Spyware / Malware / Virus Removal

[Resolved] banker, win32.zbot, kb908xxx

30 min read

Looking for the outcome? Ask AI

dogbreath666

Post #31May 16, 2009, 9:29 PM UTC

Hi Tomk, Dr.Web CureIt found 19items. I followed the procedure from your post, however when I try to close Dr.Web CureIt I get this error message. "The list of detected threats contains objects to which no actions were applied. It is recommended to neutralize them before closing the application." Some of the files have no icon and do not offer a cure option ComboFix.exe;C:\Documents and Settings\Owner\Desktop;Container contains infected objects;; ComboFix.exe/data002\32788R22FWJFW\FIND3M.bat;C:\Documents and Settings\Owner\Desktop\ComboFix.exe/data002;Probably BATCH.Virus;; ComboFix.exe/data002\32788R22FWJFW\psexec.cfexe;C:\Documents and Settings\Owner\Desktop\ComboFix.exe/data002;Program.PsExec.171;; data002;C:\Documents and Settings\Owner\Desktop;Archive contains infected objects;; I tried select all >move still get same error message. Tenacious little devils aren't they. j DrWeb.csv A0006336.EXE;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP14;Program.PsExec.170;; A0006365.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP14;Probably BATCH.Virus;; A0006492.EXE;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP14;Program.PsExec.170;; A0006520.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP14;Probably BATCH.Virus;; A0006750.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;; A0006821.EXE;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Program.PsExec.170;; A0006852.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;; A0006949.EXE;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Program.PsExec.170;; A0006979.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;; A0007110.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;; A0007184.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;; ComboFix.exe;C:\Documents and Settings\Owner\Desktop;Container contains infected objects;; ComboFix.exe/data002\32788R22FWJFW\FIND3M.bat;C:\Documents and Settings\Owner\Desktop\ComboFix.exe/data002;Probably BATCH.Virus;; ComboFix.exe/data002\32788R22FWJFW\psexec.cfexe;C:\Documents and Settings\Owner\Desktop\ComboFix.exe/data002;Program.PsExec.171;; data002;C:\Documents and Settings\Owner\Desktop;Archive contains infected objects;; NTService.exe;C:\Program Files\omniformat;Trojan.MulDrop.origin;; scan.vbs;C:\LinhaDefensiva\func;Probably SCRIPT.Virus;; ZeroSpyware LE.exe;C:\Program Files\FBM Software\ZeroSpyware Limited Edition;Probably STPAGE.Trojan;; ZSRemovalRestorer.dll;C:\Program Files\FBM Software\ZeroSpyware Limited Edition;Probably STPAGE.Trojan;;

Tomk

Post #32May 17, 2009, 4:41 AM UTC last edited May 17, 2009, 4:42 AM UTC

dogbreath666,

Those are false positives. You did fine.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

SecCenter::
AV: AVG 7.5.524 *On-access scanning disabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {F8D1277C-FFA4-00FF-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FBDA855C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FBE25DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FC1A0BD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FC2EB054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FC9F061C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {F8D30054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {F8D3EBF4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {F9C7EDAC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FB822BD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBA4FDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBA7FCBC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBAD7054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBAEF7B4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBBA585C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBC5D054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBCB0C44-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBCD4AAC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBD51CB4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBDA27BC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBE1152C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBE29A04-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBFBDDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC014BD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC0D4054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC0E3054-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC0F2054-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC132DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC14D7B4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC14F33C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC164DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC18437C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC18D77C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC1B57B4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC1ECDDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC1F3DDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC1FC3CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC257DDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC261934-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2740CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC283DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC297DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2A9C44-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2AF054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2B3DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2BDD74-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2CFBD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2F4DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC308DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC332CEC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC338794-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC37BCB4-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC37BDDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC37E594-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC38B054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3AB584-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3AC7CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3C6BCC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3CA054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3D7BD4-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3D8624-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3E4DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3FCCB4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4302AC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC434434-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC440054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC44D9C4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC45F054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC46AAAC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC475874-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC481814-FFA4-00FF-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4879EC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC48BA94-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC491BD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC499DDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC49A9B4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4BD9CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4D375C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4D8054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4D8BCC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4DCDDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4E7DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4EACA4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4FA054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC504DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC507DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC50F434-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC561844-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC568754-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC590874-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC59CDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC59DB24-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5A2DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5BADDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5BED4C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5C89CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5C9AAC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC601D74-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC608814-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC62081C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC649DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC64BDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC650DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC65255C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC662AAC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC68CDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC69CAEC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC6A5DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC6A6DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC72D4BC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC73C3DC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC81B944-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC8559C4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC8D1564-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FCD27DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FCD89DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FCE66CB4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FD20AA9C-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FD2E0A7C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FD31CBD4-FFA4-00DC-0D24-347CA8A3377C}

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

dogbreath666

Post #33May 17, 2009, 5:58 AM UTC

Hi Tomk,
Here you go. Thanks j

ComboFix 09-05-13.02 - Owner 05/16/2009 21:47.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.105 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: AVG 7.5.524 *On-access scanning disabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {F8D1277C-FFA4-00FF-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FBDA855C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FBE25DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FC1A0BD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FC2EB054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {FC9F061C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {F8D30054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {F8D3EBF4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {F9C7EDAC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FB822BD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBA4FDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBA7FCBC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBAD7054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBAEF7B4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBBA585C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBC5D054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBCB0C44-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBCD4AAC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBD51CB4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBDA27BC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBE1152C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBE29A04-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FBFBDDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC014BD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC0D4054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC0E3054-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC0F2054-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC132DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC14D7B4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC14F33C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC164DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC18437C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC18D77C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC1B57B4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC1ECDDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC1F3DDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC1FC3CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC257DDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC261934-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2740CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC283DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC297DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2A9C44-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2AF054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2B3DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2BDD74-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2CFBD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC2F4DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC308DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC332CEC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC338794-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC37BCB4-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC37BDDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC37E594-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC38B054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3AB584-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3AC7CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3C6BCC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3CA054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3D7BD4-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3D8624-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3E4DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC3FCCB4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4302AC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC434434-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC440054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC44D9C4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC45F054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC46AAAC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC475874-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC481814-FFA4-00FF-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4879EC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC48BA94-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC491BD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC499DDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC49A9B4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4BD9CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4D375C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4D8054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4D8BCC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4DCDDC-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4E7DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4EACA4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC4FA054-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC504DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC507DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC50F434-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC561844-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC568754-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC590874-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC59CDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC59DB24-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5A2DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5BADDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5BED4C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5C89CC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC5C9AAC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC601D74-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC608814-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC62081C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC649DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC64BDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC650DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC65255C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC662AAC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC68CDDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC69CAEC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC6A5DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC6A6DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC72D4BC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC73C3DC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC81B944-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC8559C4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FC8D1564-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FCD27DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FCD89DDC-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FCE66CB4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FD20AA9C-FFA4-00EE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FD2E0A7C-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FD31CBD4-FFA4-00DC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FD3BBBD4-FFA4-00DC-0D24-347CA8A3377C}
.

((((((((((((((((((((((((( Files Created from 2009-04-17 to 2009-05-17 )))))))))))))))))))))))))))))))
.

2009-05-15 03:23 . 2009-03-25 00:08 55640 —-a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-15 03:22 . 2009-05-15 03:22 ——– d—–w c:\documents and settings\All Users\Application Data\Avira
2009-05-15 03:22 . 2009-05-15 03:22 ——– d—–w c:\program files\Avira
2009-05-10 21:07 . 2009-05-10 22:56 ——– d—–w c:\program files\EsetOnlineScanner
2009-05-10 20:59 . 2009-05-10 21:02 ——– d—–w C:\Rooter$
2009-05-08 08:48 . 2009-05-08 08:48 ——– d—–w c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-08 08:48 . 2009-04-06 23:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-08 08:48 . 2009-04-06 23:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-08 08:48 . 2009-05-08 08:48 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-08 08:48 . 2009-05-08 08:48 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-05-05 09:42 . 2009-03-06 14:22 284160 -c—-w c:\windows\system32\dllcache\pdh.dll
2009-05-05 09:42 . 2009-02-06 10:39 35328 -c—-w c:\windows\system32\dllcache\sc.exe
2009-05-05 09:42 . 2009-02-09 12:10 401408 -c—-w c:\windows\system32\dllcache\rpcss.dll
2009-05-05 09:42 . 2009-02-06 11:11 110592 -c—-w c:\windows\system32\dllcache\services.exe
2009-05-05 09:42 . 2009-02-09 12:10 473600 -c—-w c:\windows\system32\dllcache\fastprox.dll
2009-05-05 09:42 . 2009-02-06 10:10 227840 -c—-w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-05 09:42 . 2009-02-09 12:10 453120 -c—-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-05 09:42 . 2009-02-09 12:10 729088 -c—-w c:\windows\system32\dllcache\lsasrv.dll
2009-05-05 09:42 . 2009-02-09 12:10 617472 -c—-w c:\windows\system32\dllcache\advapi32.dll
2009-05-05 09:42 . 2009-02-09 12:10 714752 -c—-w c:\windows\system32\dllcache\ntdll.dll
2009-05-05 09:40 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-05-05 09:40 . 2008-04-21 12:08 215552 -c—-w c:\windows\system32\dllcache\wordpad.exe
2009-05-03 03:02 . 2009-05-03 03:02 ——– d—–w c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-05-03 03:02 . 2009-05-03 03:02 ——– d—–w c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-05-02 18:06 . 2009-05-02 18:07 ——– d—–w C:\LinhaDefensiva
2009-05-02 17:12 . 2009-05-02 17:12 ——– d—–w c:\program files\ERUNT
2009-05-02 16:45 . 2009-05-02 16:45 ——– d—–w c:\program files\Trend Micro
2009-04-26 22:39 . 2009-05-16 06:40 ——– d—–w c:\documents and settings\Owner\DoctorWeb
2009-04-26 17:14 . 2009-04-26 08:26 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-04-26 08:27 . 2009-04-26 08:25 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-04-26 08:11 . 2009-04-26 08:11 ——– dc-h–w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-18 07:58 . 2009-04-18 07:58 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\Opera
2009-04-18 07:53 . 2009-04-18 07:53 ——– d—–w c:\program files\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-15 03:30 . 2006-07-19 22:18 69800 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-14 20:35 . 2009-05-14 20:35 0 –sh–w c:\windows\S1E3AFFB3.tmp
2009-05-08 20:57 . 2008-05-31 08:45 ——– d—–w c:\program files\Common Files\ESRI
2009-05-08 08:43 . 2006-07-20 01:52 ——– d—–w c:\program files\Java
2009-05-03 03:31 . 2007-09-30 23:47 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-04-26 08:11 . 2006-12-03 00:20 ——– d—–w c:\program files\Lavasoft
2009-04-25 09:59 . 2008-06-16 07:50 ——– d—–w c:\program files\SpywareBlaster
2009-04-25 09:52 . 2008-06-01 01:58 ——– d—–w c:\program files\SpywareGuard
2009-04-13 08:53 . 2009-04-13 08:53 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-11 20:00 . 2008-05-31 08:17 ——– d—–w c:\program files\PeerGuardian2
2009-03-22 23:22 . 2007-05-21 22:49 59 —-a-w c:\windows\wpd99.drv
2009-03-06 14:22 . 2006-07-19 00:47 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-07-19 00:48 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2006-07-19 00:47 78336 —-a-w c:\windows\system32\ieencode.dll
1996-12-15 17:07 . 2007-10-28 05:54 27 –sh–w c:\windows\system\_NSI_.DAT
2007-02-21 10:47 . 2008-05-20 07:06 31232 –sh–r c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2008-09-16 08:14 216064 –sh–r c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-13_16.10.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 10:19 . 2007-11-07 10:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2009-05-16 21:23 . 2009-05-16 21:23 16384 c:\windows\Temp\Perflib_Perfdata_7f4.dat
+ 2007-04-27 16:00 . 2009-02-13 20:50 28376 c:\windows\system32\drivers\ssmdrv.sys
+ 2009-05-15 03:23 . 2009-03-30 18:33 96104 c:\windows\system32\drivers\avipbb.sys
+ 2009-05-15 03:23 . 2009-02-13 20:29 22360 c:\windows\system32\drivers\avgntmgr.sys
+ 2009-05-15 03:23 . 2009-02-13 20:17 45416 c:\windows\system32\drivers\avgntdd.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}"= "c:\program files\Foxit\tbFoxi.dll" [2007-08-01 1391640]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]
2007-08-01 00:33 1391640 —-a-w c:\program files\Foxit\tbFoxi.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}"= "c:\program files\Foxit\tbFoxi.dll" [2007-08-01 1391640]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{73C7D5B0-7B03-444A-84C7-CE1BA03B5573}"= "c:\program files\Foxit\tbFoxi.dll" [2007-08-01 1391640]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"ZSLEScheduler"="c:\program files\FBM Software\ZeroSpyware Limited Edition\ZSScheduler.dll" [2007-12-03 77870]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2006-02-02 73728]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1343488]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-08-23 16050688]
"TPSMain"="TPSMain.exe" - c:\windows\system32\TPSMain.exe [2005-06-01 282624]
"TFncKy"="TFncKy.exe" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NavLogon]
[BU]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ArcInfoSetupRestart.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ArcInfoSetupRestart.lnk
backup=c:\windows\pss\ArcInfoSetupRestart.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless USB Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless USB Utility.lnk
backup=c:\windows\pss\Belkin Wireless USB Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Broadband Networking.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Broadband Networking.lnk
backup=c:\windows\pss\Microsoft Broadband Networking.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Privoxy.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Privoxy.lnk
backup=c:\windows\pss\Privoxy.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk
backup=c:\windows\pss\RAMASST.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Symantec AntiVirus"=3 (0x3)
"Swupdtmr"=3 (0x3)
"SPBBCSvc"=3 (0x3)
"SNDSrvc"=3 (0x3)
"SavRoam"=3 (0x3)
"Fax"=2 (0x2)
"ehSched"=2 (0x2)
"ehRecvr"=2 (0x2)
"DefWatch"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=3 (0x3)
"AVGEMS"=2 (0x2)
"Avg7Alrt"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"ose"=3 (0x3)
"IDriverT"=3 (0x3)
"DVD-RAM_Service"=2 (0x2)
"CFSvcs"=2 (0x2)
"aawservice"=2 (0x2)
"SentinelProtectionServer"=2 (0x2)
"ArcGIS License Manager"=2 (0x2)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"RegSrvc"=2 (0x2)
"EvtEng"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirScheduler"=2 (0x2)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUtil.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNTray.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNCfg.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUpdate.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\skype\\Skype.exe"=
"c:\\Program Files\\skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2869:TCP"= 2869:TCP:@xpsp2res.dll,-22008

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/26/2009 12:27 AM 64160]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/14/2009 7:23 PM 108289]
R2 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [6/30/2007 12:51 AM 8064]
R2 SocketLock;Raw Socket Lock Driver;c:\windows\system32\socketlock.sys [10/18/2007 12:07 AM 3712]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [6/28/2006 10:50 AM 98816]
S2 FileDeleter;ZeroSpyware FileDeleter;c:\program files\FBM Software\ZeroSpyware Limited Edition\FileDeleter.exe [11/29/2007 3:25 PM 278528]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Owner\LOCALS~1\Temp\ALSysIO.sys –> c:\docume~1\Owner\LOCALS~1\Temp\ALSysIO.sys [?]
S3 IO_Memory;IO_Memory;\??\c:\sysprep\Drivers\ioport.sys –> c:\sysprep\Drivers\ioport.sys [?]
S3 SVRPEDRV;SVRPEDRV;\??\c:\sysprep\PEDrv.sys –> c:\sysprep\PEDrv.sys [?]
S4 ArcGIS License Manager;ArcGIS License Manager;c:\program files\ESRI\License\arcgis9x\lmgrd.exe –> c:\program files\ESRI\License\arcgis9x\lmgrd.exe [?]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 11:06 AM 953168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-05-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 08:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Download all by Net Transport - c:\program files\Xi\NetTransport 2\NTAddList.html
IE: Download by Net Transport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\yaot63ze.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/advanced_search?hl=en
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 8118
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 8118
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Photosynth\npPhotosynthMozilla.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-16 21:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2655548455-846718037-109114601-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1680)
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
c:\windows\system32\netprovcredman.dll
.
Completion time: 2009-05-17 21:52
ComboFix-quarantined-files.txt 2009-05-17 05:52
ComboFix2.txt 2009-05-15 03:15
ComboFix3.txt 2009-05-15 03:04
ComboFix4.txt 2009-05-14 20:42
ComboFix5.txt 2009-05-17 05:45

Pre-Run: 14,535,917,568 bytes free
Post-Run: 14,516,293,632 bytes free

375

Tomk

Post #34May 17, 2009, 9:16 AM UTC

dogbreath666,

Hmm… Didn't work. Let's try this.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::

SecCenter::
{41564737-3200-1071-989B-0000E87B4FB1}
{F8D1277C-FFA4-00FF-0D24-347CA8A3377C}
{FBDA855C-FFA4-00DC-0D24-347CA8A3377C}
{FBE25DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC1A0BD4-FFA4-00DC-0D24-347CA8A3377C}
{FC2EB054-FFA4-00DC-0D24-347CA8A3377C}
{FC9F061C-FFA4-00DC-0D24-347CA8A3377C}
{00000000-0000-0000-0000-000000000000}
{F8D30054-FFA4-00DC-0D24-347CA8A3377C}
{F8D3EBF4-FFA4-00DC-0D24-347CA8A3377C}
{F9C7EDAC-FFA4-00DC-0D24-347CA8A3377C}
{FB822BD4-FFA4-00DC-0D24-347CA8A3377C}
{FBA4FDDC-FFA4-00DC-0D24-347CA8A3377C}
{FBA7FCBC-FFA4-00DC-0D24-347CA8A3377C}
{FBAD7054-FFA4-00DC-0D24-347CA8A3377C}
{FBAEF7B4-FFA4-00DC-0D24-347CA8A3377C}
{FBBA585C-FFA4-00DC-0D24-347CA8A3377C}
{FBC5D054-FFA4-00DC-0D24-347CA8A3377C}
{FBCB0C44-FFA4-00DC-0D24-347CA8A3377C}
{FBCD4AAC-FFA4-00DC-0D24-347CA8A3377C}
{FBD51CB4-FFA4-00DC-0D24-347CA8A3377C}
{FBDA27BC-FFA4-00EE-0D24-347CA8A3377C}
{FBE1152C-FFA4-00DC-0D24-347CA8A3377C}
{FBE29A04-FFA4-00DC-0D24-347CA8A3377C}
{FBFBDDDC-FFA4-00DC-0D24-347CA8A3377C}
{FC014BD4-FFA4-00DC-0D24-347CA8A3377C}
{FC0D4054-FFA4-00DC-0D24-347CA8A3377C}
{FC0E3054-FFA4-00EE-0D24-347CA8A3377C}
{FC0F2054-FFA4-00EE-0D24-347CA8A3377C}
{FC132DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC14D7B4-FFA4-00DC-0D24-347CA8A3377C}
{FC14F33C-FFA4-00DC-0D24-347CA8A3377C}
{FC164DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC18437C-FFA4-00DC-0D24-347CA8A3377C}
{FC18D77C-FFA4-00DC-0D24-347CA8A3377C}
{FC1B57B4-FFA4-00DC-0D24-347CA8A3377C}
{FC1ECDDC-FFA4-00EE-0D24-347CA8A3377C}
{FC1F3DDC-FFA4-00EE-0D24-347CA8A3377C}
{FC1FC3CC-FFA4-00DC-0D24-347CA8A3377C}
{FC257DDC-FFA4-00EE-0D24-347CA8A3377C}
{FC261934-FFA4-00DC-0D24-347CA8A3377C}
{FC2740CC-FFA4-00DC-0D24-347CA8A3377C}
{FC283DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC297DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC2A9C44-FFA4-00DC-0D24-347CA8A3377C}
{FC2AF054-FFA4-00DC-0D24-347CA8A3377C}
{FC2B3DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC2BDD74-FFA4-00DC-0D24-347CA8A3377C}
{FC2CFBD4-FFA4-00DC-0D24-347CA8A3377C}
{FC2F4DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC308DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC332CEC-FFA4-00DC-0D24-347CA8A3377C}
{FC338794-FFA4-00DC-0D24-347CA8A3377C}
{FC37BCB4-FFA4-00EE-0D24-347CA8A3377C}
{FC37BDDC-FFA4-00EE-0D24-347CA8A3377C}
{FC37E594-FFA4-00DC-0D24-347CA8A3377C}
{FC38B054-FFA4-00DC-0D24-347CA8A3377C}
{FC3AB584-FFA4-00DC-0D24-347CA8A3377C}
{FC3AC7CC-FFA4-00DC-0D24-347CA8A3377C}
{FC3C6BCC-FFA4-00EE-0D24-347CA8A3377C}
{FC3CA054-FFA4-00DC-0D24-347CA8A3377C}
{FC3D7BD4-FFA4-00EE-0D24-347CA8A3377C}
{FC3D8624-FFA4-00DC-0D24-347CA8A3377C}
{FC3E4DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC3FCCB4-FFA4-00DC-0D24-347CA8A3377C}
{FC4302AC-FFA4-00DC-0D24-347CA8A3377C}
{FC434434-FFA4-00DC-0D24-347CA8A3377C}
{FC440054-FFA4-00DC-0D24-347CA8A3377C}
{FC44D9C4-FFA4-00DC-0D24-347CA8A3377C}
{FC45F054-FFA4-00DC-0D24-347CA8A3377C}
{FC46AAAC-FFA4-00EE-0D24-347CA8A3377C}
{FC475874-FFA4-00DC-0D24-347CA8A3377C}
{FC481814-FFA4-00FF-0D24-347CA8A3377C}
{FC4879EC-FFA4-00DC-0D24-347CA8A3377C}
{FC48BA94-FFA4-00DC-0D24-347CA8A3377C}
{FC491BD4-FFA4-00DC-0D24-347CA8A3377C}
{FC499DDC-FFA4-00EE-0D24-347CA8A3377C}
{FC49A9B4-FFA4-00DC-0D24-347CA8A3377C}
{FC4BD9CC-FFA4-00DC-0D24-347CA8A3377C}
{FC4D375C-FFA4-00DC-0D24-347CA8A3377C}
{FC4D8054-FFA4-00DC-0D24-347CA8A3377C}
{FC4D8BCC-FFA4-00DC-0D24-347CA8A3377C}
{FC4DCDDC-FFA4-00EE-0D24-347CA8A3377C}
{FC4E7DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC4EACA4-FFA4-00DC-0D24-347CA8A3377C}
{FC4FA054-FFA4-00DC-0D24-347CA8A3377C}
{FC504DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC507DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC50F434-FFA4-00DC-0D24-347CA8A3377C}
{FC561844-FFA4-00DC-0D24-347CA8A3377C}
{FC568754-FFA4-00DC-0D24-347CA8A3377C}
{FC590874-FFA4-00DC-0D24-347CA8A3377C}
{FC59CDDC-FFA4-00DC-0D24-347CA8A3377C}
{FC59DB24-FFA4-00DC-0D24-347CA8A3377C}
{FC5A2DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC5BADDC-FFA4-00DC-0D24-347CA8A3377C}
{FC5BED4C-FFA4-00DC-0D24-347CA8A3377C}
{FC5C89CC-FFA4-00DC-0D24-347CA8A3377C}
{FC5C9AAC-FFA4-00DC-0D24-347CA8A3377C}
{FC601D74-FFA4-00DC-0D24-347CA8A3377C}
{FC608814-FFA4-00DC-0D24-347CA8A3377C}
{FC62081C-FFA4-00DC-0D24-347CA8A3377C}
{FC649DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC64BDDC-FFA4-00DC-0D24-347CA8A3377C}
{FC650DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC65255C-FFA4-00DC-0D24-347CA8A3377C}
{FC662AAC-FFA4-00DC-0D24-347CA8A3377C}
{FC68CDDC-FFA4-00DC-0D24-347CA8A3377C}
{FC69CAEC-FFA4-00DC-0D24-347CA8A3377C}
{FC6A5DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC6A6DDC-FFA4-00DC-0D24-347CA8A3377C}
{FC72D4BC-FFA4-00DC-0D24-347CA8A3377C}
{FC73C3DC-FFA4-00DC-0D24-347CA8A3377C}
{FC81B944-FFA4-00DC-0D24-347CA8A3377C}
{FC8559C4-FFA4-00DC-0D24-347CA8A3377C}
{FC8D1564-FFA4-00DC-0D24-347CA8A3377C}
{FCD27DDC-FFA4-00DC-0D24-347CA8A3377C}
{FCD89DDC-FFA4-00DC-0D24-347CA8A3377C}
{FCE66CB4-FFA4-00DC-0D24-347CA8A3377C}
{FD20AA9C-FFA4-00EE-0D24-347CA8A3377C}
{FD2E0A7C-FFA4-00DC-0D24-347CA8A3377C}
{FD31CBD4-FFA4-00DC-0D24-347CA8A3377C}

Driver::

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

dogbreath666

Post #35May 17, 2009, 9:07 PM UTC

Hi Tomk,
Here is the latest scan. I do have the current version of Avira disabled, including the on access scan. At least as far as I can tell. When I run Combofix I get an offer to upgrade to a newer version. I have been declining and running the version I downloaded earlier in the process. Thanks. j

ComboFix 09-05-13.02 - Owner 05/17/2009 12:31.10 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.128 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {FD3BBBD4-FFA4-00DC-0D24-347CA8A3377C}
.

((((((((((((((((((((((((( Files Created from 2009-04-17 to 2009-05-17 )))))))))))))))))))))))))))))))
.

2009-05-15 03:23 . 2009-03-25 00:08 55640 —-a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-15 03:22 . 2009-05-15 03:22 ——– d—–w c:\documents and settings\All Users\Application Data\Avira
2009-05-15 03:22 . 2009-05-15 03:22 ——– d—–w c:\program files\Avira
2009-05-10 21:07 . 2009-05-10 22:56 ——– d—–w c:\program files\EsetOnlineScanner
2009-05-10 20:59 . 2009-05-10 21:02 ——– d—–w C:\Rooter$
2009-05-08 08:48 . 2009-05-08 08:48 ——– d—–w c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-08 08:48 . 2009-04-06 23:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-08 08:48 . 2009-04-06 23:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-08 08:48 . 2009-05-08 08:48 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-08 08:48 . 2009-05-08 08:48 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-05-05 09:42 . 2009-03-06 14:22 284160 -c—-w c:\windows\system32\dllcache\pdh.dll
2009-05-05 09:42 . 2009-02-06 10:39 35328 -c—-w c:\windows\system32\dllcache\sc.exe
2009-05-05 09:42 . 2009-02-09 12:10 401408 -c—-w c:\windows\system32\dllcache\rpcss.dll
2009-05-05 09:42 . 2009-02-06 11:11 110592 -c—-w c:\windows\system32\dllcache\services.exe
2009-05-05 09:42 . 2009-02-09 12:10 473600 -c—-w c:\windows\system32\dllcache\fastprox.dll
2009-05-05 09:42 . 2009-02-06 10:10 227840 -c—-w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-05 09:42 . 2009-02-09 12:10 453120 -c—-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-05 09:42 . 2009-02-09 12:10 729088 -c—-w c:\windows\system32\dllcache\lsasrv.dll
2009-05-05 09:42 . 2009-02-09 12:10 617472 -c—-w c:\windows\system32\dllcache\advapi32.dll
2009-05-05 09:42 . 2009-02-09 12:10 714752 -c—-w c:\windows\system32\dllcache\ntdll.dll
2009-05-05 09:40 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-05-05 09:40 . 2008-04-21 12:08 215552 -c—-w c:\windows\system32\dllcache\wordpad.exe
2009-05-03 03:02 . 2009-05-03 03:02 ——– d—–w c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-05-03 03:02 . 2009-05-03 03:02 ——– d—–w c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-05-02 18:06 . 2009-05-02 18:07 ——– d—–w C:\LinhaDefensiva
2009-05-02 17:12 . 2009-05-02 17:12 ——– d—–w c:\program files\ERUNT
2009-05-02 16:45 . 2009-05-02 16:45 ——– d—–w c:\program files\Trend Micro
2009-04-26 22:39 . 2009-05-16 06:40 ——– d—–w c:\documents and settings\Owner\DoctorWeb
2009-04-26 17:14 . 2009-04-26 08:26 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-04-26 08:27 . 2009-04-26 08:25 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-04-26 08:11 . 2009-04-26 08:11 ——– dc-h–w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-18 07:58 . 2009-04-18 07:58 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\Opera
2009-04-18 07:53 . 2009-04-18 07:53 ——– d—–w c:\program files\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-15 03:30 . 2006-07-19 22:18 69800 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-14 20:35 . 2009-05-14 20:35 0 –sh–w c:\windows\S1E3AFFB3.tmp
2009-05-08 20:57 . 2008-05-31 08:45 ——– d—–w c:\program files\Common Files\ESRI
2009-05-08 08:43 . 2006-07-20 01:52 ——– d—–w c:\program files\Java
2009-05-03 03:31 . 2007-09-30 23:47 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-04-26 08:11 . 2006-12-03 00:20 ——– d—–w c:\program files\Lavasoft
2009-04-25 09:59 . 2008-06-16 07:50 ——– d—–w c:\program files\SpywareBlaster
2009-04-25 09:52 . 2008-06-01 01:58 ——– d—–w c:\program files\SpywareGuard
2009-04-13 08:53 . 2009-04-13 08:53 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-11 20:00 . 2008-05-31 08:17 ——– d—–w c:\program files\PeerGuardian2
2009-03-22 23:22 . 2007-05-21 22:49 59 —-a-w c:\windows\wpd99.drv
2009-03-06 14:22 . 2006-07-19 00:47 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-07-19 00:48 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2006-07-19 00:47 78336 —-a-w c:\windows\system32\ieencode.dll
1996-12-15 17:07 . 2007-10-28 05:54 27 –sh–w c:\windows\system\_NSI_.DAT
2007-02-21 10:47 . 2008-05-20 07:06 31232 –sh–r c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2008-09-16 08:14 216064 –sh–r c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-13_16.10.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 10:19 . 2007-11-07 10:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2009-05-17 20:00 . 2009-05-17 20:00 16384 c:\windows\Temp\Perflib_Perfdata_7c0.dat
+ 2007-04-27 16:00 . 2009-02-13 20:50 28376 c:\windows\system32\drivers\ssmdrv.sys
+ 2009-05-15 03:23 . 2009-03-30 18:33 96104 c:\windows\system32\drivers\avipbb.sys
+ 2009-05-15 03:23 . 2009-02-13 20:29 22360 c:\windows\system32\drivers\avgntmgr.sys
+ 2009-05-15 03:23 . 2009-02-13 20:17 45416 c:\windows\system32\drivers\avgntdd.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}"= "c:\program files\Foxit\tbFoxi.dll" [2007-08-01 1391640]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]
2007-08-01 00:33 1391640 —-a-w c:\program files\Foxit\tbFoxi.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}"= "c:\program files\Foxit\tbFoxi.dll" [2007-08-01 1391640]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{73C7D5B0-7B03-444A-84C7-CE1BA03B5573}"= "c:\program files\Foxit\tbFoxi.dll" [2007-08-01 1391640]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"ZSLEScheduler"="c:\program files\FBM Software\ZeroSpyware Limited Edition\ZSScheduler.dll" [2007-12-03 77870]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2006-02-02 73728]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1343488]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-08-23 16050688]
"TPSMain"="TPSMain.exe" - c:\windows\system32\TPSMain.exe [2005-06-01 282624]
"TFncKy"="TFncKy.exe" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NavLogon]
[BU]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ArcInfoSetupRestart.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ArcInfoSetupRestart.lnk
backup=c:\windows\pss\ArcInfoSetupRestart.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless USB Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless USB Utility.lnk
backup=c:\windows\pss\Belkin Wireless USB Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Broadband Networking.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Broadband Networking.lnk
backup=c:\windows\pss\Microsoft Broadband Networking.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Privoxy.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Privoxy.lnk
backup=c:\windows\pss\Privoxy.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk
backup=c:\windows\pss\RAMASST.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Symantec AntiVirus"=3 (0x3)
"Swupdtmr"=3 (0x3)
"SPBBCSvc"=3 (0x3)
"SNDSrvc"=3 (0x3)
"SavRoam"=3 (0x3)
"Fax"=2 (0x2)
"ehSched"=2 (0x2)
"ehRecvr"=2 (0x2)
"DefWatch"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=3 (0x3)
"AVGEMS"=2 (0x2)
"Avg7Alrt"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"ose"=3 (0x3)
"IDriverT"=3 (0x3)
"DVD-RAM_Service"=2 (0x2)
"CFSvcs"=2 (0x2)
"aawservice"=2 (0x2)
"SentinelProtectionServer"=2 (0x2)
"ArcGIS License Manager"=2 (0x2)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"RegSrvc"=2 (0x2)
"EvtEng"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirScheduler"=2 (0x2)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"FileDeleter"=2 (0x2)
"AntiVirSchedulerService"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUtil.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNTray.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNCfg.exe"=
"c:\\Program Files\\Microsoft Broadband Networking\\MSBNUpdate.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\skype\\Skype.exe"=
"c:\\Program Files\\skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2869:TCP"= 2869:TCP:@xpsp2res.dll,-22008

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/26/2009 12:27 AM 64160]
R2 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [6/30/2007 12:51 AM 8064]
R2 SocketLock;Raw Socket Lock Driver;c:\windows\system32\socketlock.sys [10/18/2007 12:07 AM 3712]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [6/28/2006 10:50 AM 98816]
S3 ALSysIO;ALSysIO;\??\c:\docume~1\Owner\LOCALS~1\Temp\ALSysIO.sys –> c:\docume~1\Owner\LOCALS~1\Temp\ALSysIO.sys [?]
S3 IO_Memory;IO_Memory;\??\c:\sysprep\Drivers\ioport.sys –> c:\sysprep\Drivers\ioport.sys [?]
S3 SVRPEDRV;SVRPEDRV;\??\c:\sysprep\PEDrv.sys –> c:\sysprep\PEDrv.sys [?]
S4 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/14/2009 7:23 PM 108289]
S4 ArcGIS License Manager;ArcGIS License Manager;c:\program files\ESRI\License\arcgis9x\lmgrd.exe –> c:\program files\ESRI\License\arcgis9x\lmgrd.exe [?]
S4 FileDeleter;ZeroSpyware FileDeleter;c:\program files\FBM Software\ZeroSpyware Limited Edition\FileDeleter.exe [11/29/2007 3:25 PM 278528]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 11:06 AM 953168]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-05-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 08:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Download all by Net Transport - c:\program files\Xi\NetTransport 2\NTAddList.html
IE: Download by Net Transport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\yaot63ze.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/advanced_search?hl=en
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 8118
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - 127.0.0.1
FF - prefs.js: network.proxy.ssl_port - 8118
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Photosynth\npPhotosynthMozilla.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-17 12:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2655548455-846718037-109114601-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3788)
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
c:\windows\system32\netprovcredman.dll
.
Completion time: 2009-05-17 12:36
ComboFix-quarantined-files.txt 2009-05-17 20:36
ComboFix2.txt 2009-05-17 06:38
ComboFix3.txt 2009-05-17 06:10
ComboFix4.txt 2009-05-17 05:52
ComboFix5.txt 2009-05-17 20:21

Pre-Run: 14,540,943,360 bytes free
Post-Run: 14,520,860,672 bytes free

255

Tomk

Post #36May 18, 2009, 2:11 AM UTC

dogbreath666, Now how are things running?

dogbreath666

Post #37May 18, 2009, 3:54 AM UTC

Hi Tomk, I still get this message from zerospyware. This shows two trojans. Are these false positives? j FBM Software ZeroSpyware Version 2.1.29.4 Scan Started: May 17, 2009 07:41 PM Scan Ended: May 17, 2009 07:42 PM Scan Summary: ¯¯¯¯¯¯¯¯¯¯¯¯¯ Spyware Application(s) Found: 2 Scanned Drive(s): Drive C: Total Scanning Time: 00:00:26.03 Total Component(s) Scanned: 55531 Total Spyware Component(s) Identified: 3 Total Process(es) Scanned: 33 Spyware Process(es) Found: 0 File(s) Scanned: 835 Spyware File Component(s): 0 Registry Entries Scanned: 54663 Spyware Registry Component(s): 3 Spyware Folder Component(s): 0 Spyware Components: ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ Application Name: Trojan Bifrose Classification: Trojan Registry Key: HKEY_CURRENT_USER\software\wget\ Application Name: Trojan.Agent.Win32.Banker Classification: Trojan Registry Key: HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\ Value Name: donotallowexceptions Value Data: 00, 00, 00, 00 Registry Key: HKEY_LOCAL_MACHINE\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\ Value Name: donotallowexceptions Value Data: 00, 00, 00, 00

Tomk

Post #38May 18, 2009, 4:35 AM UTC

dogbreath666,

I'm not sure.

Let's try a couple more things.

Please download gmer.zip from Gmer and save it to your desktop.

Right click on gmer.zip and select Extract All….
Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
Click on the Browse button. Click on Desktop. Then click OK.
Click Next. It will start extracting.
Once done, check (tick) the Show extracted files box and click Finish.
Double click on gmer.exe to run it.
Select the Rootkit tab.
On the right hand side, check all the items to be scanned, but leave Show All box unchecked.
Select all drives that are connected to your system to be scanned.
Click on the Scan button.
When the scan is finished, click Copy to save the scan log to the Windows clipboard.
Open Notepad or a similar text editor.
Paste the clipboard contents into the text editor.
Save the Gmer scan log and post it in your next reply.
Close Gmer.
Open Command Prompt by going to Start > Run and type in cmd. Press Enter.
In Command Prompt, type in net stop gmer. Press Enter.
Type in exit to close Command Prompt.

Note: Do not run any programs while Gmer is running.

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click Yes to all if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found:[external image: Posted Image]
If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
[external image: Posted Image]
This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.

dogbreath666

Post #39May 21, 2009, 1:06 AM UTC

Hi Tomk,
I have to use a less convenient net connection currently. My responses will be a bit slower. Thanks for your persistence. I am pretty sure I removed all the AVG programs. The dont show up in the add/remove programs settings window. AVG still seems to want to communicate back home. j

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-17 23:28:57
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.15 —-

SSDT F8BD1A16 ZwCreateKey
SSDT F8BD1A0C ZwCreateThread
SSDT F8BD1A1B ZwDeleteKey
SSDT F8BD1A25 ZwDeleteValueKey
SSDT F8BD1A2A ZwLoadKey
SSDT F8BD19F8 ZwOpenProcess
SSDT F8BD19FD ZwOpenThread
SSDT F8BD1A34 ZwReplaceKey
SSDT F8BD1A2F ZwRestoreKey
SSDT F8BD1A20 ZwSetValueKey
SSDT F8BD1A07 ZwTerminateProcess

—- Devices - GMER 1.0.15 —-

Device \Driver\Tcpip \Device\Ip socketlock.sys
Device \Driver\Tcpip \Device\Ip avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device \Driver\Tcpip \Device\Tcp socketlock.sys
Device \Driver\Tcpip \Device\Tcp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \Driver\Tcpip \Device\Udp socketlock.sys
Device \Driver\Tcpip \Device\Udp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \Driver\Tcpip \Device\RawIp socketlock.sys
Device \Driver\Tcpip \Device\RawIp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)
Device \Driver\Tcpip \Device\IPMULTICAST socketlock.sys
Device \Driver\Tcpip \Device\IPMULTICAST avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

—- EOF - GMER 1.0.15 —-

The specified service does not exist as an installed service

ComboFix.exe/data002\32788R22FWJFW\FIND3M.bat;C:\Documents and Settings\Owner\Desktop\ComboFix.exe/data002;Probably BATCH.Virus;;
ComboFix.exe/data002\32788R22FWJFW\psexec.cfexe;C:\Documents and Settings\Owner\Desktop\ComboFix.exe/data002;Program.PsExec.171;;
data002;C:\Documents and Settings\Owner\Desktop;Archive contains infected objects;;
ComboFix.exe;C:\Documents and Settings\Owner\Desktop;Container contains infected objects;Moved.;
ComboFix2.exe/data002\32788R22FWJFW\FIND3M.bat;C:\Documents and Settings\Owner\Desktop\ComboFix2.exe/data002;Probably BATCH.Virus;;
data002;C:\Documents and Settings\Owner\Desktop;Archive contains infected objects;;
ComboFix2.exe;C:\Documents and Settings\Owner\Desktop;Container contains infected objects;Moved.;
scan.vbs;C:\LinhaDefensiva\func;Probably SCRIPT.Virus;Incurable.Moved.;
ZeroSpyware LE.exe;C:\Program Files\FBM Software\ZeroSpyware Limited Edition;Probably STPAGE.Trojan;Incurable.Moved.;
ZSRemovalRestorer.dll;C:\Program Files\FBM Software\ZeroSpyware Limited Edition;Probably STPAGE.Trojan;Incurable.Moved.;
NTService.exe;C:\Program Files\omniformat;Trojan.MulDrop.origin;Incurable.Moved.;
A0006336.EXE;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP14;Program.PsExec.170;Incurable.Moved.;
A0006365.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP14;Probably BATCH.Virus;Incurable.Moved.;
A0006492.EXE;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP14;Program.PsExec.170;Incurable.Moved.;
A0006520.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP14;Probably BATCH.Virus;Incurable.Moved.;
A0006727.exe/data002\32788R22FWJFW\FIND3M.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15\A0006727.exe/data002;Probably BATCH.Virus;;
A0006727.exe/data002\32788R22FWJFW\psexec.cfexe;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15\A0006727.exe/data002;Program.PsExec.171;;
data002;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Archive contains infected objects;;
A0006727.exe;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Container contains infected objects;Moved.;
A0006750.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;Incurable.Moved.;
A0006821.EXE;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Program.PsExec.170;Incurable.Moved.;
A0006852.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;Incurable.Moved.;
A0006949.EXE;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Program.PsExec.170;Incurable.Moved.;
A0006979.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;Incurable.Moved.;
A0007110.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;Incurable.Moved.;
A0007184.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP15;Probably BATCH.Virus;Incurable.Moved.;
A0007364.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP17;Probably BATCH.Virus;Incurable.Moved.;
A0007430.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP17;Probably BATCH.Virus;Incurable.Moved.;
A0007572.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP17;Probably BATCH.Virus;Incurable.Moved.;
A0007660.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP17;Probably BATCH.Virus;Incurable.Moved.;
A0007694.exe/data002\32788R22FWJFW\FIND3M.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP17\A0007694.exe/data002;Probably BATCH.Virus;;
data002;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP17;Archive contains infected objects;;
A0007694.exe;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP17;Container contains infected objects;Moved.;
A0007714.exe/data002\32788R22FWJFW\FIND3M.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP18\A0007714.exe/data002;Probably BATCH.Virus;;
A0007714.exe/data002\32788R22FWJFW\psexec.cfexe;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP18\A0007714.exe/data002;Program.PsExec.171;;
data002;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP18;Archive contains infected objects;;
A0007714.exe;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP18;Container contains infected objects;Moved.;
A0007715.exe/data002\32788R22FWJFW\FIND3M.bat;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP18\A0007715.exe/data002;Probably BATCH.Virus;;
data002;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP18;Archive contains infected objects;;
A0007715.exe;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP18;Container contains infected objects;Moved.;
A0007716.exe;C:\System Volume Information\_restore{CD0BACDB-7BB8-4982-9127-7CA9CF228C78}\RP18;Trojan.MulDrop.origin;Incurable.Moved.;

Tomk

Post #40May 21, 2009, 1:17 AM UTC

dogbreath666, DrWebcurit may have borked your ZeroSpyware. Does it still run? If so, what is it telling you now?

dogbreath666

Post #41May 22, 2009, 1:25 AM UTC

Hi Tomk, You would be correct. Zerospyware is currently borked. Deleted the .exe. Will download another copy and try again. j

Tomk

Post #42May 22, 2009, 4:39 AM UTC

dogbreath666

Post #43May 22, 2009, 5:03 PM UTC

Hi Tomk, Reset Zerospyware LE last night from a zip that I had. It came up with a bunch of stuff the first run. However that database was old and after I updated to the latest database the next run was clean. Do you think that the first run with an old database was false positives? Prior to this it would clean the detections and immediately I ran another scan there would be several new detections. I haven't been connected when I ran the scans, nor has this computer been connected as much recently. That might make a difference. Here is the log file from the first scan. let me know what you think. Could be that your help has finally cleaned the machine. Thanks. jon FBM Software ZeroSpyware Version 2.1.29.4 Scan Started: May 21, 2009 08:37 PM Scan Ended: May 21, 2009 08:38 PM Scan Summary: ¯¯¯¯¯¯¯¯¯¯¯¯¯ Spyware Application(s) Found: 6 Scanned Drive(s): Drive C:,D:,E: Total Scanning Time: 00:00:29.03 Total Component(s) Scanned: 30243 Total Spyware Component(s) Identified: 12 Total Process(es) Scanned: 32 Spyware Process(es) Found: 0 File(s) Scanned: 1318 Spyware File Component(s): 0 Registry Entries Scanned: 28893 Spyware Registry Component(s): 12 Spyware Folder Component(s): 0 Spyware Components: ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ Application Name: ISTBar Classification: Browser Hijacker Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\slotch.com\ Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\slotch.com\ Value Name: * Application Name: CoolWebSearch Classification: Chronic Spyware Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoolbar.com\ Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoolbar.com\ Value Name: * Application Name: Blazefind.IESearchbar Classification: Adware Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\blazefind.com\ Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\blazefind.com\ Value Name: * Application Name: ZestyFind Classification: Adware Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\zestyfind.com\ Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\zestyfind.com\ Value Name: * Application Name: CWS.SearchMiracle Classification: Browser Hijacker Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\searchmiracle.com\ Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\searchmiracle.com\ Value Name: * Application Name: Wind Updates Classification: Adware Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\windupdates.com\ Registry Key: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\internet settings\zonemap\domains\windupdates.com\ Value Name: *

Tomk

Post #44May 22, 2009, 8:56 PM UTC

dogbreath666, Those are all rather simplistic adware infections. Virtually any scanner should remove those. They didn't show up in anything we did earlier so I don't know where they came from. I know nothing about Zerospyware so I don't know what it may or may not find correctly. It sounds like things are working correctly and I believe we're run everything to ground. Are you ready to cleanup and do some housekeeping?

dogbreath666

Post #45May 22, 2009, 9:18 PM UTC

Hi Tomk, Things look pretty good from here. I tried Zerospyware a couple of years ago to chase another problem. It came recommended from another forum and it has worked well for me. Seems to run fast and have a reasonable overhead. I am still a little puzzled by the persistence of the AVG code after that software was un-installed. I guess I should track down why they persist and how to remove orphan items, i.e. that remain after programs are un-installed, like that. Thanks for your help. Housekeeping sounds fine. j

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] banker, win32.zbot, kb908xxx

✨ Ask AI

Ask AI