[Resolved] uacinit.dll: Please help remove malicous malware

buttergun909 Topic Starter

Post #1June 7, 2009, 11:26 PM UTC last edited June 8, 2009, 2:04 AM UTC

Hello,

I got this malware a few days ago, and with help from another board, I've been able to discern that uacinit.dll is the problem. I found a few threads here on this particular problem, and it seems all of you have been able to help people get rid of the problem. So, I'm hoping you can help me, too!

I've ran several reports, which I will paste and attach. Below I will paste the DDS.txt and the GMER.txt. I will attach the ATTACH.tx.

Please let me know if anything can be done. I really appreciate any help. Thanks!

DDS.txt:

DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 23:31:06.93 on Sat 06/06/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.333 [GMT -5:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Documents and Settings\Joe\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/webhp?complete=0&hl=en
mDefault_Page_URL = hxxp://www.dell.com
mStart Page = hxxp://www.dell.com
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: : {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ModemOnHold] c:\program files\netwaiting\netWaiting.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [DellTransferAgent] "c:\documents and settings\all users\application data\dell\transferagent\TransferAgent.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall
mRun: [ShStatEXE] "c:\program files\network associates\virusscan\SHSTAT.EXE" /STANDALONE
mRun: [McAfeeUpdaterUI] "c:\program files\network associates\common framework\UpdaterUI.exe" /StartedFromRunKey
mRun: [Network Associates Error Reporting Service] "c:\program files\common files\network associates\talkback\tbmon.exe"
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_06\bin\jusched.exe"
mRun: [mxomssmenu] "c:\program files\maxtor\onetouch status\maxmenumgr.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\GetFlash.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: turbotax.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: ckpNotify - ckpNotify.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

============= SERVICES / DRIVERS ===============

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2006-4-29 58464]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-5-26 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-5-26 72944]
R2 Maxtor Sync Service;Maxtor Service;c:\program files\maxtor\sync\SyncServices.exe [2007-9-28 156976]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2006-4-29 102463]
R2 McTaskManager;Network Associates Task Manager;c:\program files\network associates\virusscan\vstskmgr.exe [2004-9-22 28672]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [2006-4-29 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [2006-4-29 670128]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [2006-4-29 2041904]
S3 McShield;Network Associates McShield;c:\program files\network associates\virusscan\mcshield.exe [2004-9-22 221191]
S3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys [2006-4-29 108480]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [2006-4-29 14924]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-5-26 7408]

============== File Associations ===============

scrfile="%1" %*

=============== Created Last 30 ================

2009-06-05 22:10 –d—– c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-06-05 22:09 –d—– c:\program files\SUPERAntiSpyware
2009-06-05 22:09 –d—– c:\docume~1\joe\applic~1\SUPERAntiSpyware.com
2009-06-05 22:08 –d—– c:\program files\common files\Wise Installation Wizard
2009-06-05 22:07 –d—– c:\program files\Windows Installer Clean Up
2009-06-05 22:07 –d—– c:\program files\MSECACHE
2009-06-04 22:46 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-04 22:46 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-06-04 22:46 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-06-03 23:32 102,664 a——- c:\windows\system32\drivers\tmcomm.sys
2009-06-03 23:31 –d—– c:\documents and settings\joe\.housecall6.6
2009-05-25 20:02 1,720,086 a——- c:\windows\system32\TmpA2069984
2009-05-23 02:38 225,280 a——- c:\windows\system32\rewire.dll
2009-05-23 02:38 1,294,336 a——- c:\windows\system32\vorbis.acm
2009-05-23 02:35 –d—– c:\program files\Image-Line
2009-05-23 02:35 1,777,664 a——- c:\windows\system32\gdiplus.dll
2009-05-23 01:07 –d—– C:\ConverterOutput
2009-05-23 01:06 –d—– c:\program files\Cucusoft

==================== Find3M ====================

2009-03-29 20:46 249,856 a——- c:\windows\system32\pdfmona.dll
2009-03-29 20:46 51,716 a——- c:\windows\system32\pdf995mon.dll
2007-11-08 20:35 246 a——- c:\program files\common files\rybiv
2007-02-10 00:56 491,768 a——- c:\program files\ie6setup.exe
2009-02-03 14:37 152 —shr– c:\windows\system32\987C99206F.sys
2009-02-03 14:37 7,518 a–sh— c:\windows\system32\KGyGaAvL.sys

============= FINISH: 23:32:16.95 ===============

GMER.txt:

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-07 15:29:02
Windows 5.0.2195

—- System - GMER 1.0.15 —-

Code 8627F8C8 ZwEnumerateKey
Code 85F8E9A0 ZwFlushInstructionCache
Code 8651900E IofCallDriver
Code 8633EE7E IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!IofCallDriver 804EE0F6 5 Bytes JMP 86519013
.text ntkrnlpa.exe!IofCompleteRequest 804EE186 5 Bytes JMP 8633EE83
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 805AAEDE 5 Bytes JMP 85F8E9A4
PAGE ntkrnlpa.exe!ZwEnumerateKey 80619A6E 5 Bytes JMP 8627F8CC

—- User code sections - GMER 1.0.15 —-

.text C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe[140] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0098000A
.text C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe[140] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0099000A
.text C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe[192] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A3000A
.text C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe[192] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A4000A
.text C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe[248] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0091000A
.text C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe[248] ntdll.dll!LdrUnloadDll 7C91718B 3 Bytes JMP 0092000A
.text C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe[248] ntdll.dll!LdrUnloadDll + 4 7C91718F 1 Byte [84]
.text C:\WINDOWS\system32\WLTRAY.exe[256] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B3000A
.text C:\WINDOWS\system32\WLTRAY.exe[256] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B4000A
.text C:\Program Files\iTunes\iTunesHelper.exe[300] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0098000A
.text C:\Program Files\iTunes\iTunesHelper.exe[300] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0099000A
.text C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe[308] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0099000A
.text C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe[308] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009A000A
.text C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe[468] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A2000A
.text C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe[468] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A3000A
.text C:\Program Files\DellSupport\DSAgnt.exe[532] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009C000A
.text C:\Program Files\DellSupport\DSAgnt.exe[532] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009D000A
.text C:\Program Files\Windows Media Player\WMPNetwk.exe[548] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0076000A
.text C:\Program Files\Windows Media Player\WMPNetwk.exe[548] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0077000A
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[592] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 007E000A
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[592] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0081000A
.text C:\Program Files\Windows Media Player\WMPNSCFG.exe[684] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0086000A
.text C:\Program Files\Windows Media Player\WMPNSCFG.exe[684] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0087000A
.text C:\WINDOWS\system32\winlogon.exe[704] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0063000A
.text C:\WINDOWS\system32\winlogon.exe[704] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\services.exe[748] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0063000A
.text C:\WINDOWS\system32\services.exe[748] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\lsass.exe[760] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006E000A
.text C:\WINDOWS\system32\lsass.exe[760] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0071000A
.text C:\WINDOWS\System32\alg.exe[1232] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006E000A
.text C:\WINDOWS\System32\alg.exe[1232] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 006F000A
.text C:\WINDOWS\system32\spoolsv.exe[1560] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0096000A
.text C:\WINDOWS\system32\spoolsv.exe[1560] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0097000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1660] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006B000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1660] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 006C000A
.text C:\Program Files\Maxtor\Sync\SyncServices.exe[1744] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A5000A
.text C:\Program Files\Maxtor\Sync\SyncServices.exe[1744] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A7000A
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1796] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006D000A
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1796] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 006E000A
.text C:\Program Files\Network Associates\VirusScan\vstskmgr.exe[1876] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006D000A
.text C:\Program Files\Network Associates\VirusScan\vstskmgr.exe[1876] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 006E000A
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[1900] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006C000A
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[1900] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 006D000A
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1920] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0099000A
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1920] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009A000A
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[1996] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009B000A
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[1996] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009C000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2056] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A7000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2056] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A8000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2056] WININET.dll!HttpAddRequestHeadersA 771C40B2 5 Bytes JMP 00B3000C
.text C:\Program Files\Internet Explorer\Iexplore.exe[2056] WININET.dll!HttpAddRequestHeadersW 771CEF4C 5 Bytes JMP 00BE000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[2056] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00BFF9F0 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2056] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00C008A0 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2056] WS2_32.dll!send 71AB428A 5 Bytes JMP 00C00780 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2056] WS2_32.dll!gethostbyname 71AB4FD4 5 Bytes JMP 00BFFDA0 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[2056] WS2_32.dll!closesocket 71AB9639 5 Bytes JMP 00C00A60 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\Program Files\iPod\bin\iPodService.exe[2372] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0071000A
.text C:\Program Files\iPod\bin\iPodService.exe[2372] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0072000A
.text C:\Documents and Settings\Joe\Desktop\bunny.scr.exe[2416] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B5000A
.text C:\Documents and Settings\Joe\Desktop\bunny.scr.exe[2416] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B6000A
.text c:\program files\common files\installshield\updateservice\isuspm.exe[2948] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0097000A
.text c:\program files\common files\installshield\updateservice\isuspm.exe[2948] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0098000A
.text C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe[2956] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009E000A
.text C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe[2956] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009F000A
.text C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe[3176] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00AD000A
.text C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe[3176] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AE000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[3416] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A7000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[3416] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A8000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[3416] WININET.dll!HttpAddRequestHeadersA 771C40B2 5 Bytes JMP 00B3000C
.text C:\Program Files\Internet Explorer\Iexplore.exe[3416] WININET.dll!HttpAddRequestHeadersW 771CEF4C 5 Bytes JMP 00BE000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[3416] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00BFF9F0 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[3416] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00C008A0 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[3416] WS2_32.dll!send 71AB428A 5 Bytes JMP 00C00780 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[3416] WS2_32.dll!gethostbyname 71AB4FD4 5 Bytes JMP 00BFFDA0 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[3416] WS2_32.dll!closesocket 71AB9639 5 Bytes JMP 00C00A60 \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
.text C:\WINDOWS\Explorer.EXE[3604] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00AA000A
.text C:\WINDOWS\Explorer.EXE[3604] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AB000A
.text C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe[3648] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00C8000A
.text C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe[3648] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00C9000A
.text C:\WINDOWS\system32\ctfmon.exe[3880] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0097000A
.text C:\WINDOWS\system32\ctfmon.exe[3880] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0098000A
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[3908] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009D000A
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[3908] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009E000A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3932] ntdll.dll!LdrLoadDll 7C9161CA 3 Bytes JMP 0092000A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3932] ntdll.dll!LdrLoadDll + 4 7C9161CE 1 Byte [84]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3932] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0093000A
.text C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE[4040] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0095000A
.text C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE[4040] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0096000A
.text C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe[4060] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0095000A
.text C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe[4060] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0096000A
.text C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe[4080] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0097000A
.text C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe[4080] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0098000A

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip Scap.sys (Check Point Software Technologies)
AttachedDevice \Driver\Tcpip \Device\Ip mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Scap.sys (Check Point Software Technologies)
AttachedDevice \Driver\Tcpip \Device\Udp mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Scap.sys (Check Point Software Technologies)
AttachedDevice \Driver\Tcpip \Device\RawIp Scap.sys (Check Point Software Technologies)
AttachedDevice \Driver\Tcpip \Device\RawIp mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)

Device \FileSystem\Fastfat \Fat A8D9FC8A
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\UACxtciihkobvukjrq.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [916] 0x029B0000
Library \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1028] 0x00890000
Library \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1072] 0x00890000
Library \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1132] 0x00890000
Library \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1208] 0x00890000
Library \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1720] 0x00890000
Library \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [2056] 0x00BF0000
Library \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [3416] 0x00BF0000
Library \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\IEXPLORE.EXE [3716] 0x00BF0000

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\UACkcmyktuwuyxiddb.sys (*** hidden *** ) [SYSTEM] UACd.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACkcmyktuwuyxiddb.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACkcmyktuwuyxiddb.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACgroqpxdaiqjitbo.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACntrgtvsjdyiejax.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACetephdptpxbrelj.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACnosqlrgsbswwfwa.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACiqmlbwhtsvalfvq.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacmal \\?\globalroot\systemroot\system32\UACdomqieruwpyqdyx.db
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacrem \\?\globalroot\systemroot\system32\UACxtciihkobvukjrq.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACcofmkbapdnxtqgx.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACnlxdontvnnseyvv.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACxusrkqbjqmqyuky.log
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACkcmyktuwuyxiddb.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACkcmyktuwuyxiddb.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACgroqpxdaiqjitbo.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACntrgtvsjdyiejax.dat
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACetephdptpxbrelj.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACnosqlrgsbswwfwa.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACiqmlbwhtsvalfvq.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacmal \\?\globalroot\systemroot\system32\UACdomqieruwpyqdyx.db
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacrem \\?\globalroot\systemroot\system32\UACxtciihkobvukjrq.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACqldkboqehkhvyof.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACcofmkbapdnxtqgx.log
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACnlxdontvnnseyvv.log
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACxusrkqbjqmqyuky.log
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion@ProductName Microsoft Windows XP
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion@CurrentVersion 5.1
Reg HKLM\SOFTWARE\Classes\UACTLS.UAAddressBookButtonCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UAAddressBookButtonCtrl.5@ UAAddressBookBttn Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UAAddressBookButtonCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UAAddressBookButtonCtrl.5\CLSID@ {C0E10003-001C-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UAButtonCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UAButtonCtrl.5@ UAButton Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UAButtonCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UAButtonCtrl.5\CLSID@ {C0E10003-0007-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UACheckBoxCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UACheckBoxCtrl.5@ UACheckBox Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UACheckBoxCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UACheckBoxCtrl.5\CLSID@ {C0E10003-0013-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UADropDwnCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UADropDwnCtrl.5@ UADropDown Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UADropDwnCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UADropDwnCtrl.5\CLSID@ {C0E10003-000A-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UAEditCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UAEditCtrl.5@ UAEdit Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UAEditCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UAEditCtrl.5\CLSID@ {C0E10003-0023-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGalleryButtonCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGalleryButtonCtrl.5@ UAGalleryBttn Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGalleryButtonCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGalleryButtonCtrl.5\CLSID@ {C0E10003-0010-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGalleryCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGalleryCtrl.5@ UAGallery Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGalleryCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGalleryCtrl.5\CLSID@ {C0E10003-0019-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGraphicDropDown.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGraphicDropDown.5@ UAGraphicDropDown Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGraphicDropDown.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UAGraphicDropDown.5\CLSID@ {C0E10003-0026-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UAHelpCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UAHelpCtrl.5@ UAHelp Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UAHelpCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UAHelpCtrl.5\CLSID@ {C0E10003-002F-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UAPartsListCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UAPartsListCtrl.5@ UAPartsList Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UAPartsListCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UAPartsListCtrl.5\CLSID@ {C0E10003-000D-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UARadioBttnCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UARadioBttnCtrl.5@ UARadioButton Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UARadioBttnCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UARadioBttnCtrl.5\CLSID@ {C0E10003-0016-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UAScrapBookButtonCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UAScrapBookButtonCtrl.5@ UAScrapBookBttn Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UAScrapBookButtonCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UAScrapBookButtonCtrl.5\CLSID@ {C0E10003-001F-0005-C0E1-C0E1C0E1C0E1}
Reg HKLM\SOFTWARE\Classes\UACTLS.UATextCtrl.5
Reg HKLM\SOFTWARE\Classes\UACTLS.UATextCtrl.5@ UAText Control
Reg HKLM\SOFTWARE\Classes\UACTLS.UATextCtrl.5\CLSID
Reg HKLM\SOFTWARE\Classes\UACTLS.UATextCtrl.5\CLSID@ {C0E10003-002C-0005-C0E1-C0E1C0E1C0E1}

—- Files - GMER 1.0.15 —-

File C:\Documents and Settings\Joe\Favorites\uacinit.dll Please help remove malicous malware!.url 253 bytes
File C:\Documents and Settings\Joe\Local Settings\Temp\UACd4f3.tmp 343040 bytes executable
File C:\WINDOWS\system32\drivers\UACkcmyktuwuyxiddb.sys 53248 bytes executable <– ROOTKIT !!!
File C:\WINDOWS\system32\UACcofmkbapdnxtqgx.log 44335 bytes
File C:\WINDOWS\system32\UACdomqieruwpyqdyx.db 1110399 bytes
File C:\WINDOWS\system32\UACetephdptpxbrelj.dll 19968 bytes executable
File C:\WINDOWS\system32\UACgroqpxdaiqjitbo.dll 25088 bytes executable
File C:\WINDOWS\system32\uacinit.dll 5712 bytes
File C:\WINDOWS\system32\UACiqmlbwhtsvalfvq.dll 19456 bytes executable
File C:\WINDOWS\system32\UACnosqlrgsbswwfwa.dll 17408 bytes executable
File C:\WINDOWS\system32\UACntrgtvsjdyiejax.dat 224 bytes
File C:\WINDOWS\system32\UACqldkboqehkhvyof.dll 66560 bytes
File C:\WINDOWS\system32\uactmp.db 3976714 bytes
File C:\WINDOWS\system32\UACxtciihkobvukjrq.dll 30208 bytes executable
File C:\WINDOWS\TEMP\UAC8e7f.tmp 66560 bytes

—- EOF - GMER 1.0.15 —-

My PC is running fine – only issue is, if I do a Google search, the font displays too large. Also, I can't open any spyware programs, ie Malware Anti Bytes or Spybot. Double-clicking, right-clicking, etc, do not work – the only thing that does is renaming the program, right-clicking, clicking the Properties button, and setting in the Compatibility mode to run on Windows 2000. But other than that – no popups or anthing.

Thanks!!

EDIT: One strange thing I have noticed – I can't add favorites anymore. I keep adding this post as a favorite, but it won't display in my Favorites dropdown…I get a listing stating "empty," which links to nothing. ALSO, my history shows websites I have NOT visited…creepy!

Attachments:

📎Attach.txt

oldman960

Post #2June 8, 2009, 6:16 AM UTC

Hi , welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Please read through the instructions to familiarize yourself with what to expect when the tool runs.

If you all ready have combofix on your computer please delete combofix.exe from your desktop.

It is vitally important that combofix is renamed before it is even started to download

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
-Tools->Options->Main tab
-Set to "Always ask me where to Save the files".
During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]

It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.

———————————————————–

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

———————————————————–

Double click on ComboFix.exe & follow the prompts. Close all browsers/windows first.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not run combofix more than once. If you have problems, please post back for additional instructions.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with

combofix log

Let us know how the computer is at the moment and any problems you are having.

Thanks

buttergun909

Post #3June 9, 2009, 2:31 AM UTC last edited June 9, 2009, 2:33 AM UTC

Thanks for the reply.

I followed instructions and ran Combo Fix. I've attached the log as a text file, and also pasted it below.

Also, when I first ran it, I got a message stating that it had detected Rootkit Activity and needed to reboot. Here are the items it detected, which it asked me to write down:

C:WINDOWS/SYSTEM32/DRIVERS/UACKCmyktuwuyxiddb.sys
C:WINDOWS/SYSTEM32/UASgroqpxdaiqjitbo.dll
C:WINDOWS/SYSTEM32/UACntgtvsjdyiejax.dat
C:WINDOWS/SYSTEM32/UACetephdptpxbrelj.dll
C:WINDOWS/SYSTEM32/UACnosqlegsbswwfwa.dll
C:WINDOWS/SYSTEM32/UACiqmlbwhtsvalfvq.dll
C:WINDOWS/SYSTEM32/UACdomqierawpyqdyx.db
C:WINDOWS/SYSTEM32/UACxtciihkobvukjrq.dll
C:WINDOWS/SYSTEM32/UACqldkboqehkhvyof.dll
C:WINDOWS/SYSTEM32/UACcofmkbapdnxtqgx.log
C:WINDOWS/SYSTEM32/UACnlxdontvnnseyvv.log
C:WINDOWS/SYSTEM32/UACusrkqbjqmqyuky.log

And here is the Combo Fix log:

ComboFix 09-06-08.02 - Joe 06/08/2009 19:06.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.708 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\b136.exe.bin
c:\windows\IE4 Error Log.txt
c:\windows\system32\drfdovek.ini
c:\windows\system32\drivers\UACkcmyktuwuyxiddb.sys
c:\windows\system32\eayebmgc.ini
c:\windows\system32\fogyonma.ini
c:\windows\system32\iinxkmch.ini
c:\windows\system32\jcmfndbt.ini
c:\windows\system32\keqybnwp.ini
c:\windows\system32\kiycplpw.ini
c:\windows\system32\loywyvpw.ini
c:\windows\system32\mcikuwja.ini
c:\windows\system32\mimcmwjn.ini
c:\windows\system32\mqdhkjfh.ini
c:\windows\system32\oqpikxgi.ini
c:\windows\system32\pkuilrfa.ini
c:\windows\system32\UACcofmkbapdnxtqgx.log
c:\windows\system32\UACdomqieruwpyqdyx.db
c:\windows\system32\UACetephdptpxbrelj.dll
c:\windows\system32\UACgroqpxdaiqjitbo.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACiqmlbwhtsvalfvq.dll
c:\windows\system32\UACnlxdontvnnseyvv.log
c:\windows\system32\UACnosqlrgsbswwfwa.dll
c:\windows\system32\UACntrgtvsjdyiejax.dat
c:\windows\system32\UACqldkboqehkhvyof.dll
c:\windows\system32\UACxtciihkobvukjrq.dll
c:\windows\system32\UACxusrkqbjqmqyuky.log
c:\windows\system32\wdsvtuma.ini
c:\windows\system32\xtbjlrhu.ini
c:\windows\system32\xukeoqxs.ini
c:\windows\system32\ybuvseht.ini
c:\windows\system32\ygcsdahx.ini
c:\windows\system32\yvlavilr.ini
C:\xcrashdump.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-05-09 to 2009-06-09 )))))))))))))))))))))))))))))))
.

2009-06-06 03:11 . 2009-06-06 07:25 117760 —-a-w- c:\documents and settings\Joe\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-06 03:10 . 2009-06-06 03:10 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-06 03:09 . 2009-06-06 07:27 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-06-06 03:09 . 2009-06-06 03:09 ——– d—–w- c:\documents and settings\Joe\Application Data\SUPERAntiSpyware.com
2009-06-06 03:08 . 2009-06-06 03:08 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-06-06 03:07 . 2009-06-06 03:07 3584 —-a-r- c:\documents and settings\Joe\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-06-06 03:07 . 2009-06-06 03:07 ——– d—–w- c:\program files\Windows Installer Clean Up
2009-06-06 03:07 . 2009-06-06 03:07 ——– d—–w- c:\program files\MSECACHE
2009-06-05 03:46 . 2009-05-26 18:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-05 03:46 . 2009-06-06 02:56 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-05 03:46 . 2009-05-26 18:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-04 04:32 . 2009-06-04 04:31 102664 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2009-06-04 04:31 . 2009-06-04 04:34 ——– d—–w- c:\documents and settings\Joe\.housecall6.6
2009-05-24 21:11 . 2009-05-24 21:11 ——– d—–w- c:\documents and settings\Joe\Application Data\DivX
2009-05-23 07:38 . 2006-06-20 15:56 225280 —-a-w- c:\windows\system32\rewire.dll
2009-05-23 07:35 . 2009-05-23 07:38 ——– d—–w- c:\program files\Image-Line
2009-05-23 07:35 . 2003-06-20 18:28 1777664 —-a-w- c:\windows\system32\gdiplus.dll
2009-05-23 06:07 . 2009-05-23 06:07 ——– d—–w- C:\ConverterOutput
2009-05-23 06:06 . 2009-02-26 21:34 94650 —-a-w- c:\windows\system32\HKCU_GNU.reg
2009-05-23 06:06 . 2009-02-26 21:34 2004 —-a-w- c:\windows\system32\HKLM_GNU.reg
2009-05-23 06:06 . 2008-12-18 06:22 57344 —-a-w- c:\windows\system32\ff_vfw.dll
2009-05-23 06:06 . 2008-06-15 15:01 60273 —-a-w- c:\windows\system32\pthreadGC2.dll
2009-05-23 06:06 . 2008-06-15 15:01 258352 —-a-w- c:\windows\system32\unicows.dll
2009-05-23 06:06 . 2008-02-04 02:26 364544 —-a-w- c:\windows\system32\cdg.dll
2009-05-23 06:06 . 2006-09-27 22:46 348160 —-a-w- c:\windows\system32\cdga.dll
2009-05-23 06:06 . 2006-07-18 02:42 14909 —-a-w- c:\windows\system32\A_reg.reg
2009-05-23 06:06 . 2009-05-23 06:06 ——– d—–w- c:\program files\Cucusoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-26 01:03 . 2007-04-13 00:20 ——– d–h–w- c:\documents and settings\Joe\Application Data\Move Networks
2009-05-24 21:17 . 2009-02-15 08:55 ——– d—–w- c:\documents and settings\Joe\Application Data\uTorrent
2009-05-01 00:24 . 2008-06-18 01:20 ——– d—–w- c:\documents and settings\Leanne\Application Data\Move Networks
2009-04-06 03:35 . 2009-04-06 03:35 1205677 —-a-w- c:\documents and settings\All Users\Application Data\TaxCut\2008\Update\US68017101lupd.exe
2009-03-31 03:35 . 2007-05-12 10:38 89880 —-a-w- c:\documents and settings\Leanne\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-30 01:46 . 2009-03-30 01:46 51716 —-a-w- c:\windows\system32\pdf995mon.dll
2009-03-30 01:46 . 2009-03-30 01:46 249856 —-a-w- c:\windows\system32\pdfmona.dll
2009-03-29 22:06 . 2009-03-29 22:03 27660784 —-a-w- c:\documents and settings\All Users\Application Data\TaxCut\2008\Update\US45016801lupd.exe
2009-03-24 00:56 . 2009-03-04 04:38 34062 —-a-w- c:\documents and settings\Leanne\Application Data\Move Networks\ie_bin\Uninst.exe
2009-03-24 00:56 . 2009-03-24 00:55 1048200 —-a-w- c:\documents and settings\Leanne\Application Data\Move Networks\MoveMediaPlayer_071303000004.exe
2007-11-09 01:35 . 2007-06-10 23:53 246 —-a-w- c:\program files\Common Files\rybiv
2007-02-10 05:56 . 2007-02-10 05:56 491768 —-a-w- c:\program files\ie6setup.exe
2009-02-03 19:37 . 2006-04-19 06:42 152 –sh–r- c:\windows\system32\987C99206F.sys
2009-02-03 19:37 . 2006-04-19 06:42 7518 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellTransferAgent"="c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 135168]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-13 1117184]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-23 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\tbmon.exe" [2003-10-07 147514]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-12-11 267048]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
2005-03-02 00:49 24672 —-a-w- c:\windows\system32\ckpNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Joe\\Desktop\\utorrent.exe"=

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [4/29/2006 5:50 PM 58464]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [4/29/2006 6:17 PM 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [4/29/2006 6:17 PM 670128]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [4/29/2006 6:17 PM 2041904]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [4/29/2006 6:17 PM 14924]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-ModemOnHold - c:\program files\NetWaiting\netWaiting.exe
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\GetFlash.exe
SafeBoot-procexp90.Sys

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/webhp?complete=0&hl=en
mStart Page = hxxp://www.dell.com
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: turbotax.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-08 19:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(708)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-06-09 19:15
ComboFix-quarantined-files.txt 2009-06-09 00:15
ComboFix2.txt 2007-11-16 05:26

Pre-Run: 41,551,122,432 bytes free
Post-Run: 43,687,243,776 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

181

I've also attached the log as a text file.

How computer is running at the moment: Fine so far, but again, I see websites in my history that I have not visited today. I'm not even using the computer at all; just booted it up to run Combo Fix and post the results.

Please let me know how to proceed.

Thanks again!

Attachments:

📎COMBO_FIX_LOG.txt

oldman960

Post #4June 9, 2009, 6:20 AM UTC

Hi buttergun909,

My pleasure.

We will use combofix again, but run it differently.

Please follow all previous instructions regarding security programs.

Do not run this more than once. If you have problems, please post back for further instructions.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

Do Not copy the word CODE

File::
C:\WINDOWS\system32\uactmp.db
C:\Documents and Settings\Joe\Local Settings\Temp\UACd4f3.tmp
C:\WINDOWS\TEMP\UAC8e7f.tmp

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Next

You have this program installed, Malwarebytes' Anti-Malware (MBAM).

Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next

Please run DDS again and post only the Attach.txt. For some reason part of the origonal was blank.

Please post back with

combofix log
MBAM log
Attach.txt

Please describe any symptoms remaining.

Thanks

buttergun909

Post #5June 10, 2009, 3:03 AM UTC last edited June 10, 2009, 3:03 AM UTC

Things seem to be looking up – I ran MBAM, and it didn't find any harmful items.

First I'll paste the combofix log below:

ComboFix 09-06-08.02 - Joe 06/09/2009 21:18.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.656 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Joe\Desktop\CFScript.txt
* Created a new restore point

FILE ::
"c:\documents and settings\Joe\Local Settings\Temp\UACd4f3.tmp"
"c:\windows\system32\uactmp.db"
"c:\windows\TEMP\UAC8e7f.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\uactmp.db

.
((((((((((((((((((((((((( Files Created from 2009-05-10 to 2009-06-10 )))))))))))))))))))))))))))))))
.

2009-06-06 03:11 . 2009-06-06 07:25 117760 —-a-w- c:\documents and settings\Joe\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-06 03:10 . 2009-06-06 03:10 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-06 03:09 . 2009-06-06 07:27 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-06-06 03:09 . 2009-06-06 03:09 ——– d—–w- c:\documents and settings\Joe\Application Data\SUPERAntiSpyware.com
2009-06-06 03:08 . 2009-06-06 03:08 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-06-06 03:07 . 2009-06-06 03:07 3584 —-a-r- c:\documents and settings\Joe\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-06-06 03:07 . 2009-06-06 03:07 ——– d—–w- c:\program files\Windows Installer Clean Up
2009-06-06 03:07 . 2009-06-06 03:07 ——– d—–w- c:\program files\MSECACHE
2009-06-05 03:46 . 2009-05-26 18:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-05 03:46 . 2009-06-06 02:56 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-05 03:46 . 2009-05-26 18:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-04 04:32 . 2009-06-04 04:31 102664 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2009-06-04 04:31 . 2009-06-04 04:34 ——– d—–w- c:\documents and settings\Joe\.housecall6.6
2009-05-24 21:11 . 2009-05-24 21:11 ——– d—–w- c:\documents and settings\Joe\Application Data\DivX
2009-05-23 07:38 . 2006-06-20 15:56 225280 —-a-w- c:\windows\system32\rewire.dll
2009-05-23 07:35 . 2009-05-23 07:38 ——– d—–w- c:\program files\Image-Line
2009-05-23 07:35 . 2003-06-20 18:28 1777664 —-a-w- c:\windows\system32\gdiplus.dll
2009-05-23 06:07 . 2009-05-23 06:07 ——– d—–w- C:\ConverterOutput
2009-05-23 06:06 . 2009-02-26 21:34 94650 —-a-w- c:\windows\system32\HKCU_GNU.reg
2009-05-23 06:06 . 2009-02-26 21:34 2004 —-a-w- c:\windows\system32\HKLM_GNU.reg
2009-05-23 06:06 . 2008-12-18 06:22 57344 —-a-w- c:\windows\system32\ff_vfw.dll
2009-05-23 06:06 . 2008-06-15 15:01 60273 —-a-w- c:\windows\system32\pthreadGC2.dll
2009-05-23 06:06 . 2008-06-15 15:01 258352 —-a-w- c:\windows\system32\unicows.dll
2009-05-23 06:06 . 2008-02-04 02:26 364544 —-a-w- c:\windows\system32\cdg.dll
2009-05-23 06:06 . 2006-09-27 22:46 348160 —-a-w- c:\windows\system32\cdga.dll
2009-05-23 06:06 . 2006-07-18 02:42 14909 —-a-w- c:\windows\system32\A_reg.reg
2009-05-23 06:06 . 2009-05-23 06:06 ——– d—–w- c:\program files\Cucusoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-26 01:03 . 2007-04-13 00:20 ——– d–h–w- c:\documents and settings\Joe\Application Data\Move Networks
2009-05-24 21:17 . 2009-02-15 08:55 ——– d—–w- c:\documents and settings\Joe\Application Data\uTorrent
2009-05-01 00:24 . 2008-06-18 01:20 ——– d—–w- c:\documents and settings\Leanne\Application Data\Move Networks
2009-04-06 03:35 . 2009-04-06 03:35 1205677 —-a-w- c:\documents and settings\All Users\Application Data\TaxCut\2008\Update\US68017101lupd.exe
2009-03-31 03:35 . 2007-05-12 10:38 89880 —-a-w- c:\documents and settings\Leanne\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-30 01:46 . 2009-03-30 01:46 51716 —-a-w- c:\windows\system32\pdf995mon.dll
2009-03-30 01:46 . 2009-03-30 01:46 249856 —-a-w- c:\windows\system32\pdfmona.dll
2009-03-29 22:06 . 2009-03-29 22:03 27660784 —-a-w- c:\documents and settings\All Users\Application Data\TaxCut\2008\Update\US45016801lupd.exe
2009-03-24 00:56 . 2009-03-04 04:38 34062 —-a-w- c:\documents and settings\Leanne\Application Data\Move Networks\ie_bin\Uninst.exe
2009-03-24 00:56 . 2009-03-24 00:55 1048200 —-a-w- c:\documents and settings\Leanne\Application Data\Move Networks\MoveMediaPlayer_071303000004.exe
2007-11-09 01:35 . 2007-06-10 23:53 246 —-a-w- c:\program files\Common Files\rybiv
2007-02-10 05:56 . 2007-02-10 05:56 491768 —-a-w- c:\program files\ie6setup.exe
2009-02-03 19:37 . 2006-04-19 06:42 152 –sh–r- c:\windows\system32\987C99206F.sys
2009-02-03 19:37 . 2006-04-19 06:42 7518 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellTransferAgent"="c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 135168]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-13 1117184]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-23 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\tbmon.exe" [2003-10-07 147514]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-12-11 267048]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
2005-03-02 00:49 24672 —-a-w- c:\windows\system32\ckpNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Joe\\Desktop\\utorrent.exe"=

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [4/29/2006 5:50 PM 58464]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [4/29/2006 6:17 PM 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [4/29/2006 6:17 PM 670128]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [4/29/2006 6:17 PM 2041904]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [4/29/2006 6:17 PM 14924]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/webhp?complete=0&hl=en
mStart Page = hxxp://www.dell.com
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: turbotax.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-09 21:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(704)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-06-10 21:24
ComboFix-quarantined-files.txt 2009-06-10 02:24
ComboFix2.txt 2009-06-09 00:15
ComboFix3.txt 2007-11-16 05:26

Pre-Run: 43,661,082,624 bytes free
Post-Run: 43,666,079,744 bytes free

139

Here is the MBAM log:

Malwarebytes' Anti-Malware 1.37
Database version: 2256
Windows 5.1.2600 Service Pack 2

6/9/2009 9:53:44 PM
mbam-log-2009-06-09 (21-53-44).txt

Scan type: Quick Scan
Objects scanned: 90237
Time elapsed: 2 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

And I have pasted the ATTACH txt, as well as posted it below:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 4/8/2006 12:54:12 PM
System Uptime: 6/9/2009 9:11:33 PM (0 hours ago)

Motherboard: Dell Inc. | | 0GD366
Processor: Intel® Pentium® M processor 1.70GHz | Microprocessor | 598/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 71 GiB total, 40.677 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: VPN-1 SecureClient Adapter
Device ID: ROOT\NET\0000
Manufacturer: Check Point
Name: VPN-1 SecureClient Adapter
PNP Device ID: ROOT\NET\0000
Service: OMVA

==== System Restore Points ===================

RP56: 3/4/2009 3:25:07 PM - System Checkpoint
RP57: 3/5/2009 3:48:23 PM - System Checkpoint
RP58: 3/7/2009 1:02:26 PM - Installed DeductionPro 2008
RP59: 3/8/2009 6:11:29 PM - System Checkpoint
RP60: 3/10/2009 1:47:58 AM - System Checkpoint
RP61: 3/21/2009 12:41:55 AM - System Checkpoint
RP62: 3/27/2009 11:59:24 PM - System Checkpoint
RP63: 3/29/2009 4:57:11 PM - Removed DeductionPro 2008
RP64: 3/29/2009 5:01:30 PM - Installed TaxCut Premium + Efile 2008.
RP65: 3/29/2009 8:47:03 PM - Printer Driver PDF995 Printer Driver Installed
RP66: 3/31/2009 11:58:52 PM - System Checkpoint
RP67: 4/4/2009 2:32:40 AM - System Checkpoint
RP68: 4/14/2009 10:14:18 PM - System Checkpoint
RP69: 4/18/2009 3:07:07 AM - System Checkpoint
RP70: 4/21/2009 1:35:32 AM - System Checkpoint
RP71: 4/24/2009 11:47:49 PM - System Checkpoint
RP72: 4/26/2009 10:19:40 PM - System Checkpoint
RP73: 5/2/2009 12:02:44 AM - System Checkpoint
RP74: 5/3/2009 1:34:39 AM - System Checkpoint
RP75: 5/5/2009 10:38:00 PM - System Checkpoint
RP76: 5/8/2009 11:33:45 PM - System Checkpoint
RP77: 5/9/2009 11:52:38 PM - System Checkpoint
RP78: 5/12/2009 10:39:26 PM - System Checkpoint
RP79: 5/16/2009 12:56:51 AM - System Checkpoint
RP80: 5/17/2009 1:01:41 AM - System Checkpoint
RP81: 5/20/2009 6:19:34 PM - System Checkpoint
RP82: 5/23/2009 12:26:27 AM - System Checkpoint
RP83: 5/24/2009 11:56:39 AM - System Checkpoint
RP84: 5/25/2009 8:06:07 PM - Removed NetZeroInstallers
RP85: 5/29/2009 11:31:20 PM - System Checkpoint
RP86: 5/30/2009 11:57:19 PM - System Checkpoint
RP87: 6/9/2009 9:17:34 PM - ComboFix created restore point

==== Installed Programs ======================

Adobe Acrobat - Reader 6.0.2 Update
Adobe Flash Player ActiveX
Adobe Reader 6.0.1
Ahead Nero Burning ROM
Amazon MP3 Downloader 1.0.3
AnswerWorks 4.0 Runtime - English
AOLIcon
Apple Mobile Device Support
Apple Software Update
AutoUpdate
CCleaner (remove only)
Check Point VPN-1 SecureClient NG_AI_R56
Conexant HDA D110 MDC V.92 Modem
Corel Paint Shop Pro X
Cucusoft DVD to iPod + iPod Video Converter Suite [removed]
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell System Restore
Dell Wireless WLAN Card
DellSupport
Digital Content Portal
Digital Line Detect
DivX Codec
DVD Shrink 3.2
EducateU
ELIcon
High Definition Audio Driver Package - KB835221
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB906569)
Hotfix for Windows XP (KB908673)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Intel® Graphics Media Accelerator Driver for Mobile
Internal Network Card Power Management
iTunes
Java™ 6 Update 6
Kaspersky Online Scanner
Malwarebytes' Anti-Malware
Maxtor Manager
McAfee VirusScan Enterprise
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Modem Helper
MSXML 4.0 SP2 (KB927978)
MSXML 6.0 Parser
NetWaiting
Pdf995 (installed by TaxCut)
PdfEdit995 (installed by TaxCut)
PowerDVD 5.5
QuickTime
RealPlayer Basic
Rolling Stone - Cover to Cover
Search Assist
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Sonic DLA
Sonic MyDVD LE
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
Spybot - Search & Destroy 1.4
SUPERAntiSpyware Free Edition
Synaptics Pointing Device Driver
TaxCut Premium + Efile 2008
TurboTax Deluxe 2005
TurboTax Deluxe Deduction Maximizer 2006
TurboTax Premier 2007
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925876)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB936357)
URL Assistant
Viewpoint Media Player
WebCyberCoach 3.2 Dell
WebFldrs XP
WexTech AnswerWorks
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Installer Clean Up
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885855
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB889673
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
WordPerfect Office 12

==== Event Viewer Messages From Past Week ========

6/8/2009 6:56:17 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.
6/5/2009 11:04:43 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
6/5/2009 11:04:35 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NaiAvTdi1 NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL Tcpip
6/5/2009 11:04:35 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2009 11:04:35 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2009 11:04:35 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2009 11:04:35 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2009 11:04:35 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2009 11:03:56 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/5/2009 11:03:55 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
6/4/2009 8:08:06 AM, error: Service Control Manager [7000] - The QoS Packet Scheduler service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
6/4/2009 8:08:06 AM, error: Service Control Manager [7000] - The Dell Wireless WLAN Tray Service service failed to start due to the following error: The system cannot find the file specified.
6/3/2009 11:27:47 PM, error: System Error [1003] - Error code 100000d1, parameter1 e1691000, parameter2 00000002, parameter3 00000000, parameter4 aa499b00.

==== End Of File ===========================

No other symptoms yet – no unusual websites in my history, and MBAM actually started when I double-clicked on it! Before this I had to right click and change properties, etc, to get it to run.

Thanks again for your help, and please let me know how to proceed.

Attachments:

📎Attach_new.txt

oldman960

Post #6June 10, 2009, 4:34 AM UTC

Hi buttergun909,

That is progress.

Your Java is out of date.

Go to http://java.sun.com/javase/downloads/index.jsp
Scroll down to "Java Runtime Environment (JRE) 6 Update 14
Click the download button on the right.

If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.

Select the platform (Windows, in your case), mutli language.
Accept the license agreement, click continue.

You do not have to install the Java Web Start ActiveX Control

Scroll down and click on Windows Offline Installation,
Save the file jre-6u13-windows-i586-p.exe to your desktop;

Do not select Run . Do not install it yet.

When the download is complete, close your browser.

Open Control Panel > Add/Remove Programs and uninstall

Java™ 6 Update 6

Do not uninstall Java TM 6 Update 14 if found!

Reboot your computer.

Double-click on the saved file (jre-6u14-windows-i586-p.exe) to install the update.
Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

One more scan just to be sure.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions.
You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
- Mail databases
Click on My Computerr under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Change the Files of type to Text file (.txt)
Set the Save In to Desktop
click the Save button.
Please post this log in your next reply along with a new DDS log (just the DDS.txt).

Thanks

buttergun909

Post #7June 10, 2009, 2:32 PM UTC

Thanks for the reply, and I'll do this when I get home. In the meantime – quick question. I noticed in the Notepad copy I pasted into ComboFix, the db-removal stuff was only for my profile. My wife (the "Leanne" mentioned in all the log-posts above) also has a profile on the PC. Will this remove the malware from her profile as well? I figure if it's removed from the C it's gone from all profiles, but I just wanted to make sure. Thanks again for your help. I will update Java and run scans as soon as I get home this evening.

oldman960

Post #8June 10, 2009, 5:09 PM UTC

Hi buttergun909, The tools we used will scan all files and folders in all user's profiles. The file you are refering as being in your profile was in a temp folder in your profile. It's from the GMER log, I was just checking to make sure it was gone. The other files were in the C:\ directory but not under a specific profile. This infection was set to run from a Local Machine registry key which means it would have ran on all profiles. No bad entries were found in your wife's account. Ok?

buttergun909

Post #9June 10, 2009, 6:43 PM UTC

Fantastic, that's what I thought. Thanks for confirming! I'll be back later tonight with the latest scans and logs. Thanks again for your help!

buttergun909

Post #10June 11, 2009, 4:57 AM UTC

Okay, I updated Java, ran Kaspersky, and re-ran DDS. Here are the logs: Kaspersky Scan Report: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Wednesday, June 10, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Thursday, June 11, 2009 03:58:50 Records in database: 2336168 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 82809 Threat name: 23 Infected objects: 36 Suspicious objects: 0 Duration of the scan: 01:48:51 File name / Threat name / Threats count C:\Documents and Settings\Joe\.housecall6.6\Quarantine\83122[1].exe.bac_a02268 Infected: Email-Worm.Win32.Zhelatin.zb 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\83122[1].exe.bac_a02268 Infected: Trojan-Clicker.HTML.IFrame.dn 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\am52.exe.bac_a02268 Infected: Trojan-Dropper.Win32.Agent.mu 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\backups.zip.bac_a02268 Infected: Trojan-Downloader.Win32.TSUpdate.o 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\backups.zip.bac_a02268 Infected: not-a-virus:AdWare.Win32.Mostofate.u 2 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\backups.zip.bac_a02268 Infected: Trojan-Downloader.Win32.Small.buy 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\backups.zip.bac_a02268 Infected: Rootkit.Win32.Agent.eq 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\backups.zip.bac_a02268 Infected: Trojan-Downloader.Win32.Homles.ac 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\bY001[1].exe.bac_a02268 Infected: not-a-virus:AdWare.Win32.TTC.b 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\bY001[1].exe.bac_a02268 Infected: Trojan-Downloader.Win32.Small.eqn 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\bY001[1].exe.bac_a02268 Infected: not-a-virus:AdWare.Win32.Virtumonde.jp 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\bY001[1].exe.bac_a02268 Infected: Trojan-Dropper.Win32.Agent.mu 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\cktrd0578.exe.bac_a02268 Infected: Trojan-Clicker.Win32.VB.vx 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\hawub0578.exe.bac_a02268 Infected: not-a-virus:AdWare.Win32.ZenoSearch.o 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\jar_cache36875.tmp.bac_a02268 Infected: Trojan.Java.ClassLoader.ap 3 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\NOFCym2lizm5Rw35.exe.bac_a02268 Infected: Trojan.Win32.BHO.nfv 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\retadpu[1].exe.bac_a02268 Infected: Trojan-Downloader.Win32.Homles.z 1 C:\Documents and Settings\Joe\.housecall6.6\Quarantine\T1QaSQ1065.exe.bac_a02268 Infected: Trojan-Downloader.Win32.VB.awj 1 C:\Documents and Settings\Joe\Desktop\SDFix\backups\backups.zip Infected: Rootkit.Win32.Agent.eq 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\UACkcmyktuwuyxiddb.sys.vir Infected: Rootkit.Win32.Agent.lhm 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACetephdptpxbrelj.dll.vir Infected: Packed.Win32.Tdss.m 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACgroqpxdaiqjitbo.dll.vir Infected: Packed.Win32.Tdss.m 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACiqmlbwhtsvalfvq.dll.vir Infected: Trojan.Win32.TDSS.adzz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACnosqlrgsbswwfwa.dll.vir Infected: Trojan.Win32.TDSS.adzx 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACqldkboqehkhvyof.dll.vir Infected: Trojan.Win32.TDSS.aegg 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACxtciihkobvukjrq.dll.vir Infected: Trojan.Win32.TDSS.aekg 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP86\A0031676.sys Infected: Rootkit.Win32.Agent.lhm 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP86\A0031677.dll Infected: Packed.Win32.Tdss.m 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP86\A0031678.dll Infected: Packed.Win32.Tdss.m 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP86\A0031679.dll Infected: Trojan.Win32.TDSS.adzx 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP86\A0031680.dll Infected: Trojan.Win32.TDSS.adzz 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP86\A0031681.dll Infected: Trojan.Win32.TDSS.aekg 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP86\A0031682.dll Infected: Trojan.Win32.TDSS.aegg 1 The selected area was scanned. DDS log (just the txt): DDS (Ver_09-05-14.01) - NTFSx86 Run by [removed] at 23:23:56.76 on Wed 06/10/2009 Internet Explorer: 6.0.2900.2180 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.510 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\vstskmgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Joe\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/webhp?complete=0&hl=en mStart Page = hxxp://www.dell.com uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: : {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup uRun: [DellTransferAgent] "c:\documents and settings\all users\application data\dell\transferagent\TransferAgent.exe" uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall mRun: [ShStatEXE] "c:\program files\network associates\virusscan\SHSTAT.EXE" /STANDALONE mRun: [McAfeeUpdaterUI] "c:\program files\network associates\common framework\UpdaterUI.exe" /StartedFromRunKey mRun: [Network Associates Error Reporting Service] "c:\program files\common files\network associates\talkback\tbmon.exe" mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [mxomssmenu] "c:\program files\maxtor\onetouch status\maxmenumgr.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_03\bin\jusched.exe" IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll Trusted Zone: turbotax.com DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: ckpNotify - ckpNotify.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ============= SERVICES / DRIVERS =============== R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2006-4-29 58464] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-5-26 9968] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-5-26 72944] R2 Maxtor Sync Service;Maxtor Service;c:\program files\maxtor\sync\SyncServices.exe [2007-9-28 156976] R2 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2006-4-29 102463] R2 McTaskManager;Network Associates Task Manager;c:\program files\network associates\virusscan\vstskmgr.exe [2004-9-22 28672] R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [2006-4-29 17456] R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [2006-4-29 670128] R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [2006-4-29 2041904] S3 McShield;Network Associates McShield;c:\program files\network associates\virusscan\mcshield.exe [2004-9-22 221191] S3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys [2006-4-29 108480] S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [2006-4-29 14924] S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-5-26 7408] =============== Created Last 30 ================ 2009-06-10 21:04 69,632 a——- c:\windows\system32\javacpl.cpl 2009-06-09 21:16 –ds—- C:\Combo-Fix 2009-06-08 18:54 a-dshr– C:\cmdcons 2009-06-08 18:52 161,792 a——- c:\windows\SWREG.exe 2009-06-08 18:52 155,136 a——- c:\windows\PEV.exe 2009-06-08 18:52 98,816 a——- c:\windows\sed.exe 2009-06-05 22:10 –d—– c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2009-06-05 22:09 –d—– c:\program files\SUPERAntiSpyware 2009-06-05 22:09 –d—– c:\docume~1\joe\applic~1\SUPERAntiSpyware.com 2009-06-05 22:08 –d—– c:\program files\common files\Wise Installation Wizard 2009-06-05 22:07 –d—– c:\program files\Windows Installer Clean Up 2009-06-05 22:07 –d—– c:\program files\MSECACHE 2009-06-04 22:46 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-04 22:46 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-06-04 22:46 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-06-03 23:32 102,664 a——- c:\windows\system32\drivers\tmcomm.sys 2009-06-03 23:31 –d—– c:\documents and settings\joe\.housecall6.6 2009-05-25 20:02 1,720,086 a——- c:\windows\system32\TmpA2069984 2009-05-23 02:38 225,280 a——- c:\windows\system32\rewire.dll 2009-05-23 02:38 1,294,336 a——- c:\windows\system32\vorbis.acm 2009-05-23 02:35 –d—– c:\program files\Image-Line 2009-05-23 02:35 1,777,664 a——- c:\windows\system32\gdiplus.dll 2009-05-23 01:07 –d—– C:\ConverterOutput 2009-05-23 01:06 –d—– c:\program files\Cucusoft ==================== Find3M ==================== 2009-03-29 20:46 249,856 a——- c:\windows\system32\pdfmona.dll 2009-03-29 20:46 51,716 a——- c:\windows\system32\pdf995mon.dll 2007-11-08 20:35 246 a——- c:\program files\common files\rybiv 2007-02-10 00:56 491,768 a——- c:\program files\ie6setup.exe 2009-02-03 14:37 152 —shr– c:\windows\system32\987C99206F.sys 2009-02-03 14:37 7,518 a–sh— c:\windows\system32\KGyGaAvL.sys ============= FINISH: 23:24:31.01 =============== My PC seems to be running fine. In fact, it's a bit better in some respects – used to take at least a minute for internet explorer to load. Now it loads in under a second when I double-click on the IE desktop shortcut. Please let me know if I need to do anything else. BTW, I think I've hammered down WHEN I got this malware, and at the time I had my external harddrive connected. I've just now re-connected it for the first time since the infection. I ran a Kaspersky scan on it and it got to 66% without finding anything. It's been a long day so I just stopped the scan so I can go to bed. Do you recommend re-running the scan on it? (I'm betting I should.) I'm just unsure if these types of malwares even go to the external harddrive, or if they just stick to the C drive. Thanks again for all of your help.

oldman960

Post #11June 11, 2009, 6:48 AM UTC

Hi buttergun909,

First, did you also post HERE? If so please close that thread.

All the Kaspersky detections are in quarantined folders or System Restore points which will be removed when we clean up the tools.

We will remove most of the quaratined files now, the rest will go when we remove combofix.

We will use combofix again.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

Do Not copy the word CODE

Folder::
C:\Documents and Settings\Joe\.housecall6.6
C:\Documents and Settings\Joe\Desktop\SDFix

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

For some reason the DDS log shows you are now running Java 6 Update 3 (ignore the 1)
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

We will take care of that with this tool.

Please copy and paste this part of the instructions pertaining to the java update into a notepad and save it to your desktop for reference as your browser will be closed.

Please download JavaRa to your desktop and unzip it to its own folder. Close your browser.

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

The current version is Java™ 6 Update 13 *Update 14 may be offered.)

Next
To confirm your version of java, please

click your start button, click run
in the run box field, type cmd , click ok
a black command window will open
type java -version (note the space after java)
hit enter

what version is shown?

As for your external drive, yes I would suggest you do a scan on it. One other thing you should do is use this little utility on the drive and any other USB storage devices you have. If you hold the shift key down while connecting the drive, autorun will be prevented from happening.

Download Flash_Disinfector.exe by sUBs and save it to your desktop.

Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

Please post back with

combofix log
java version

Thanks

buttergun909

Post #12June 11, 2009, 2:39 PM UTC last edited June 11, 2009, 2:44 PM UTC

Thanks, will take care of this when I get home. And that was me on the other forum – I posted there before I discovered this forum. I thought I had closed that thread, but it looks like I didn't. I'll request a moderator to do so. What gave me away, the "909?" Thanks again for your help, and I'll be back tonight with more logs and the java version I have.

buttergun909

Post #13June 12, 2009, 4:03 AM UTC

Here is the ComboFix log:

ComboFix 09-06-11.06 - Joe 06/11/2009 22:36.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.719 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Joe\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Joe\.housecall6.6
c:\documents and settings\Joe\Desktop\SDFix
c:\documents and settings\Joe\.housecall6.6\8ball.txt
c:\documents and settings\Joe\.housecall6.6\AU_Log\TmuDump.txt
c:\documents and settings\Joe\.housecall6.6\aucfg.ini
c:\documents and settings\Joe\.housecall6.6\BPMNT.dll
c:\documents and settings\Joe\.housecall6.6\ciussi32.dll
c:\documents and settings\Joe\.housecall6.6\dsvout.dll
c:\documents and settings\Joe\.housecall6.6\engine.stat
c:\documents and settings\Joe\.housecall6.6\getMac.exe
c:\documents and settings\Joe\.housecall6.6\GetServer.ini
c:\documents and settings\Joe\.housecall6.6\jsapi.dll
c:\documents and settings\Joe\.housecall6.6\jupdate.dll
c:\documents and settings\Joe\.housecall6.6\local.conf
c:\documents and settings\Joe\.housecall6.6\log\2009-06-03-23-31-45.temp
c:\documents and settings\Joe\.housecall6.6\log\dsvout.log
c:\documents and settings\Joe\.housecall6.6\log\engine0.log
c:\documents and settings\Joe\.housecall6.6\log\engine0.log.lck
c:\documents and settings\Joe\.housecall6.6\log\error0.log
c:\documents and settings\Joe\.housecall6.6\log\error0.log.lck
c:\documents and settings\Joe\.housecall6.6\log\execution0.log
c:\documents and settings\Joe\.housecall6.6\log\execution0.log.lck
c:\documents and settings\Joe\.housecall6.6\patch.exe
c:\documents and settings\Joe\.housecall6.6\PATCHW32.DLL
c:\documents and settings\Joe\.housecall6.6\Pattern\lpt$vpn.169
c:\documents and settings\Joe\.housecall6.6\Pattern\tmaptn.777
c:\documents and settings\Joe\.housecall6.6\Pattern\TMVAmain.ptn
c:\documents and settings\Joe\.housecall6.6\Pattern\tsc.ptn
c:\documents and settings\Joe\.housecall6.6\ssapi32.dll
c:\documents and settings\Joe\.housecall6.6\ssapiptn.da5
c:\documents and settings\Joe\.housecall6.6\tmcomm.sys
c:\documents and settings\Joe\.housecall6.6\TmEngDrv.dll
c:\documents and settings\Joe\.housecall6.6\TmUpdate.dll
c:\documents and settings\Joe\.housecall6.6\tsc.exe
c:\documents and settings\Joe\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\ini_xml.zip
c:\documents and settings\Joe\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\ini_xml.zip.etag
c:\documents and settings\Joe\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\server.ini
c:\documents and settings\Joe\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\server.ini.etag
c:\documents and settings\Joe\.housecall6.6\usrbl.dat
c:\documents and settings\Joe\.housecall6.6\usrwl.dat
c:\documents and settings\Joe\.housecall6.6\vsapi32.dll
c:\documents and settings\Joe\.housecall6.6\vscan.dat
c:\documents and settings\Joe\Desktop\SDFix\apps\assosfix.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\cliptext.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\download.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\dummy.sys
c:\documents and settings\Joe\Desktop\SDFix\apps\Enable_Command_Prompt.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\ERDNT.E_E
c:\documents and settings\Joe\Desktop\SDFix\apps\ERDNTDOS.LOC
c:\documents and settings\Joe\Desktop\SDFix\apps\ERDNTWIN.LOC
c:\documents and settings\Joe\Desktop\SDFix\apps\ERUNT.EXE
c:\documents and settings\Joe\Desktop\SDFix\apps\ERUNT.LOC
c:\documents and settings\Joe\Desktop\SDFix\apps\fix.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\FixBH.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\FIXCU.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\FIXLM.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\FixPath.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\FixWebCheck.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\fixXP.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\FixXPsp2.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\HPFix.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\leg2.txt
c:\documents and settings\Joe\Desktop\SDFix\apps\legacy.txt
c:\documents and settings\Joe\Desktop\SDFix\apps\legacybk.txt
c:\documents and settings\Joe\Desktop\SDFix\apps\locate.com
c:\documents and settings\Joe\Desktop\SDFix\apps\LS.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\MD5File.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\moveex.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\MyGcpvFix.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\MyGkFix2.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\Process.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\RegDACL.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\Rem.txt
c:\documents and settings\Joe\Desktop\SDFix\apps\Rem2.txt
c:\documents and settings\Joe\Desktop\SDFix\apps\Replace\W2K.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\Replace\XP.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\Reset_AppInit_DLLs.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\RestartIt!.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\Restore_SecurityCenter.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\Restore_SharedAccess.reg
c:\documents and settings\Joe\Desktop\SDFix\apps\sc.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\SF.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\shutdown.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\srv2.txt
c:\documents and settings\Joe\Desktop\SDFix\apps\svc.txt
c:\documents and settings\Joe\Desktop\SDFix\apps\svcbk.txt
c:\documents and settings\Joe\Desktop\SDFix\apps\swreg.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\swsc.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\unzip.exe
c:\documents and settings\Joe\Desktop\SDFix\apps\zip.exe
c:\documents and settings\Joe\Desktop\SDFix\backups\attrib.exe
c:\documents and settings\Joe\Desktop\SDFix\backups\backupreg.zip
c:\documents and settings\Joe\Desktop\SDFix\backups\backups.zip
c:\documents and settings\Joe\Desktop\SDFix\backups\find.exe
c:\documents and settings\Joe\Desktop\SDFix\backups\findstr.exe
c:\documents and settings\Joe\Desktop\SDFix\backups\HOSTS
c:\documents and settings\Joe\Desktop\SDFix\backups\regedit.exe
c:\documents and settings\Joe\Desktop\SDFix\catchme.exe
c:\documents and settings\Joe\Desktop\SDFix\dummy.sys
c:\documents and settings\Joe\Desktop\SDFix\report 7-8-07.txt
c:\documents and settings\Joe\Desktop\SDFix\Report.txt
c:\documents and settings\Joe\Desktop\SDFix\RunThis.bat
c:\documents and settings\Joe\Desktop\SDFix\SDFIX_ReadMe_Online.url

.
((((((((((((((((((((((((( Files Created from 2009-05-12 to 2009-06-12 )))))))))))))))))))))))))))))))
.

2009-06-11 02:03 . 2009-06-11 02:03 ——– d—–w- c:\program files\Common Files\Java
2009-06-06 03:11 . 2009-06-06 07:25 117760 —-a-w- c:\documents and settings\Joe\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-06 03:10 . 2009-06-06 03:10 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-06 03:09 . 2009-06-06 07:27 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-06-06 03:09 . 2009-06-06 03:09 ——– d—–w- c:\documents and settings\Joe\Application Data\SUPERAntiSpyware.com
2009-06-06 03:08 . 2009-06-06 03:08 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-06-06 03:07 . 2009-06-06 03:07 3584 —-a-r- c:\documents and settings\Joe\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-06-06 03:07 . 2009-06-06 03:07 ——– d—–w- c:\program files\Windows Installer Clean Up
2009-06-06 03:07 . 2009-06-06 03:07 ——– d—–w- c:\program files\MSECACHE
2009-06-05 03:46 . 2009-05-26 18:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-05 03:46 . 2009-06-06 02:56 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-05 03:46 . 2009-05-26 18:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-04 04:32 . 2009-06-04 04:31 102664 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2009-05-24 21:11 . 2009-05-24 21:11 ——– d—–w- c:\documents and settings\Joe\Application Data\DivX
2009-05-23 07:38 . 2006-06-20 15:56 225280 —-a-w- c:\windows\system32\rewire.dll
2009-05-23 07:35 . 2009-05-23 07:38 ——– d—–w- c:\program files\Image-Line
2009-05-23 07:35 . 2003-06-20 18:28 1777664 —-a-w- c:\windows\system32\gdiplus.dll
2009-05-23 06:07 . 2009-05-23 06:07 ——– d—–w- C:\ConverterOutput
2009-05-23 06:06 . 2009-02-26 21:34 94650 —-a-w- c:\windows\system32\HKCU_GNU.reg
2009-05-23 06:06 . 2009-02-26 21:34 2004 —-a-w- c:\windows\system32\HKLM_GNU.reg
2009-05-23 06:06 . 2008-12-18 06:22 57344 —-a-w- c:\windows\system32\ff_vfw.dll
2009-05-23 06:06 . 2008-06-15 15:01 60273 —-a-w- c:\windows\system32\pthreadGC2.dll
2009-05-23 06:06 . 2008-06-15 15:01 258352 —-a-w- c:\windows\system32\unicows.dll
2009-05-23 06:06 . 2008-02-04 02:26 364544 —-a-w- c:\windows\system32\cdg.dll
2009-05-23 06:06 . 2006-09-27 22:46 348160 —-a-w- c:\windows\system32\cdga.dll
2009-05-23 06:06 . 2006-07-18 02:42 14909 —-a-w- c:\windows\system32\A_reg.reg
2009-05-23 06:06 . 2009-05-23 06:06 ——– d—–w- c:\program files\Cucusoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-12 02:44 . 2006-04-01 15:05 ——– d—–w- c:\program files\Java
2009-05-26 01:03 . 2007-04-13 00:20 ——– d–h–w- c:\documents and settings\Joe\Application Data\Move Networks
2009-05-24 21:17 . 2009-02-15 08:55 ——– d—–w- c:\documents and settings\Joe\Application Data\uTorrent
2009-05-01 00:24 . 2008-06-18 01:20 ——– d—–w- c:\documents and settings\Leanne\Application Data\Move Networks
2009-04-06 03:35 . 2009-04-06 03:35 1205677 —-a-w- c:\documents and settings\All Users\Application Data\TaxCut\2008\Update\US68017101lupd.exe
2009-03-31 03:35 . 2007-05-12 10:38 89880 —-a-w- c:\documents and settings\Leanne\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-30 01:46 . 2009-03-30 01:46 51716 —-a-w- c:\windows\system32\pdf995mon.dll
2009-03-30 01:46 . 2009-03-30 01:46 249856 —-a-w- c:\windows\system32\pdfmona.dll
2009-03-29 22:06 . 2009-03-29 22:03 27660784 —-a-w- c:\documents and settings\All Users\Application Data\TaxCut\2008\Update\US45016801lupd.exe
2009-03-24 00:56 . 2009-03-04 04:38 34062 —-a-w- c:\documents and settings\Leanne\Application Data\Move Networks\ie_bin\Uninst.exe
2009-03-24 00:56 . 2009-03-24 00:55 1048200 —-a-w- c:\documents and settings\Leanne\Application Data\Move Networks\MoveMediaPlayer_071303000004.exe
2007-11-09 01:35 . 2007-06-10 23:53 246 —-a-w- c:\program files\Common Files\rybiv
2007-02-10 05:56 . 2007-02-10 05:56 491768 —-a-w- c:\program files\ie6setup.exe
2009-02-03 19:37 . 2006-04-19 06:42 152 –sh–r- c:\windows\system32\987C99206F.sys
2009-02-03 19:37 . 2006-04-19 06:42 7518 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-06-09_00.13.21 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-06 21:09 . 2008-03-25 07:37 139264 c:\windows\system32\javaws.exe
+ 2009-06-11 02:04 . 2007-09-25 04:31 139264 c:\windows\system32\javaws.exe
+ 2009-06-11 02:04 . 2007-09-25 03:30 135168 c:\windows\system32\javaw.exe
- 2008-06-06 21:09 . 2008-03-25 06:28 135168 c:\windows\system32\javaw.exe
+ 2009-06-11 02:04 . 2007-09-25 03:30 135168 c:\windows\system32\java.exe
- 2008-06-06 21:09 . 2008-03-25 06:28 135168 c:\windows\system32\java.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellTransferAgent"="c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 135168]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-13 1117184]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-23 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\tbmon.exe" [2003-10-07 147514]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-11 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-12-11 267048]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
2005-03-02 00:49 24672 —-a-w- c:\windows\system32\ckpNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Joe\\Desktop\\utorrent.exe"=

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [4/29/2006 5:50 PM 58464]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [4/29/2006 6:17 PM 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [4/29/2006 6:17 PM 670128]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [4/29/2006 6:17 PM 2041904]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [4/29/2006 6:17 PM 14924]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/webhp?complete=0&hl=en
mStart Page = hxxp://www.dell.com
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: turbotax.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-11 22:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(704)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-06-12 22:43
ComboFix-quarantined-files.txt 2009-06-12 03:43
ComboFix2.txt 2009-06-10 02:24
ComboFix3.txt 2009-06-09 00:15
ComboFix4.txt 2007-11-16 05:26

Pre-Run: 43,367,952,384 bytes free
Post-Run: 43,527,110,656 bytes free

247

I also re-ran the Java installation, and checking my PC per your instructions above, it tells me I have version 1.6.0_14. Is this the one I want?

Please let me know how to proceed.

Thanks!!

oldman960

Post #14June 12, 2009, 7:14 AM UTC

Hi buttergun909,

I just happened to stumble across it and the log looked familiar.

That's the java version you want.

Any problems? If not we can clean up the tools we used.

Now lets uninstall GMER:

Copy the entire contents of the Code Box below to Notepad.
Name the file as gmer_uninstall.bat
Change the Save as Type to All Files
and Save it in the folder where GMER.exe was saved
Once saved, double click on the gmer_uninstall.bat file. a MSDOS window will be displayed. That is normal.

Do Not copy the word CODE

@echo off
sc stop gmer
sc delete gmer
if exist %SystemRoot%\System32\drivers\gmer.sys del /f /q %SystemRoot%\System32\drivers\gmer.sys
if exist %SystemRoot%\gmer.dll del /f /q %SystemRoot%\gmer.dll
if exist %SystemRoot%\gmer.exe del /f /q %SystemRoot%\gmer.exe
if exist %SystemRoot%\gmer.ini del /f /q %SystemRoot%\gmer.ini
if exist %SystemRoot%\gmer_uninstall.cmd del /f /q %SystemRoot%\gmer_uninstall.cmd
if exist %SystemRoot%\gmer.bat del /f /q %SystemRoot%\gmer.bat
if exist %SystemRoot%\gmer.reg del /f /q %SystemRoot%\gmer.reg
if exist %SystemRoot%\gmer.log del /f /q %SystemRoot%\gmer.log
rd /s /q gmer
del /f /q gmer_uninstall.bat
exit

From your desktop, please delete if present

any notepads/logs that we created
GMER.zip
GMER.exe
DDS.scr

Next

Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /u

Updates and upgrades

* If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the cirtical updates installed (Free) Microsoft Office Update

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 6.0.2 and 6.0.1, in that order, first. Be sure to move any PDF documents to another folder first though.

Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. You have Mcafee, Spybot, MBAM and SAS. Just enable Spybot's Teatimer and add a firewall.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware, IMO)

You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.

-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.

- Keep your antivirus program updated, as well as any other security programs you have.

- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

-Check this site out to check for out of date programs
Secunia Personal Software Inspector (PSI) 1.0

We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".

Take care

buttergun909

Post #15June 13, 2009, 4:02 AM UTC

Okay, I've done all of the steps above, and my PC seems to be working fine. Everything seems perfect! Thanks so much for your help. Your instructions were very easy to follow, and you were a great guide through this entire ordeal. I'm updating all security measures per your recommendations…so let's hope this never happens to me again! Thanks again for your help, and take care!

[Resolved] uacinit.dll: Please help remove malicous malware

✨ Ask AI

Ask AI