic Link Library LIBEAY32.dll
Also, ran McAfee. It found and quarantined 13 items. Type: Trojan, Detection Name: New Malware.ca
Anyway, Hope this info is of some help/importance. I'll check in while I'm at work tomorrow (Monday), I'll be home around 5:15 Eastern.
Again, thank you so much for your patience with this.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI