What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] HELP! INTERNET KEEPS DIVERTING TO DIFFERENT SITE

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,

Everytime I search for something in google, and then i choose something from the search results, instead of taking me to that site, the internet diverts me to some completely random site, such as gambling, porn etc. I have norton 360, but it doesnt seem to have done anything to fix the problem. Below is my hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:29:19, on 08/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\agrsmsvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe
C:\WINNT\System32\NTME\METHWNT.EXE
C:\WINNT\System32\NTME\brad32.exe
C:\Program Files\Norton Online\Engine\1.1.0.21\ccSvcHst.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe
C:\Program Files\Norton Online\Engine\1.1.0.21\ccSvcHst.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINNT\BCMSMMSG.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINNT\system32\internat.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.1.0.2:8080
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.0.0.134\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.0.0.134\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: Symantec Norton Safety Minder BHO - {B8E07826-0971-4f16-B133-047B88034E89} - C:\Program Files\Norton Online\AddOns\Norton Safety Minder\Engine\1.1.0.21\coIEPlg.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.0.0.134\coIEPlg.dll
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [igfxtray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINNT\system32\igfxpers.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINNT\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 1.0.3705; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.1)" -"http://www.miniclip.com/games/bow-master/en/"
O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: office.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.google.co.uk
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = senior.st-georges-college.co.uk
O17 - HKLM\Software\..\Telephony: DomainName = senior.st-georges-college.co.uk
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = senior.st-georges-college.co.uk
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = senior.st-georges-college.co.uk
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.0.0.134\coIEPlg.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINNT\system32\agrsmsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe
O23 - Service: Network Associates Management Agent - Network Associates, Inc. - C:\WINNT\System32\NTME\METHWNT.EXE
O23 - Service: Norton Online (NOF) - Symantec Corporation - C:\Program Files\Norton Online\Engine\1.1.0.21\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

–
End of file - 11790 bytes




help!!!!!!!!!
Post #2 last edited
Hi and Welcome,

NOTE:
  • Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
  • Absence of symptoms does not always mean the computer is clean
  • Kindly follow my instructions in the order posted.
  • Please DO NOT run any scans or fix items without my direction.



Please do the following:

STEP #1

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


STEP #2


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Here is the Attach file UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-07-30.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 02/09/2008 14:07:18 System Uptime: 08/08/2009 15:46:02 (1 hours ago) Motherboard: Hewlett-Packard | | 30A2 Processor: Intel® Core™2 CPU T7200 @ 2.00GHz | U10 | 1995/166mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 112 GiB total, 89.264 GiB free. D: is CDROM () ==== Disabled Device Manager Items ============= Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A} Description: Nokia Windows Portable Device Driver Device ID: ROOT\WPD\0000 Manufacturer: Nokia Name: Nokia 6500c PNP Device ID: ROOT\WPD\0000 Service: WUDFRd Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A} Description: Nokia E71 Device ID: ROOT\WPD\0001 Manufacturer: Nokia Name: Nokia E71 PNP Device ID: ROOT\WPD\0001 Service: WUDFRd ==== System Restore Points =================== No restore point in system. ==== Installed Programs ====================== A-Level Exambank Maths ACD/Labs Software 5 (C:\RS-C\ACDFREE5) Acid - Base ActivTest Adobe Flash Player 10 ActiveX Adobe Reader 9 Adobe Shockwave Player 11 Agere Systems HDA Modem Art and Mathematics Asyst Schools Administration Audacity 1.2.6 Autograph 3.20 BCM V.92 56K Modem BNF CD-ROM Broadcom 440x 10/100 Integrated Controller Broadcom 802.11 Wireless LAN Adapter Broadcom NetXtreme Ethernet Controller C-Major Audio Cabri-géomètre II Cabri 3D 2.0.0 Cabri 3D Plug-in 2.0.0 Channel Analysis Chemistry Set 2000 Network Choice Guard Compatibility Pack for the 2007 Office system Complex Grapher 1.0.2 CorelDRAW Graphics Suite 12 Course Companion GCSE FM Network Course Companion GCSE HM Network Crocodile ICT 605 Crocodile Physics 605 Crocodile Technology 606 Data Handling Tool DivX Web Player Drag and Drop Exercise Tool e-Science e.Log Vision Desktop Easiteach EasySense Software Economatics PIC-Logicator 2005 Electrochemistry Elements, Compounds and Mixtures Energetics Equilibrium Exam Tutor Higher Tier Maths Exam Tutor Intermediate Tier Maths ExamWizard Edexcel GCE Mathematics ExamWizard Edexcel GCSE Mathematics Formulator Tarsia 3.8 GCSE Chemistry for You - Support Pack GCSE Geography for AQA Specification A Whiteboard Software GEAR driver installer for x86 and x64 Gtgw_Graphs HighMAT Extension to Microsoft Windows XP CD Writing Wizard HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.0 (KB932471) HP Integrated Module with Bluetooth wireless technology HP Product Detection HP Quick Launch Buttons 6.00 D2 Intel® Graphics Media Accelerator Driver Intel® PRO Network Connections J2SE Runtime Environment 5.0 Update 4 J2SE Runtime Environment 5.0 Update 6 Jasc Paint Shop Pro 9 Jasc Paint Shop Pro 9 20040928_12 Plugin Update Patch Jasc Paint Shop Pro 9 GDI+ Patch Jasc Paint Shop Pro 9.01 Patch Java 2 Runtime Environment, SE v1.4.2_04 Java™ 6 Update 7 Junk Mail filter update Kar2ouche Clique Francais Kar2ouche Composer Kar2ouche Developing French Kar2ouche Dream Kar2ouche Spanish Kinetics Labelling Exercise Tool LimeWire 4.18.8 Macromedia Contribute 3.11 Macromedia Dreamweaver 8 Macromedia Extension Manager Macromedia Fireworks 8 Macromedia Flash 8 Macromedia Flash 8 Video Encoder Macromedia Flash Player 8 Plugin MathType 4 MDL Chime/Chime Pro for Internet Explorer Mechanics Microsoft .NET Framework (English) Microsoft .NET Framework (English) v1.0.3705 Microsoft .NET Framework 1.0 Hotfix (KB928367) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft Application Error Reporting Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 Microsoft Office Professional Edition 2003 Microsoft Text-to-Speech Engine 4.0 (English) Microsoft User-Mode Driver Framework Feature Pack 1.5 Microsoft Visual C++ 2005 Redistributable Mindjet MindManager Pro 6 Moles MSVC80_x86 MSVCRT MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 6.0 Parser (KB933579) Multimedia Science School 11-16 Edition 2.0 Multimedia Science School 16-18 Edition Nero BurnRights Nokia Connectivity Cable Driver Norton 360 Norton Online Norton Safety Minder NVIDIA Windows 2000/XP Display Drivers Paris for Alis PC Connectivity Solution PCB Wizard 3 PDF-XChange 3.0 PHE API Setup Photo Story 3 for Windows PowerDVD Probe PTC ProDESKTOP 8.0 QuickTime Real Alternative 1.50 Realtek High Definition Audio Driver Redox Security Update for Microsoft .NET Framework 2.0 (KB928365) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Segoe UI Sensing Science Laboratory Shockwave SimChemistry for Windows SIMS Infrastructure Sketchpad SoundMAX SPARC Structure and Bonding Synaptics Pointing Device Driver Tabs Room Booking Viewer Installation Testbase Key Stage 3 Mathematics Testbase UAM across the key stages Texas Instruments PCIxx21/x515/xx12 drivers. TIPCI Understanding Reactions Update for Windows XP (KB942763) Update for Windows XP (KB951978) VC80CRTRedist - 8.0.50727.762 Viewer WebFldrs XP Windows Communication Foundation Windows Driver Package - Nokia Modem (03/05/2008 3.7) Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0) Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage v1.3.0254.0 Windows Genuine Advantage Validation Tool (KB892130) Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Mail Windows Live Messenger Windows Live Sign-in Assistant Windows Live Upload Tool Windows Live Writer Windows Media Format 11 runtime Windows Media Player 11 Windows Presentation Foundation Windows Workflow Foundation Windows XP Service Pack 3 WinRAR archiver WinZip Wordsearch Exercise Tool WorldWide Volunteering NW V3.9 XML Paper Specification Shared Components Pack 1.0 Yenka Yenka Technology Add-On ==== Event Viewer Messages From Past Week ======== 07/08/2009 13:52:02, error: Service Control Manager [7034] - The tdctxte Service service terminated unexpectedly. It has done this 1 time(s). 07/08/2009 13:52:02, error: Service Control Manager [7034] - The sofatnet Service service terminated unexpectedly. It has done this 1 time(s). 07/08/2009 13:52:02, error: Service Control Manager [7034] - The mabidwe Service service terminated unexpectedly. It has done this 1 time(s). 07/08/2009 13:52:02, error: Service Control Manager [7034] - The afisicx Service service terminated unexpectedly. It has done this 1 time(s). 06/08/2009 19:13:50, error: System Error [1003] - Error code 00000077, parameter1 00000001, parameter2 00000000, parameter3 00000000, parameter4 a8df5cbc. 06/08/2009 19:13:26, error: Removable Storage Service [15] - RSM cannot manage library CdRom0. The database is corrupt. 04/08/2009 17:16:13, error: Service Control Manager [7023] - The Service Eset service terminated with the following error: The specified module could not be found. 04/08/2009 17:16:13, error: Service Control Manager [7023] - The Service AntiVir service terminated with the following error: The specified module could not be found. 04/08/2009 17:16:13, error: Service Control Manager [7023] - The Network Connections. service terminated with the following error: The specified module could not be found. 04/08/2009 17:16:13, error: Service Control Manager [7023] - The Human Interface Device Access service terminated with the following error: The specified module could not be found. 04/08/2009 17:16:13, error: Service Control Manager [7023] - The .Freame Micer service terminated with the following error: The specified module could not be found. 04/08/2009 17:16:13, error: Service Control Manager [7000] - The McAfee McShield service failed to start due to the following error: The system cannot find the file specified. 04/08/2009 17:14:50, error: NETLOGON [5719] - No Domain Controller is available for domain STGSS due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator. 03/08/2009 19:45:22, error: Removable Storage Service [111] - RSM could not load media in drive Drive 0 of library USB DISK 2.0 USB Device. 02/08/2009 10:36:27, error: Service Control Manager [7023] - The EvdoServer service terminated with the following error: The system cannot find the file specified. 01/08/2009 00:05:19, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 805adacc, parameter3 ba503bb4, parameter4 ba5038b0. ==== End Of File =========================== And here is DDS DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 16:50:42.34 on 08/08/2009 Internet Explorer: 6.0.2900.5512 Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2039.1431 [GMT 1:00] ============== Running Processes =============== C:\WINNT\system32\svchost -k DcomLaunch svchost.exe C:\WINNT\System32\svchost.exe -k netsvcs C:\WINNT\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\agrsmsvc.exe svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINNT\System32\svchost.exe -k HTTPFilter C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe C:\WINNT\System32\NTME\METHWNT.EXE C:\WINNT\System32\NTME\brad32.exe C:\Program Files\Norton Online\Engine\1.1.0.21\ccSvcHst.exe C:\WINNT\system32\svchost.exe -k imgsvc C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe C:\Program Files\Norton Online\Engine\1.1.0.21\ccSvcHst.exe C:\WINNT\Explorer.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINNT\BCMSMMSG.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINNT\system32\rundll32.exe C:\WINNT\system32\igfxpers.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\WINNT\system32\internat.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\sarif\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.co.uk/ mDefault_Page_URL = hxxp://www.google.co.uk uInternet Settings,ProxyServer = 10.1.0.2:8080 uInternet Settings,ProxyOverride = BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.0.0.134\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.0.0.134\IPSBHO.DLL BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: CmjBrowserHelperObject Object: {ac41d38f-b56d-40ad-94e0-b493d130c959} - c:\program files\mindjet\mindmanager 6\Mm6InternetExplorer.dll BHO: Symantec Norton Safety Minder BHO: {b8e07826-0971-4f16-b133-047b88034e89} - c:\program files\norton online\addons\norton safety minder\engine\1.1.0.21\coIEPlg.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.0.0.134\coIEPlg.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [Internat.exe] internat.exe uRunOnce: [Shockwave Updater] c:\winnt\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 1.0.3705; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.1)" -"http://www.miniclip.com/games/bow-master/en/" mRun: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon mRun: [NvCplDaemon] RUNDLL32.EXE c:\winnt\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe" mRun: [pdfSaver3] mRun: [MMReminderService] c:\program files\mindjet\mindmanager 6\MMReminderService.exe mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey mRun: [High Definition Audio Property Page Shortcut] HDAShCut.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [BCMSMMSG] BCMSMMSG.exe mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [SoundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [igfxtray] c:\winnt\system32\igfxtray.exe mRun: [igfxhkcmd] c:\winnt\system32\hkcmd.exe mRun: [igfxpers] c:\winnt\system32\igfxpers.exe mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" dRun: [internat.exe] internat.exe dRun: [NvMediaCenter] RUNDLL32.EXE c:\winnt\system32\NVMCTRAY.DLL,NvTaskbarInit dRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background dRunOnce: [^SetupICWDesktop] c:\program files\internet explorer\connection wizard\icwconn1.exe /desktop dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe dRunOnce: [FlashPlayerUpdate] c:\winnt\system32\macromed\flash\FlashUtil10a.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe StartupFolder: c:\documents and settings\all users\start menu\programs\startup\office.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - {AC41D38F-B56D-40AD-94E0-B493D130C959} - c:\program files\mindjet\mindmanager 6\Mm6InternetExplorer.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://go.divx.com/plugin/DivXBrowserPlugin.cab Handler: ms-its51 - {F6F1E82D-DE4D-11D2-875C-0000F8105754} - c:\program files\common files\microsoft shared\information retrieval\itss51.dll Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.0.0.134\CoIEPlg.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R0 SymEFA;Symantec Extended File Attributes;c:\winnt\system32\drivers\n360\0300000.086\SymEFA.sys [2009-8-7 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\winnt\system32\drivers\n360\0300000.086\BHDrvx86.sys [2009-8-7 258608] R1 ccHP;Symantec Hash Provider;c:\winnt\system32\drivers\n360\0300000.086\cchpx86.sys [2009-8-7 482352] R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090730.003\IDSXpx86.sys [2009-8-7 276344] R1 KMFrameWork;KMFramework;c:\winnt\system32\drivers\KMFrameWork.sys [2005-1-21 80768] R2 KbdFIOControl;KbdFIOControl;c:\winnt\system32\drivers\KbdF.sys [2005-11-21 7168] R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2007-7-25 104000] R2 N360;Norton 360;c:\program files\norton 360\engine\3.0.0.134\ccSvcHst.exe [2009-8-7 115560] R2 Network Associates Management Agent;Network Associates Management Agent;c:\winnt\system32\ntme\METHWNT.EXE [2002-7-2 163903] R2 NOF;Norton Online;c:\program files\norton online\engine\1.1.0.21\ccSvcHst.exe [2009-8-8 117640] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-7 101936] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090807.048\NAVENG.SYS [2009-8-8 87888] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090807.048\NAVEX15.SYS [2009-8-8 875728] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\winnt\system32\drivers\nmwcdnsu.sys –> c:\winnt\system32\drivers\nmwcdnsu.sys [?] S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A};Symantec Redirector - Norton Safety Minder;c:\winnt\system32\drivers\nsm\0101000.015\symrdr.sys [2009-8-8 216624] S3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\drivers\usbhub20.sys [2003-7-2 49776] S3 Wdm1;USB Linq Cable Driver;c:\winnt\system32\drivers\usbbc.sys [2002-6-27 9882] =============== Created Last 30 ================ 2009-08-08 16:28 –d—– c:\program files\Trend Micro 2009-08-08 12:00 –d—– c:\winnt\system32\drivers\NSM 2009-08-08 12:00 –d—– c:\winnt\system32\drivers\NOF 2009-08-08 12:00 –d—– c:\program files\Norton Online 2009-08-07 19:35 a-d–r– c:\program files\Norton Support 2009-08-07 19:33 107,368 a——- c:\winnt\system32\GEARAspi.dll 2009-08-07 19:33 23,848 a——- c:\winnt\system32\drivers\GEARAspiWDM.sys 2009-08-07 19:33 –d—– c:\docume~1\alluse~1\applic~1\{7B6BA59A-FB0E-4499-8536-A7420338BF3B} 2009-08-07 19:33 36,400 a—-r– c:\winnt\system32\drivers\SymIM.sys 2009-08-07 19:33 124,976 a——- c:\winnt\system32\drivers\SYMEVENT.SYS 2009-08-07 19:33 60,808 a——- c:\winnt\system32\S32EVNT1.DLL 2009-08-07 19:33 7,456 a——- c:\winnt\system32\drivers\SYMEVENT.CAT 2009-08-07 19:33 806 a——- c:\winnt\system32\drivers\SYMEVENT.INF 2009-08-07 19:33 –d—– c:\program files\Symantec 2009-08-07 19:32 –d—– c:\winnt\system32\drivers\N360 2009-08-07 19:32 –d—– c:\program files\Norton 360 2009-08-07 19:20 –d—– c:\documents and settings\all users\Symantec Temporary Files 2009-08-07 13:40 –d—– c:\docume~1\sarif\applic~1\Malwarebytes 2009-08-07 13:40 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-08-01 00:02 67,072 a——- c:\winnt\system32\drivers\vsfocesrfulvlb.sys 2009-07-29 16:40 –d—– c:\documents and settings\sarif\Tracing 2009-07-29 16:35 –d—– c:\program files\Microsoft 2009-07-29 16:34 –d—– c:\program files\Windows Live SkyDrive 2009-07-29 16:30 –d—– c:\program files\common files\Windows Live 2009-07-19 18:03 –d—– c:\docume~1\alluse~1\applic~1\Norton 2009-07-19 18:02 –d—– c:\docume~1\alluse~1\applic~1\Symantec 2009-07-19 18:02 –d—– c:\program files\NortonInstaller 2009-07-19 18:02 –d—– c:\docume~1\alluse~1\applic~1\NortonInstaller ==================== Find3M ==================== 2009-06-12 13:00 81 a——- C:\CTX.DAT 2007-07-25 16:36 8 ac-sh— c:\program files\.drv120405.dat 2007-07-25 16:36 8 ac-sh— c:\program files\.data211204.dat 2007-07-25 16:36 8 ac-sh— c:\program files\.data211004.dat 2007-07-25 16:36 8 ac-sh— c:\program files\.data110704.dat 2007-07-25 16:36 8 ac-sh— c:\program files\.dat000002.dat 2007-07-25 16:36 8 ac-sh— c:\program files\.dat000001.dat 2002-06-26 16:25 21,952 ac–h— c:\program files\folder.htt 2002-06-26 16:25 271 —sh— c:\program files\desktop.ini 1999-10-08 09:21 1,024 -c-sh— c:\winnt\system32\msi32b03.dat ============= FINISH: 16:51:35.65 ===============
Post #4
The Gmer file scanned but rebooted my computer automatically without allowing me to save. I tried a number of times. I have attached a Gmer.txt file which I saved part way through its scan

Attachments:

Post #5 last edited
Hi,

you have a nasty rootkit on board.

This type of infection allows hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge.
If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?


Please do the following:

Please download Sysprot Antirootkit from HERE

Unzip it into a folder on your desktop.

  • Double click Sysprot.exe to start the program.
  • Click on the Log tab.
  • In the Write to log box select ALL ITEMS
  • Look near the bottom left, and Check Hidden Objects Only
  • Click on the Create Log button on the bottom right.
  • After a few seconds a new window should appear.
  • Select Scan Root Drive. Click on the Start button.
  • When it is complete a new window will appear to indicate that the scan is finished.
  • The log will be saved automatically in the same folder Sysprot.exe was extracted to.
  • Open the text file and copy/paste the log here.
Post #7
Hi,

please do the following:

Download Combofix from either of the links below. You must rename it before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".


Link 1
Link 2



During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]


[external image: Posted Image]
——————————————————————–
  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.


———————————————————–

  • Double click on Combo-Fix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\Combo-Fix.txt" for further review.
    **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**


    ———————————————————–

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    ———————————————————–

Post #8 last edited
hi,
heres the combo log

ComboFix 09-08-07.09 - SArif 08/08/2009 17:54.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2039.1545 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1053587083-1959034591-656298025-1000
c:\recycler\S-1-5-21-1053587083-1959034591-656298025-500
c:\recycler\S-1-5-21-1118069101-1174020249-1221329067-1000
c:\recycler\S-1-5-21-1118069101-1174020249-1221329067-500
c:\recycler\S-1-5-21-1315426594-3778096734-1976006485-1009
c:\recycler\S-1-5-21-1384674534-142703929-1789936528-1009
c:\recycler\S-1-5-21-1409082233-854245398-682003330-1000
c:\recycler\S-1-5-21-1409082233-854245398-682003330-500
c:\recycler\S-1-5-21-142934082-3846648375-1373828505-1009
c:\recycler\S-1-5-21-142934082-3846648375-1373828505-500
c:\recycler\S-1-5-21-1745105688-1801155140-1773821754-1009
c:\recycler\S-1-5-21-1746689930-1431995252-1580503805-1009
c:\recycler\S-1-5-21-183217182-809660304-2183427264-1009
c:\recycler\S-1-5-21-2011634172-2258287317-1765673871-1009
c:\recycler\S-1-5-21-2488249443-1734213777-3817005575-1009
c:\recycler\S-1-5-21-2488249443-1734213777-3817005575-500
c:\recycler\S-1-5-21-265138142-16413180-2943016783-1009
c:\recycler\S-1-5-21-272170415-2547739488-781941547-1009
c:\recycler\S-1-5-21-272170415-2547739488-781941547-500
c:\recycler\S-1-5-21-3011606817-615215551-1828772599-1009
c:\recycler\S-1-5-21-3305450920-2391284555-1219202787-1009
c:\recycler\S-1-5-21-3423663100-356722778-1460147360-1009
c:\recycler\S-1-5-21-366425222-1271938265-130884458-1009
c:\recycler\S-1-5-21-366425222-1271938265-130884458-1010
c:\recycler\S-1-5-21-4131470213-3849704915-1183558482-1009
c:\recycler\S-1-5-21-443919286-767055771-3098389351-500
c:\recycler\S-1-5-21-568605264-624654716-145312045-1000
c:\recycler\S-1-5-21-568605264-624654716-145312045-1002
c:\recycler\S-1-5-21-568605264-624654716-145312045-500
c:\recycler\S-1-5-21-710357248-3441543920-1923750342-1009
c:\winnt\Install.txt
c:\winnt\jestertb.dll
c:\winnt\run.log
c:\winnt\system32\config\systemprofile\Application Data\Macromedia\Common
c:\winnt\system32\drivers\vsfocesrfulvlb.sys
c:\winnt\system32\drivers\ytasfwhqwmrflo.sys
c:\winnt\system32\Install.txt
c:\winnt\system32\mdm.exe
c:\winnt\system32\ytasfwalqpmylt.dll
c:\winnt\system32\ytasfweirjetas.dat
c:\winnt\system32\ytasfwqjcxkvmt.dat
c:\winnt\system32\ytasfwyqmltqfl.dll
c:\winnt\Web\default.htt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_ytasfwoblhtpuy
——-\Legacy_ytasfwoblhtpuy
——-\Legacy_AFISICX
——-\Legacy_DEFAULTLIB
——-\Legacy_MABIDWE
——-\Legacy_NETMANTOW
——-\Legacy_SOFTYINFORWOW1
——-\Legacy_SOPIDKC
——-\Legacy_SOXPECA
——-\Legacy_TDCTXTE
——-\Service_IAS


((((((((((((((((((((((((( Files Created from 2009-07-08 to 2009-08-08 )))))))))))))))))))))))))))))))
.

2009-08-08 17:03 . 2009-08-08 17:03 ——– d—–w- c:\winnt\system32\N360_BACKUP
2009-08-08 15:28 . 2009-08-08 15:28 ——– d—–w- c:\program files\Trend Micro
2009-08-07 18:32 . 2009-08-07 18:32 ——– d—–w- c:\winnt\system32\drivers\N360
2009-07-19 17:02 . 2009-08-08 10:59 ——– d—–w- c:\program files\NortonInstaller
2009-07-19 17:02 . 2009-07-19 17:02 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\NortonInstaller

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-08 11:00 . 2009-08-07 18:33 806 —-a-w- c:\winnt\system32\drivers\SYMEVENT.INF
2009-08-08 11:00 . 2009-08-07 18:33 7456 —-a-w- c:\winnt\system32\drivers\SYMEVENT.CAT
2009-08-08 11:00 . 2009-08-07 18:33 60808 —-a-w- c:\winnt\system32\S32EVNT1.DLL
2009-08-08 11:00 . 2009-08-07 18:33 124976 —-a-w- c:\winnt\system32\drivers\SYMEVENT.SYS
2009-08-08 11:00 . 2009-08-07 18:33 ——– d—–w- c:\program files\Symantec
2009-08-08 11:00 . 2009-08-08 11:00 ——– d—–w- c:\program files\Norton Online
2009-08-08 11:00 . 2009-07-19 17:03 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Norton
2009-08-08 10:52 . 2009-01-01 20:55 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-07 18:35 . 2009-08-07 18:35 ——– d—a-r- c:\program files\Norton Support
2009-08-07 18:33 . 2009-08-07 18:33 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-08-07 18:33 . 2009-08-07 18:33 36400 —-a-r- c:\winnt\system32\drivers\SymIM.sys
2009-08-07 18:32 . 2009-08-07 18:32 ——– d—–w- c:\program files\Norton 360
2009-08-07 18:32 . 2009-08-07 18:32 ——– d—–w- c:\program files\Windows Sidebar
2009-08-07 18:32 . 2009-07-19 17:02 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Symantec
2009-08-07 18:31 . 2007-07-25 16:01 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\McAfee
2009-08-07 18:31 . 2007-07-25 15:58 ——– d—–w- c:\program files\McAfee
2009-08-07 18:23 . 2009-02-25 20:00 ——– d—a-w- c:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-08-07 12:40 . 2009-08-07 12:40 ——– d—–w- c:\documents and settings\sarif\Application Data\Malwarebytes
2009-08-07 12:40 . 2009-08-07 12:40 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-07-29 15:40 . 2006-08-09 14:35 102608 —-a-w- c:\documents and settings\St Georges College\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-29 15:36 . 2008-11-21 22:23 ——– d—–w- c:\program files\Windows Live
2009-07-29 15:35 . 2009-07-29 15:35 ——– d—–w- c:\program files\Microsoft
2009-07-29 15:34 . 2009-07-29 15:34 ——– d—–w- c:\program files\Windows Live SkyDrive
2009-07-29 15:30 . 2009-07-29 15:30 ——– d—–w- c:\program files\Common Files\Windows Live
2009-07-26 15:08 . 2009-01-28 18:36 ——– d—–w- c:\documents and settings\sarif\Application Data\LimeWire
2009-07-20 13:11 . 2009-06-29 14:40 ——– d—a-w- c:\docume~1\ALLUSE~1\APPLIC~1\Sports Interactive
2009-07-19 17:03 . 2009-01-01 20:55 ——– d—–w- c:\program files\Norton Security Scan
2009-07-18 16:34 . 2009-01-04 15:41 ——– d—–w- c:\documents and settings\sarif\Application Data\U3
2009-07-07 20:17 . 2009-07-07 20:17 ——– d—–w- c:\program files\DivX
2009-07-07 20:17 . 2009-07-07 20:17 ——– d—–w- c:\program files\Common Files\DivX Shared
2009-06-29 14:41 . 2009-06-29 14:18 ——– d—–w- c:\documents and settings\sarif\Application Data\Sports Interactive
2009-06-25 20:57 . 2009-06-25 20:57 ——– d—–w- c:\documents and settings\sarif\Application Data\Hermitech Laboratory
2009-06-25 20:56 . 2009-06-25 20:56 ——– d—–w- c:\program files\Hermitech Laboratory
2009-06-12 12:00 . 2009-06-12 12:00 81 —-a-w- C:\CTX.DAT
2009-06-10 20:48 . 2008-11-21 22:34 ——– d—–w- c:\program files\Windows Live Toolbar
2009-06-10 20:47 . 2007-07-30 14:08 ——– d—–w- c:\program files\Ahead
2009-06-10 20:38 . 2002-07-01 08:20 ——– d–h–w- c:\program files\InstallShield Installation Information
2007-07-25 15:36 . 2007-07-25 15:36 8 -csha-w- c:\program files\.drv120405.dat
2007-07-25 15:36 . 2007-07-25 15:36 8 -csha-w- c:\program files\.data211204.dat
2007-07-25 15:36 . 2007-07-25 15:36 8 -csha-w- c:\program files\.data211004.dat
2007-07-25 15:36 . 2007-07-25 15:36 8 -csha-w- c:\program files\.data110704.dat
2007-07-25 15:36 . 2007-07-25 15:36 8 -csha-w- c:\program files\.dat000002.dat
2007-07-25 15:36 . 2007-07-25 15:36 8 -csha-w- c:\program files\.dat000001.dat
2002-06-26 15:25 . 2002-06-26 15:25 21952 -c-ha-w- c:\program files\folder.htt
2004-03-01 12:25 . 2006-07-20 10:42 114688 -c–a-w- c:\program files\internet explorer\plugins\ChimeShim.dll
1999-10-08 08:21 . 2004-03-21 16:30 1024 -csh–w- c:\winnt\system32\msi32b03.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Internat.exe"="internat.exe" - c:\winnt\system32\internat.exe [1999-12-07 20752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="c:\winnt\system32\mobsync.exe" [2008-04-14 143360]
"NvCplDaemon"="c:\winnt\System32\NvCpl.dll" [2003-07-28 4841472]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-08-09 77824]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"MMReminderService"="c:\program files\Mindjet\MindManager 6\MMReminderService.exe" [2005-11-18 28672]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 136768]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"igfxtray"="c:\winnt\system32\igfxtray.exe" [2006-06-06 94208]
"igfxhkcmd"="c:\winnt\system32\hkcmd.exe" [2006-06-06 77824]
"igfxpers"="c:\winnt\system32\igfxpers.exe" [2006-06-06 118784]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 131072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"nwiz"="nwiz.exe" - c:\winnt\system32\nwiz.exe [2003-07-28 323584]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\winnt\system32\HdAShCut.exe [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" - c:\winnt\RTHDCPL.exe [2005-09-22 14854144]
"BCMSMMSG"="BCMSMMSG.exe" - c:\winnt\BCMSMMSG.exe [2003-08-29 122880]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\winnt\system32\bthprops.cpl [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\winnt\System32\NVMCTRAY.DLL" [2003-07-28 49152]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"internat.exe"="internat.exe" - c:\winnt\system32\internat.exe [1999-12-07 20752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2008-04-14 214528]
"tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544]
"FlashPlayerUpdate"="c:\winnt\system32\Macromed\Flash\FlashUtil10a.exe" [2008-10-05 235936]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-2-15 581693]
office.exe [2009-7-14 27413]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-1166\Scripts\Logon\0\0]
"Script"=\\wrsrv1\sysvol\senior.st-georges-college.co.uk\scripts\wr_a_staff.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-6934\Scripts\Logoff\0\0]
"Script"=\\wrsrv1\SYSVOL\senior.st-georges-college.co.uk\scripts\logout.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-6934\Scripts\Logon\0\0]
"Script"=\\wrsrv1\SYSVOL\senior.st-georges-college.co.uk\scripts\wr_pupils.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-6934\Scripts\Logon\0\1]
"Script"=\\wrsrv1\SYSVOL\senior.st-georges-college.co.uk\scripts\login.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-6934\Scripts\Logon\1\0]
"Script"=\\wrsrv1\SYSVOl\sysvol\senior.st-georges-college.co.uk\scripts\wr_pupils.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-7513\Scripts\Logon\0\0]
"Script"=\\wrsrv1\sysvol\senior.st-georges-college.co.uk\scripts\wr_a_staff.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-7914\Scripts\Logon\0\0]
"Script"=\\wrsrv1\SYSVOL\senior.st-georges-college.co.uk\scripts\wr_pupils.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-7914\Scripts\Logon\1\0]
"Script"=\\wrsrv1\SYSVOl\sysvol\senior.st-georges-college.co.uk\scripts\wr_pupils.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-8758\Scripts\Logon\0\0]
"Script"=\\senior.st-georges-college.co.uk\SysVol\senior.st-georges-college.co.uk\scripts\wr_a_staff.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1645522239-1563985344-682003330-8773\Scripts\Logon\0\0]
"Script"=\\wrsrv1\sysvol\senior.st-georges-college.co.uk\scripts\wr_b_staff.bat

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 SymEFA;Symantec Extended File Attributes;c:\winnt\system32\drivers\N360\0300000.086\SymEFA.sys [07/08/2009 19:33 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\winnt\system32\drivers\N360\0300000.086\BHDrvx86.sys [07/08/2009 19:32 258608]
R1 ccHP;Symantec Hash Provider;c:\winnt\system32\drivers\N360\0300000.086\cchpx86.sys [07/08/2009 19:32 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSXpx86.sys [07/08/2009 21:56 276344]
R1 KMFrameWork;KMFramework;c:\winnt\system32\drivers\KMFrameWork.sys [21/01/2005 17:57 80768]
R2 KbdFIOControl;KbdFIOControl;c:\winnt\system32\drivers\KbdF.sys [21/11/2005 15:27 7168]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe [07/08/2009 19:32 115560]
R2 Network Associates Management Agent;Network Associates Management Agent;c:\winnt\system32\NTME\METHWNT.EXE [02/07/2002 17:20 163903]
R2 NOF;Norton Online;c:\program files\Norton Online\Engine\1.1.0.21\ccSvcHst.exe [08/08/2009 12:00 117640]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\winnt\system32\drivers\nmwcdnsu.sys –> c:\winnt\system32\drivers\nmwcdnsu.sys [?]
S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A};Symantec Redirector - Norton Safety Minder;c:\winnt\system32\drivers\NSM\0101000.015\symrdr.sys [08/08/2009 12:00 216624]
S3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\drivers\usbhub20.sys [02/07/2003 09:37 49776]
S3 Wdm1;USB Linq Cable Driver;c:\winnt\system32\drivers\usbbc.sys [27/06/2002 09:10 9882]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv10910

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
eq2soft
.
- - - - ORPHANS REMOVED - - - -

HKCU-RunOnce-Shockwave Updater - c:\winnt\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 1.0.3705; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30;
HKLM-Run-pdfSaver3 - (no file)
SafeBoot-sglfb.sys
SafeBoot-tga.sys


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyServer = 10.1.0.2:8080
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: ms-its51 - {F6F1E82D-DE4D-11D2-875C-0000F8105754} - c:\program files\Common Files\Microsoft Shared\Information Retrieval\itss51.dll
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
.
.
——- File Associations ——-
.
txtfile="c:\winnt\system32\nctedit.exe" "%1"
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-08 18:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.0.0.134\diMaster.dll\" /prefetch:1"
–

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NOF]
"ImagePath"="\"c:\program files\Norton Online\Engine\1.1.0.21\ccSvcHst.exe\" /s \"NOF\" /m \"c:\program files\Norton Online\Engine\1.1.0.21\diMaster.dll\" /prefetch:1"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1692)
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\btncopy.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\winnt\system32\agrsmsvc.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\winnt\system32\NTME\BRAD32.EXE
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\McAfee\Common Framework\Mctray.exe
c:\winnt\system32\rundll32.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2009-08-08 18:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-08 17:31

Pre-Run: 95,762,698,240 bytes free
Post-Run: 95,695,884,288 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect /noexecute=optin

283 — E O F — 2007-08-15 09:22

Attachments:

Post #9
Hi,

Please do the following:

I would like you to upload a file to be scanned
  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\winnt\system32\internat.exe

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.


Please do the same for the following file:

c:\winnt\system32\msi32b03.dat

Post #10
VirSCAN.org Scanned Report :
Scanned time : 2009/08/08 19:05:55 (BST)
Scanner results: All Scanners reported not find malware!
File Name : internat.exe
File Size : 20752 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : f4206fca3b1d2feab50738ec2485d5f3
SHA1 : a22ffc874d8e3bf7b3cc7efcdab75da7c4584788
Online report : http://virscan.org/report/12bf579021e87126…56ae9565b8.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090808063123 2009-08-08 0.37 -
AhnLab V3 2009.08.08.00 2009.08.08 2009-08-08 0.77 -
AntiVir 8.2.0.248 7.1.5.85 2009-08-07 0.33 -
Antiy 2.0.18 20090804.2672262 2009-08-04 0.14 -
Arcavir 2009 200908081326 2009-08-08 0.03 -
Authentium 5.1.1 200908081557 2009-08-08 1.19 -
AVAST! 4.7.4 090807-0 2009-08-07 0.01 -
AVG 8.5.288 270.13.47/2290 2009-08-08 0.36 -
BitDefender 7.81008.3835339 7.27062 2009-08-09 3.32 -
CA (VET) 9.0.0.143 31.6.6666 2009-08-08 7.59 -
ClamAV 0.95.2 9666 2009-08-08 0.01 -
Comodo 3.10 1911 2009-08-08 0.72 -
CP Secure 1.1.0.715 2009.08.08 2009-08-08 11.80 -
Dr.Web 4.44.0.9170 2009.08.08 2009-08-08 5.05 -
F-Prot 4.4.4.56 20090808 2009-08-08 1.18 -
F-Secure 7.02.73807 2009.08.08.02 2009-08-08 0.11 -
Fortinet 2.81-3.120 10.691 2009-08-07 0.22 -
GData 19.6966/19.431 20090808 2009-08-08 4.62 -
ViRobot 20090808 2009.08.08 2009-08-08 0.41 -
Ikarus T3.1.01.64 2009.08.08.73201 2009-08-08 3.32 -
JiangMin 11.0.800 2009.08.08 2009-08-08 3.67 -
Kaspersky 5.5.10 2009.08.08 2009-08-08 0.09 -
KingSoft 2009.2.5.15 2009.8.8.15 2009-08-08 0.47 -
McAfee 5.3.00 5702 2009-08-08 3.00 -
Microsoft 1.4903 2009.08.08 2009-08-08 5.21 -
Norman 6.01.09 6.01.00 2009-08-06 0.00 -
Panda 9.05.01 2009.08.08 2009-08-08 1.60 -
Trend Micro 8.700-1004 6.350.11 2009-08-08 0.03 -
Quick Heal 10.00 2009.08.08 2009-08-08 1.05 -
Rising 20.0 21.41.52.00 2009-08-08 0.79 -
Sophos 2.89.1 4.44 2009-08-09 2.90 -
Sunbelt 5320 5320 2009-08-08 1.20 -
Symantec 1.3.0.24 20090808.003 2009-08-08 0.07 -
nProtect 20090807.01 4975345 2009-08-07 5.97 -
The Hacker 6.3.4.3 v00378 2009-08-07 0.69 -
VBA32 3.12.10.9 20090807.1152 2009-08-07 1.82 -
VirusBuster 4.5.11.10 10.111.7/1844711 2009-08-08 2.25 -
Post #11
VirSCAN.org Scanned Report :
Scanned time : 2009/08/08 19:09:07 (BST)
Scanner results: All Scanners reported not find malware!
File Name : msi32b03.dat
File Size : 1024 byte
File Type : data
MD5 : e740c443867a51101034c28ea5f659b2
SHA1 : a02ec98c3cfae93e70a45e4f7540663dc502122f
Online report : http://virscan.org/report/9bcbf03970cbff3b…2f57f88277.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090808063123 2009-08-08 0.34 -
AhnLab V3 2009.08.08.00 2009.08.08 2009-08-08 0.91 -
AntiVir 8.2.0.248 7.1.5.85 2009-08-07 0.45 -
Antiy 2.0.18 20090804.2672262 2009-08-04 0.12 -
Arcavir 2009 200908081326 2009-08-08 0.02 -
Authentium 5.1.1 200908081557 2009-08-08 1.16 -
AVAST! 4.7.4 090807-0 2009-08-07 0.00 -
AVG 8.5.288 270.13.47/2290 2009-08-08 0.31 -
BitDefender 7.81008.3835339 7.27062 2009-08-09 3.39 -
CA (VET) 9.0.0.143 31.6.6666 2009-08-08 6.80 -
ClamAV 0.95.2 9666 2009-08-08 0.00 -
Comodo 3.10 1911 2009-08-08 0.71 -
CP Secure 1.1.0.715 2009.08.08 2009-08-08 11.83 -
Dr.Web 4.44.0.9170 2009.08.08 2009-08-08 5.04 -
F-Prot 4.4.4.56 20090808 2009-08-08 1.14 -
F-Secure 7.02.73807 2009.08.08.02 2009-08-08 7.59 -
Fortinet 2.81-3.120 10.691 2009-08-07 0.20 -
GData 19.6966/19.431 20090808 2009-08-08 4.97 -
ViRobot 20090808 2009.08.08 2009-08-08 0.41 -
Ikarus T3.1.01.64 2009.08.08.73201 2009-08-08 3.33 -
JiangMin 11.0.800 2009.08.08 2009-08-08 4.11 -
Kaspersky 5.5.10 2009.08.08 2009-08-08 0.02 -
KingSoft 2009.2.5.15 2009.8.8.15 2009-08-08 0.49 -
McAfee 5.3.00 5702 2009-08-08 3.09 -
Microsoft 1.4903 2009.08.08 2009-08-08 5.10 -
Norman 6.01.09 6.01.00 2009-08-06 0.00 -
Panda 9.05.01 2009.08.08 2009-08-08 2.10 -
Trend Micro 8.700-1004 6.350.11 2009-08-08 0.02 -
Quick Heal 10.00 2009.08.08 2009-08-08 1.08 -
Rising 20.0 21.41.52.00 2009-08-08 0.27 -
Sophos 2.89.1 4.44 2009-08-09 2.86 -
Sunbelt 5320 5320 2009-08-08 1.22 -
Symantec 1.3.0.24 20090808.003 2009-08-08 0.17 -
nProtect 20090807.01 4975345 2009-08-07 6.72 -
The Hacker 6.3.4.3 v00378 2009-08-07 0.63 -
VBA32 3.12.10.9 20090807.1152 2009-08-07 1.81 -
VirusBuster 4.5.11.10 10.111.7/1844711 2009-08-08 2.24 -
Post #12
Hi,

please do the following:

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply



Also, Please describe how your computer is running now and if there are any out standing issues.
Post #13
I dont have tha malware program installed, i have found some documents, with a 'quarantined' file, but no program. Also I cannot dowload it from the net as Norton believes it is a high risk threat. But PC seems to be running very well now, with original problem gone! xx , so do i still need to do anything?
Post #14
Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



Please also run the Kaspersky online scanner.

Make sure Norton is disabled for the scan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI