Spyware / Malware / Virus Removal

[Resolved] Memman.vxd (Rogue.SysCleanerPro) - can't get rid of.

18 min read

Looking for the outcome? Ask AI

Crimea Topic Starter

Post #1August 24, 2009, 7:32 PM UTC

Hi,

I've followed the instructions, here http://forums.whatthetech.com/Welcome_New_Members_t106388.html, before posting, and the results are below.

My problem: I have repeatedly run Malwarebytes' Anti-malware to get rid of the Memman.vxd keylogger I appear to have, constantly deleting it from Quarantine and rebooting, but it keeps re-appearing.

Symptoms: periodically, IE7 behaves eratically - "Add to favourites" is disabled; can't open more than 3 tabs - and "right-clicking", in general, is disabled. Solving these problems requires another Malwarebytes scan or a reboot. I presume Memman.vxd is the cause.

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 18:32:48.68 on 24/08/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.415 [GMT 1:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: a-squared Anti-Malware *On-access scanning enabled* (Updated) {0F8591BB-342B-4493-91C3-4E948ED21255}
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ShellLess\ShellLess.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\SSC Service Utility\ssc_serv.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
C:\Program Files\Abaiko Disk Space Monitor\ADSM.exe
C:\Program Files\SourceTec\Sothink Web Video Downloader Stand-alone\VideoDownloader.exe
C:\Program Files\Invisible Security Full\InvisibleSecurityFull.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe
C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
C:\Program Files\FastStone Capture\FSCapture.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\TechSmith\SnagIt 7\TSCHelp.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\defragActivityMonitor.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
D:\### ANTI-VIRUS, -SPY-WARE ETC\Windows SysInternals Process Explorer 11.04\ProcessExplorer\procexp.exe
C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2guard.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Arjun\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sky.com/
BHO: HelperObject Class: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 7\SnagItBHO.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: FGCatchUrl: {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - c:\program files\flashget\jccatch.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - c:\program files\flashget\getflash.dll
TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 7\SnagItIEAddin.dll
TB: HDSPPropPage Class: {6f9def1a-c65a-f01a-b42d-9b6f763a94b3} - c:\program files\nero\nero 7\nero fast cd-dvd burning plug-in\NeroBurnPlugin.dll
TB: {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - No File
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [Eraser RiskMonitor] "c:\program files\east-tec eraser 2008\launch.exe" "c:\program files\east-tec eraser 2008\etRiskMon.exe"
uRun: [SkinClock] c:\program files\atomic alarm clock\AtomicAlarmClock.exe
uRun: [EPSON Stylus DX7000F Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatibke.exe /fu "c:\windows\temp\E_S85.tmp" /EF "HKCU"
uRun: [ADSM] c:\program files\abaiko disk space monitor\ADSM.exe
uRun: [Web Video Downloader] "c:\program files\sourcetec\sothink web video downloader stand-alone\VideoDownloader.exe"
uRun: [Invisible Security] c:\program files\invisible security full\InvisibleSecurityFull.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [SkyTel] SkyTel.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [ThreatFire] c:\program files\threatfire\TFTray.exe
mRun: [DesktopMechanic]
mRun: [P17Helper] Rundll32 P17.dll,P17Helper
mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [a-squared] "c:\program files\a-squared anti-malware\a2guard.exe" /d=60
mRun: [ShellLess] c:\program files\shellless\ShellLess.exe hide
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SSC Service Utility] c:\program files\ssc service utility\ssc_serv.exe /s
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Flashget] "c:\program files\flashget\FlashGet.exe" /min
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\arjun\startm~1\programs\startup\fastst~1.lnk - c:\program files\faststone capture\FSCapture.exe
StartupFolder: c:\docume~1\arjun\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ashamp~1.lnk - c:\program files\ashampoo\ashampoo magical defrag\bin\aDefragCtrl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\snagit~1.lnk - c:\program files\techsmith\snagit 7\SnagIt32.exe
IE: &Download All with FlashGet - c:\program files\flashget\jc_all.htm
IE: &Download with FlashGet - c:\program files\flashget\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
IE: {1F958B09-6612-7a0e-9223-4C7324C57B23}
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe
IE: {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - {17A84966-F1E9-4645-AA9E-5E771EE1C859} - c:\progra~1\nuclea~1\videoget\plugins\VIDEOG~1.DLL
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: microsoft.com\*.update
Trusted Zone: windowsupdate.com\download
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {076169AA-8C3D-4CFC-AC23-3ACA88FC21B5} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - hxxp://www.creative.com/su/ocx/15030/CTSUEng.cab
DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} - hxxp://support.f-secure.com/ols/fscax.cab
DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} - hxxp://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://prerelease.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {2D9F7B63-EC7C-43FF-A41D-6E9EC984A5B9} - hxxps://myaccount.gateway.gov.uk/ClientObjects/GGSecSign.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} - hxxp://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197990575718
DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} - hxxp://esupport.epson-europe.com/selftest/en/Prg/ESTPTest.cab
DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - hxxp://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} - hxxp://www.nanoscan.com/cabs/nanoinst.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} - hxxp://drm1.reelsurvey.com/ePlayer/V3_2_0_0/ACNePlayer.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} - hxxp://support.f-secure.com/ols/fscax.cab
DPF: {C237A80A-4C55-4C68-BAA9-CBE4408D12B2} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} - hxxp://www.freedom.net/viruscenter/onlineviruscheck/cabs/cssweb.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://vpn.pharmalink.co.uk/dana-cached/setup/JuniperSetupSP1.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/su/ocx/15030/CTPID.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: {1214FBE7-4464-4A7E-9958-B5851A7A30A3} - No File
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 AVG Anti-Rootkit;AVG Anti-Rootkit;c:\windows\system32\drivers\avgarkt.sys [2007-1-31 5632]
R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [2009-6-5 40560]
R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys –> c:\windows\system32\drivers\pxscan.sys [?]
R0 pxsec;pxsec;c:\windows\system32\drivers\pxsec.sys –> c:\windows\system32\drivers\pxsec.sys [?]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2008-6-20 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2008-6-20 46864]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2007-2-14 11264]
R1 anf0100.sys;anf0100.sys;c:\windows\system32\drivers\anf0100.sys [2008-9-10 9728]
R1 AvgArCln;Avg Anti-Rootkit Clean Driver;c:\windows\system32\drivers\AvgArCln.sys [2007-10-24 3968]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-5-3 11608]
R1 LADriver;LADriver;c:\windows\system32\drivers\LADriver.sys [2007-7-31 27136]
R1 LDDriver;LDDriver;c:\windows\system32\drivers\LDDriver.sys [2007-7-31 24064]
R1 LHDriver;LHDriver;c:\windows\system32\drivers\LHDriver.sys [2007-7-31 14336]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-8-5 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-8-5 74480]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [2009-5-29 95592]
R2 a2AntiMalware;a-squared Anti-Malware Service;c:\program files\a-squared anti-malware\a2service.exe [2008-8-2 980512]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-5-3 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-5-3 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-3 55656]
R2 ThreatFire;ThreatFire;c:\program files\threatfire\tfservice.exe service –> c:\program files\threatfire\TFService.exe service [?]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [2007-2-14 35712]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-8-5 7408]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2008-6-20 33552]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [2009-5-15 16640]
R4 pxprot;pxprot;c:\windows\system32\drivers\pxprot.sys [2009-3-11 18440]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\3.tmp –> c:\windows\system32\3.tmp [?]
S3 p17filt;p17filt;c:\windows\system32\drivers\p17filt.sys –> c:\windows\system32\drivers\p17filt.sys [?]
S3 Video3D;ASUS Video3D Service;c:\windows\system32\drivers\video3d32.sys –> c:\windows\system32\drivers\Video3D32.sys [?]

=============== Created Last 30 ================

2009-08-20 22:07 –d—– c:\program files\EASEUS
2009-08-20 03:33 40,960 a——- c:\windows\wavdest.ax
2009-08-20 03:33 –d—– c:\program files\Eltima Software
2009-08-19 02:34 –d—– c:\program files\FlashGet
2009-08-18 18:48 –d—– c:\windows\ServicePackFiles
2009-08-17 21:22 –d—– c:\program files\Secunia
2009-08-16 02:50 –d—– c:\program files\Digiarty
2009-08-13 05:32 –d—– c:\docume~1\alluse~1\applic~1\explauncher
2009-08-13 05:32 –d—– c:\docume~1\alluse~1\applic~1\launcher
2009-08-09 22:46 1,209 a——- C:\mxlog.dat
2009-08-09 22:44 53,248 a——- c:\windows\system32\MyFlashZip0.ax
2009-08-09 22:44 75,264 a——- c:\windows\system32\zlib1.dll
2009-08-09 21:54 –d—– c:\program files\SUPERAntiSpyware
2009-08-07 12:30 4,604,701 a——- c:\windows\system32\SNAGIT7
2009-08-04 18:56 4,248,840 a——- c:\windows\system32\qtp-mt334.dll
2009-07-28 03:32 –d—– c:\windows\system32\Adobe

==================== Find3M ====================

2009-08-05 23:15 55,656 a——- c:\windows\system32\drivers\avgntflt.sys
2009-08-05 10:11 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-08-04 18:56 40,560 a——- c:\windows\system32\drivers\hotcore3.sys
2009-08-03 13:36 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 13:36 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-07-17 19:55 58,880 a——- c:\windows\system32\atl.dll
2009-07-13 10:08 286,720 a——- c:\windows\system32\wmpdxm.dll
2009-06-29 17:12 827,392 a——- c:\windows\system32\wininet.dll
2009-06-29 17:12 78,336 a——- c:\windows\system32\ieencode.dll
2009-06-29 17:12 17,408 a——- c:\windows\system32\corpol.dll
2009-06-16 15:55 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 15:55 82,432 a——- c:\windows\system32\fontsub.dll
2009-06-12 12:50 76,288 a——- c:\windows\system32\telnet.exe
2009-06-10 15:21 84,992 a——- c:\windows\system32\avifil32.dll
2009-06-10 14:22 83,344 a——- c:\windows\system32\Erasext.dll
2009-06-10 14:22 307,088 a——- c:\windows\system32\Eraser.dll
2009-06-10 14:22 73,104 a——- c:\windows\system32\Eraserl.exe
2009-06-10 07:32 132,096 a——- c:\windows\system32\wkssvc.dll
2009-06-09 16:06 1,871,872 a——- c:\windows\system32\mstscax.dll
2009-06-03 20:27 1,290,752 a——- c:\windows\system32\quartz.dll
2008-11-07 02:09 382 a——- c:\program files\Shortcut to Program Files.lnk

============= FINISH: 18:35:29.76 ===============

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/24 18:39
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================

Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF33D8000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7A30000 Size: 8192 File Visible: No Signed: -
Status: -

Name: mchInjDrv.sys
Image Path: C:\WINDOWS\system32\Drivers\mchInjDrv.sys
Address: 0xF7B7F000 Size: 2560 File Visible: No Signed: -
Status: -

Name: PCI_PNP4140
Image Path: \Driver\PCI_PNP4140
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Name: PROCEXP111.SYS
Image Path: C:\WINDOWS\system32\Drivers\PROCEXP111.SYS
Address: 0xF7A80000 Size: 7680 File Visible: No Signed: -
Status: -

Name: pxscan.sys
Image Path: pxscan.sys
Address: 0xF753C000 Size: 36864 File Visible: No Signed: -
Status: -

Name: pxsec.sys
Image Path: pxsec.sys
Address: 0xF757C000 Size: 40960 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB9289000 Size: 49152 File Visible: No Signed: -
Status: -

Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Name: spwg.sys
Image Path: spwg.sys
Address: 0xF731A000 Size: 1052672 File Visible: No Signed: -
Status: -

SSDT
——————-
#: 041 Function Name: NtCreateKey
Status: Hooked by "" at address 0xf7b5ef7e

#: 053 Function Name: NtCreateThread
Status: Hooked by "" at address 0xf7b5ef74

#: 063 Function Name: NtDeleteKey
Status: Hooked by "" at address 0xf7b5ef83

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "" at address 0xf7b5ef8d

#: 071 Function Name: NtEnumerateKey
Status: Hooked by "spwg.sys" at address 0xf7339da4

#: 073 Function Name: NtEnumerateValueKey
Status: Hooked by "spwg.sys" at address 0xf733a132

#: 098 Function Name: NtLoadKey
Status: Hooked by "" at address 0xf7b5ef92

#: 119 Function Name: NtOpenKey
Status: Hooked by "TfSysMon.sys" at address 0xf7590f68

#: 122 Function Name: NtOpenProcess
Status: Hooked by "" at address 0xf7b5ef60

#: 128 Function Name: NtOpenThread
Status: Hooked by "" at address 0xf7b5ef65

#: 160 Function Name: NtQueryKey
Status: Hooked by "spwg.sys" at address 0xf733a20a

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "spwg.sys" at address 0xf733a08a

#: 193 Function Name: NtReplaceKey
Status: Hooked by "" at address 0xf7b5ef9c

#: 204 Function Name: NtRestoreKey
Status: Hooked by "" at address 0xf7b5ef97

#: 247 Function Name: NtSetValueKey
Status: Hooked by "" at address 0xf7b5ef88

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys" at address 0xf35770b0

Hidden Services
——————-
Service Name: CSIScanner
Image Path: "C:\Program Files\Prevx\prevx.exe" /service

==EOF==

Attach.txt is attached, as required.

I would be very grateful if someone could help.

Thanks.

Attachments:

📎Attach.txt

CatByte

Post #2August 29, 2009, 12:01 AM UTC

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

Crimea

Post #3September 1, 2009, 3:01 AM UTC

Hi,

I followed your instructions and everything appears well, after 24 hrs of use.

I've re-run Avira AntiVir, Malwarebytes' Anti-malware and Spybot - Search & Destroy and nothing turns up.
A-squared Anti-malware, though, still shows the following:

c:\windows\system32\memman.vxd detected: Trace.File.Computer Monitor Keylogger!A2
Value: HKEY_CLASSES_ROOT\CLSID\{E5B91392-1DD4-4B12-8D8D-87577377F432}\InprocServer32 –> ThreadingModel detected: Trace.Registry.DDominator!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E5B91392-1DD4-4B12-8D8D-87577377F432}\InprocServer32 –> ThreadingModel detected: Trace.Registry.DDominator!A2

Can I ask why Comodo Firewall Pro is listed by ComboFix when I no longer have it installed?

Here is the ComboFix Log:

ComboFix 09-08-29.01 - Arjun 30/08/2009 0:35.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.409 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: a-squared Anti-Malware *On-access scanning disabled* (Updated) {0F8591BB-342B-4493-91C3-4E948ED21255}
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\Installer\15d686.msi
c:\windows\Installer\183140.msi
c:\windows\Installer\2ea337.msi
c:\windows\Installer\428d79.msp
c:\windows\Installer\92a87.msi
c:\windows\Installer\9b792.msi
c:\windows\system32\Data
c:\windows\system32\Memman.vxd

.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-29 )))))))))))))))))))))))))))))))
.

2009-08-26 16:29 . 2009-08-26 16:29 152576 —-a-w- c:\documents and settings\Arjun\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-24 17:18 . 2009-08-24 17:18 ——– d—–w- c:\program files\ERUNT
2009-08-20 21:07 . 2009-08-20 21:07 ——– d—–w- c:\program files\EASEUS
2009-08-20 02:48 . 2009-08-20 02:48 ——– d—–w- c:\documents and settings\Arjun\Application Data\Eltima Software
2009-08-20 02:33 . 2009-08-20 02:33 ——– d—–w- c:\program files\Eltima Software
2009-08-19 01:34 . 2009-08-29 23:41 ——– d—–w- c:\program files\FlashGet
2009-08-18 17:48 . 2009-08-18 17:48 ——– d—–w- c:\windows\ServicePackFiles
2009-08-17 20:22 . 2009-08-17 20:22 ——– d—–w- c:\program files\Secunia
2009-08-16 01:50 . 2009-08-16 01:50 ——– d—–w- c:\program files\Digiarty
2009-08-13 04:32 . 2009-08-13 04:32 ——– d—–w- c:\documents and settings\All Users\Application Data\explauncher
2009-08-13 04:32 . 2009-08-13 04:32 ——– d—–w- c:\documents and settings\All Users\Application Data\launcher
2009-08-10 00:55 . 2009-08-10 00:55 ——– d—–w- c:\program files\ImgBurn
2009-08-09 21:46 . 2009-08-09 21:51 1209 —-a-w- C:\mxlog.dat
2009-08-09 21:44 . 2008-07-21 09:34 75264 —-a-w- c:\windows\system32\zlib1.dll
2009-08-09 20:54 . 2009-08-29 02:14 117760 —-a-w- c:\documents and settings\Arjun\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-09 20:54 . 2009-08-09 20:54 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-08-04 17:56 . 2009-08-04 17:56 4248840 —-a-w- c:\windows\system32\qtp-mt334.dll
2009-07-31 23:15 . 2009-07-31 23:20 ——– d—–w- c:\documents and settings\Arjun\Local Settings\Application Data\Ashampoo Music Studio 2009

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-29 23:29 . 2008-03-27 16:30 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-29 23:26 . 2007-02-21 20:17 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-29 21:11 . 2008-08-02 15:51 ——– d—–w- c:\program files\a-squared Anti-Malware
2009-08-29 21:10 . 2009-03-01 16:23 766 —-a-r- c:\documents and settings\Arjun\Application Data\Microsoft\Installer\{E2CAFC9F-95A1-4F27-9C1D-34DC9426A81B}\_250159c2.exe
2009-08-29 21:10 . 2009-03-01 16:23 2238 —-a-r- c:\documents and settings\Arjun\Application Data\Microsoft\Installer\{E2CAFC9F-95A1-4F27-9C1D-34DC9426A81B}\_67c77e22.exe
2009-08-29 21:10 . 2009-03-01 16:23 2238 —-a-r- c:\documents and settings\Arjun\Application Data\Microsoft\Installer\{E2CAFC9F-95A1-4F27-9C1D-34DC9426A81B}\_6006e3a.exe
2009-08-29 21:10 . 2007-07-31 19:25 ——– d—–w- c:\program files\Invisible Security Full
2009-08-29 02:15 . 2009-04-10 21:36 ——– d—–w- c:\program files\SpywareBlaster
2009-08-26 16:31 . 2008-06-01 15:50 ——– d—–w- c:\program files\Java
2009-08-20 21:07 . 2007-02-14 20:49 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-20 16:26 . 2009-07-10 21:14 ——– d—–w- c:\program files\WinUtilities
2009-08-18 19:09 . 2007-12-23 23:57 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-17 02:23 . 2007-02-22 02:33 ——– d—–w- c:\program files\Common Files\Adobe
2009-08-13 14:34 . 2008-06-20 20:51 ——– d—–w- c:\program files\ThreatFire
2009-08-13 04:23 . 2009-06-05 01:56 ——– d—–w- c:\program files\Paragon Software
2009-08-10 00:56 . 2007-12-31 19:53 ——– d—–w- c:\documents and settings\Arjun\Application Data\ImgBurn
2009-08-09 21:44 . 2009-04-16 22:35 ——– d—–w- c:\documents and settings\Arjun\Application Data\Moyea
2009-08-09 21:44 . 2009-04-16 22:31 ——– d—–w- c:\program files\Moyea
2009-08-09 20:54 . 2007-02-21 16:37 ——– d—–w- c:\documents and settings\Arjun\Application Data\SUPERAntiSpyware.com
2009-08-09 20:53 . 2007-02-21 15:24 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-08-05 22:15 . 2009-05-03 21:51 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-05 18:48 . 2009-06-27 03:43 ——– d—–w- c:\documents and settings\Arjun\Application Data\dvdcss
2009-08-05 09:11 . 2006-02-28 12:00 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 17:56 . 2009-06-05 01:56 40560 —-a-w- c:\windows\system32\drivers\hotcore3.sys
2009-08-04 17:03 . 2009-04-19 01:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-04 17:02 . 2009-05-28 14:25 3942048 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-03 12:36 . 2009-04-19 01:10 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 12:36 . 2009-04-19 01:10 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-02 01:31 . 2008-11-07 01:06 ——– d—–w- c:\program files\SSC Service Utility
2009-07-31 23:15 . 2007-12-31 22:04 ——– d—–w- c:\program files\Ashampoo
2009-07-30 02:45 . 2008-08-20 21:22 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-07-25 04:23 . 2008-12-06 16:26 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-07-22 17:09 . 2008-09-08 20:56 ——– d—–w- c:\program files\PKR
2009-07-22 04:20 . 2009-07-22 04:20 ——– d—–w- c:\documents and settings\All Users\Application Data\F-Secure
2009-07-18 00:01 . 2009-07-17 23:53 848 –sha-w- c:\windows\system32\KGyGaAvL.sys
2009-07-17 23:53 . 2009-07-17 23:53 ——– d—–w- c:\documents and settings\All Users\Application Data\InstallShield
2009-07-17 23:52 . 2009-07-17 23:52 ——– d—–w- c:\documents and settings\Arjun\Application Data\Corel
2009-07-17 23:52 . 2009-07-17 23:52 ——– d—–w- c:\program files\Common Files\Corel
2009-07-17 23:52 . 2009-07-17 23:49 ——– d—–w- c:\program files\Corel
2009-07-17 18:55 . 2006-02-28 12:00 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-17 00:01 . 2009-06-29 23:24 ——– d—–w- c:\program files\Adolix
2009-07-13 09:08 . 2006-02-28 12:00 286720 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-07 16:19 . 2009-07-06 23:27 ——– d—–w- c:\program files\East-Tec Backup
2009-06-29 16:12 . 2006-02-28 12:00 827392 —-a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2006-02-28 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2006-02-28 12:00 17408 —-a-w- c:\windows\system32\corpol.dll
2009-06-19 20:37 . 2008-06-20 20:51 46864 —-a-w- c:\windows\system32\drivers\TfSysMon.sys
2009-06-19 20:37 . 2008-06-20 20:51 33552 —-a-w- c:\windows\system32\drivers\TfNetMon.sys
2009-06-19 20:37 . 2008-06-20 20:51 51984 —-a-w- c:\windows\system32\drivers\TfFsMon.sys
2009-06-18 00:49 . 2009-06-18 00:49 103 —-a-w- c:\documents and settings\Arjun\Application Data\Smart Audio Editor\smae.dll
2009-06-17 12:20 . 2009-06-17 12:20 12648 —-a-w- c:\windows\system32\drivers\psi_mf.sys
2009-06-16 14:55 . 2006-02-28 12:00 82432 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2006-02-28 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 00:24 . 2007-02-02 16:39 64456 —-a-w- c:\documents and settings\Arjun\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-12 11:50 . 2006-02-28 12:00 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 15:22 . 2009-06-10 15:22 152576 —-a-w- c:\documents and settings\Arjun\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-10 14:21 . 2006-02-28 12:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:22 . 2009-06-22 01:14 83344 —-a-w- c:\windows\system32\Erasext.dll
2009-06-10 13:22 . 2009-06-22 01:14 307088 —-a-w- c:\windows\system32\Eraser.dll
2009-06-10 13:22 . 2009-06-22 01:14 73104 —-a-w- c:\windows\system32\Eraserl.exe
2009-06-10 06:32 . 2006-02-28 12:00 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-09 15:06 . 2007-02-02 16:30 1871872 —-a-w- c:\windows\system32\mstscax.dll
2009-06-03 19:27 . 2006-02-28 12:00 1290752 —-a-w- c:\windows\system32\quartz.dll
2008-11-07 01:09 . 2008-11-07 01:09 382 —-a-w- c:\program files\Shortcut to Program Files.lnk
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6F9DEF1A-C65A-F01A-B42D-9B6F763A94B3}"= "c:\program files\Nero\Nero 7\Nero Fast CD-DVD Burning Plug-in\NeroBurnPlugin.dll" [2009-08-07 562736]

[HKEY_CLASSES_ROOT\clsid\{6f9def1a-c65a-f01a-b42d-9b6f763a94b3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkinClock"="c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2008-09-11 1739264]
"ADSM"="c:\program files\Abaiko Disk Space Monitor\ADSM.exe" [2008-12-22 1966080]
"Web Video Downloader"="c:\program files\SourceTec\Sothink Web Video Downloader Stand-alone\VideoDownloader.exe" [2009-08-07 3257616]
"Invisible Security"="c:\program files\Invisible Security Full\InvisibleSecurityFull.exe" [2009-07-14 1380352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-06-19 259344]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"a-squared"="c:\program files\a-squared Anti-Malware\a2guard.exe" [2009-08-17 3209360]
"ShellLess"="c:\program files\ShellLess\ShellLess.exe" [2008-09-02 2198528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SSC Service Utility"="c:\program files\SSC Service Utility\ssc_serv.exe" [2007-10-09 665600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Flashget"="c:\program files\FlashGet\FlashGet.exe" [2007-09-25 2007088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-01 1519616]
"NvMediaCenter"="NvMCTray.dll" - c:\windows\system32\nvmctray.dll [2006-06-01 86016]
"P17Helper"="P17.dll" - c:\windows\system32\P17.DLL [2005-05-03 64512]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-09-06 16262656]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

c:\documents and settings\Arjun\Start Menu\Programs\Startup\
FastStone Capture.lnk - c:\program files\FastStone Capture\FSCapture.exe [2007-2-13 1111552]
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-6-24 803176]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Ashampoo Magical Defrag.lnk - c:\program files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe [2008-6-23 4540120]
SnagIt 7.lnk - c:\program files\TechSmith\SnagIt 7\SnagIt32.exe [2005-10-14 3719168]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RecentX"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\IpSharkk\\IpSharkk.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"94:TCP"= 94:TCP:VRS Recording System Web Control Panel

R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [05/06/2009 02:56 40560]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [20/06/2008 21:51 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [20/06/2008 21:51 46864]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [14/02/2007 21:49 11264]
R1 anf0100.sys;anf0100.sys;c:\windows\system32\drivers\anf0100.sys [10/09/2008 21:33 9728]
R1 LADriver;LADriver;c:\windows\system32\drivers\LADriver.sys [31/07/2007 16:39 27136]
R1 LDDriver;LDDriver;c:\windows\system32\drivers\LDDriver.sys [31/07/2007 16:39 24064]
R1 LHDriver;LHDriver;c:\windows\system32\drivers\LHDriver.sys [31/07/2007 16:39 14336]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [05/08/2009 16:06 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [05/08/2009 16:06 74480]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [29/05/2009 21:02 95592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [03/05/2009 22:51 108289]
R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service –> c:\program files\ThreatFire\TFService.exe service [?]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [14/02/2007 21:55 35712]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [17/06/2009 13:20 12648]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [20/06/2008 21:51 33552]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [15/05/2009 03:10 16640]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\3.tmp –> c:\windows\system32\3.tmp [?]
S3 p17filt;p17filt;c:\windows\system32\drivers\p17filt.sys –> c:\windows\system32\drivers\p17filt.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [05/08/2009 16:06 7408]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-08-29 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-01-12 17:02]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-Eraser RiskMonitor - c:\program files\East-Tec Eraser 2008\Launch.exe
HKLM-Run-DesktopMechanic - (no file)
ShellExecuteHooks-{1214FBE7-4464-4A7E-9958-B5851A7A30A3} - (no file)
SafeBoot-aawservice

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sky.com/
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
IE: {{1F958B09-6612-7a0e-9223-4C7324C57B23}
Trusted Zone: microsoft.com\*.update
Trusted Zone: windowsupdate.com\download
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://prerelease.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {2D9F7B63-EC7C-43FF-A41D-6E9EC984A5B9} - hxxps://myaccount.gateway.gov.uk/ClientObjects/GGSecSign.cab
DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} - hxxp://drm1.reelsurvey.com/ePlayer/V3_2_0_0/ACNePlayer.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-30 00:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\3.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1960408961-1060284298-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E167F7F6-0493-63D1-670C-D9904F58312C}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(728)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\program files\ThreatFire\TFWAH.dll
c:\program files\ThreatFire\TFNI.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll

- - - - - - - > 'lsass.exe'(784)
c:\program files\ThreatFire\TFWAH.dll
.
Completion time: 2009-08-29 0:47
ComboFix-quarantined-files.txt 2009-08-29 23:47
ComboFix2.txt 2007-12-27 16:27

Pre-Run: 4,037,885,952 bytes free
Post-Run: 4,210,675,712 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

276 — E O F — 2009-08-18 17:50

CatByte

Post #4September 1, 2009, 9:26 AM UTC last edited September 25, 2009, 1:49 AM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
c:\windows\system32\3.tmp

Driver::
MEMSWEEP2

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MEMSWEEP2]

RegNull::
[HKEY_USERS\S-1-5-21-1960408961-1060284298-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E167F7F6-0493-63D1-670C-D9904F58312C}*]

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

CatByte

Post #5September 1, 2009, 9:32 AM UTC last edited September 6, 2009, 11:40 AM UTC

Hi,

We need to replace a file from your installatiion CF

Please do the following:

1] Boot computer with the Windows XP CD-ROM in the CD-ROM drive.
2] To repair a Windows XP installation using Recovery Console, press R.
3] At the command prompt, type the following commands:-

cd \windows\system32\drivers [Press the ENTER Key]

ren ntfs.sys ntfs.old [Press the ENTER Key]

If the ntfs.sys file is there and corrupt it will rename it. If it is not there then it is missing/moved

4]At the command prompt, type the following command, and then press ENTER:
copy X:\i386\ntfs.sys drive:\windows\system32\drivers [Where X=CD-ROM Drive letter]

5]Remove the Windows XP CD from CD-ROM drive, type quit, and then
press ENTER to quit the Recovery Console.

6. Restart the system.

Crimea

Post #6September 4, 2009, 11:09 PM UTC last edited September 6, 2009, 11:40 AM UTC

Hi,

Here are the results:

ComboFix 09-08-29.01 - Arjun 02/09/2009 1:59.3.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.430 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Arjun\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

FILE ::
"c:\windows\system32\3.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Memman.vxd

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MEMSWEEP2

((((((((((((((((((((((((( Files Created from 2009-08-02 to 2009-09-02 )))))))))))))))))))))))))))))))
.

2009-08-26 16:29 . 2009-08-26 16:29 152576 —-a-w- c:\documents and settings\Arjun\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-24 17:18 . 2009-08-24 17:18 ——– d—–w- c:\program files\ERUNT
2009-08-20 21:07 . 2009-08-20 21:07 ——– d—–w- c:\program files\EASEUS
2009-08-20 02:48 . 2009-08-20 02:48 ——– d—–w- c:\documents and settings\Arjun\Application Data\Eltima Software
2009-08-20 02:33 . 2009-08-20 02:33 ——– d—–w- c:\program files\Eltima Software
2009-08-19 01:34 . 2009-09-02 01:06 ——– d—–w- c:\program files\FlashGet
2009-08-18 17:48 . 2009-08-18 17:48 ——– d—–w- c:\windows\ServicePackFiles
2009-08-17 20:22 . 2009-08-17 20:22 ——– d—–w- c:\program files\Secunia
2009-08-16 01:50 . 2009-08-16 01:50 ——– d—–w- c:\program files\Digiarty
2009-08-13 04:32 . 2009-08-13 04:32 ——– d—–w- c:\documents and settings\All Users\Application Data\explauncher
2009-08-13 04:32 . 2009-08-13 04:32 ——– d—–w- c:\documents and settings\All Users\Application Data\launcher
2009-08-10 00:55 . 2009-08-10 00:55 ——– d—–w- c:\program files\ImgBurn
2009-08-09 21:46 . 2009-08-09 21:51 1209 —-a-w- C:\mxlog.dat
2009-08-09 21:44 . 2008-07-21 09:34 75264 —-a-w- c:\windows\system32\zlib1.dll
2009-08-09 20:54 . 2009-09-01 15:43 117760 —-a-w- c:\documents and settings\Arjun\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-09 20:54 . 2009-08-09 20:54 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-08-04 17:56 . 2009-08-04 17:56 4248840 —-a-w- c:\windows\system32\qtp-mt334.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-02 01:09 . 2009-03-01 16:23 766 —-a-r- c:\documents and settings\Arjun\Application Data\Microsoft\Installer\{E2CAFC9F-95A1-4F27-9C1D-34DC9426A81B}\_250159c2.exe
2009-09-02 01:09 . 2009-03-01 16:23 2238 —-a-r- c:\documents and settings\Arjun\Application Data\Microsoft\Installer\{E2CAFC9F-95A1-4F27-9C1D-34DC9426A81B}\_67c77e22.exe
2009-09-02 01:09 . 2009-03-01 16:23 2238 —-a-r- c:\documents and settings\Arjun\Application Data\Microsoft\Installer\{E2CAFC9F-95A1-4F27-9C1D-34DC9426A81B}\_6006e3a.exe
2009-09-02 01:09 . 2007-07-31 19:25 ——– d—–w- c:\program files\Invisible Security Full
2009-09-02 01:09 . 2008-03-27 16:30 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-02 00:54 . 2007-02-21 20:17 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-01 16:05 . 2009-04-10 21:36 ——– d—–w- c:\program files\SpywareBlaster
2009-08-26 16:31 . 2008-06-01 15:50 ——– d—–w- c:\program files\Java
2009-08-20 21:07 . 2007-02-14 20:49 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-20 16:26 . 2009-07-10 21:14 ——– d—–w- c:\program files\WinUtilities
2009-08-18 19:09 . 2007-12-23 23:57 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-17 02:23 . 2007-02-22 02:33 ——– d—–w- c:\program files\Common Files\Adobe
2009-08-13 14:34 . 2008-06-20 20:51 ——– d—–w- c:\program files\ThreatFire
2009-08-13 04:23 . 2009-06-05 01:56 ——– d—–w- c:\program files\Paragon Software
2009-08-10 00:56 . 2007-12-31 19:53 ——– d—–w- c:\documents and settings\Arjun\Application Data\ImgBurn
2009-08-09 21:44 . 2009-04-16 22:35 ——– d—–w- c:\documents and settings\Arjun\Application Data\Moyea
2009-08-09 21:44 . 2009-04-16 22:31 ——– d—–w- c:\program files\Moyea
2009-08-09 20:54 . 2007-02-21 16:37 ——– d—–w- c:\documents and settings\Arjun\Application Data\SUPERAntiSpyware.com
2009-08-09 20:53 . 2007-02-21 15:24 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-08-05 22:15 . 2009-05-03 21:51 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-05 18:48 . 2009-06-27 03:43 ——– d—–w- c:\documents and settings\Arjun\Application Data\dvdcss
2009-08-05 09:11 . 2006-02-28 12:00 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 17:56 . 2009-06-05 01:56 40560 —-a-w- c:\windows\system32\drivers\hotcore3.sys
2009-08-04 17:03 . 2009-04-19 01:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-04 17:02 . 2009-05-28 14:25 3942048 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-03 12:36 . 2009-04-19 01:10 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 12:36 . 2009-04-19 01:10 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-02 01:31 . 2008-11-07 01:06 ——– d—–w- c:\program files\SSC Service Utility
2009-07-31 23:15 . 2007-12-31 22:04 ——– d—–w- c:\program files\Ashampoo
2009-07-30 02:45 . 2008-08-20 21:22 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-07-25 04:23 . 2008-12-06 16:26 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-07-22 17:09 . 2008-09-08 20:56 ——– d—–w- c:\program files\PKR
2009-07-22 04:20 . 2009-07-22 04:20 ——– d—–w- c:\documents and settings\All Users\Application Data\F-Secure
2009-07-18 00:01 . 2009-07-17 23:53 848 –sha-w- c:\windows\system32\KGyGaAvL.sys
2009-07-17 23:53 . 2009-07-17 23:53 ——– d—–w- c:\documents and settings\All Users\Application Data\InstallShield
2009-07-17 23:52 . 2009-07-17 23:52 ——– d—–w- c:\documents and settings\Arjun\Application Data\Corel
2009-07-17 23:52 . 2009-07-17 23:52 ——– d—–w- c:\program files\Common Files\Corel
2009-07-17 23:52 . 2009-07-17 23:49 ——– d—–w- c:\program files\Corel
2009-07-17 18:55 . 2006-02-28 12:00 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-17 00:01 . 2009-06-29 23:24 ——– d—–w- c:\program files\Adolix
2009-07-13 09:08 . 2006-02-28 12:00 286720 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-07 16:19 . 2009-07-06 23:27 ——– d—–w- c:\program files\East-Tec Backup
2009-06-29 16:12 . 2006-02-28 12:00 827392 ——w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2006-02-28 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2006-02-28 12:00 17408 —-a-w- c:\windows\system32\corpol.dll
2009-06-19 20:37 . 2008-06-20 20:51 46864 —-a-w- c:\windows\system32\drivers\TfSysMon.sys
2009-06-19 20:37 . 2008-06-20 20:51 33552 —-a-w- c:\windows\system32\drivers\TfNetMon.sys
2009-06-19 20:37 . 2008-06-20 20:51 51984 —-a-w- c:\windows\system32\drivers\TfFsMon.sys
2009-06-18 00:49 . 2009-06-18 00:49 103 —-a-w- c:\documents and settings\Arjun\Application Data\Smart Audio Editor\smae.dll
2009-06-17 12:20 . 2009-06-17 12:20 12648 —-a-w- c:\windows\system32\drivers\psi_mf.sys
2009-06-16 14:55 . 2006-02-28 12:00 82432 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2006-02-28 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 00:24 . 2007-02-02 16:39 64456 —-a-w- c:\documents and settings\Arjun\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-12 11:50 . 2006-02-28 12:00 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 15:22 . 2009-06-10 15:22 152576 —-a-w- c:\documents and settings\Arjun\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-10 14:21 . 2006-02-28 12:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:22 . 2009-06-22 01:14 83344 —-a-w- c:\windows\system32\Erasext.dll
2009-06-10 13:22 . 2009-06-22 01:14 307088 —-a-w- c:\windows\system32\Eraser.dll
2009-06-10 13:22 . 2009-06-22 01:14 73104 —-a-w- c:\windows\system32\Eraserl.exe
2009-06-10 06:32 . 2006-02-28 12:00 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-09 15:06 . 2007-02-02 16:30 1871872 —-a-w- c:\windows\system32\mstscax.dll
2008-11-07 01:09 . 2008-11-07 01:09 382 —-a-w- c:\program files\Shortcut to Program Files.lnk
.

((((((((((((((((((((((((((((( SnapShot@2009-08-29_23.43.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-02 01:08 . 2009-09-02 01:08 16384 c:\windows\temp\Perflib_Perfdata_2b0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6F9DEF1A-C65A-F01A-B42D-9B6F763A94B3}"= "c:\program files\Nero\Nero 7\Nero Fast CD-DVD Burning Plug-in\NeroBurnPlugin.dll" [2009-08-07 562736]

[HKEY_CLASSES_ROOT\clsid\{6f9def1a-c65a-f01a-b42d-9b6f763a94b3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkinClock"="c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2008-09-11 1739264]
"ADSM"="c:\program files\Abaiko Disk Space Monitor\ADSM.exe" [2008-12-22 1966080]
"Web Video Downloader"="c:\program files\SourceTec\Sothink Web Video Downloader Stand-alone\VideoDownloader.exe" [2009-08-07 3257616]
"Invisible Security"="c:\program files\Invisible Security Full\InvisibleSecurityFull.exe" [2009-07-14 1380352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-02-28 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-02-28 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-06-19 259344]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"ShellLess"="c:\program files\ShellLess\ShellLess.exe" [2008-09-02 2198528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SSC Service Utility"="c:\program files\SSC Service Utility\ssc_serv.exe" [2007-10-09 665600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Flashget"="c:\program files\FlashGet\FlashGet.exe" [2007-09-25 2007088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-06-01 1519616]
"NvMediaCenter"="NvMCTray.dll" - c:\windows\system32\nvmctray.dll [2006-06-01 86016]
"P17Helper"="P17.dll" - c:\windows\system32\P17.DLL [2005-05-03 64512]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-09-06 16262656]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

c:\documents and settings\Arjun\Start Menu\Programs\Startup\
FastStone Capture.lnk - c:\program files\FastStone Capture\FSCapture.exe [2007-2-13 1111552]
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-6-24 803176]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Ashampoo Magical Defrag.lnk - c:\program files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe [2008-6-23 4540120]
SnagIt 7.lnk - c:\program files\TechSmith\SnagIt 7\SnagIt32.exe [2005-10-14 3719168]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RecentX"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\IpSharkk\\IpSharkk.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"94:TCP"= 94:TCP:VRS Recording System Web Control Panel

R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [05/06/2009 02:56 40560]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [20/06/2008 21:51 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [20/06/2008 21:51 46864]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [14/02/2007 21:49 11264]
R1 anf0100.sys;anf0100.sys;c:\windows\system32\drivers\anf0100.sys [10/09/2008 21:33 9728]
R1 LADriver;LADriver;c:\windows\system32\drivers\LADriver.sys [31/07/2007 16:39 27136]
R1 LDDriver;LDDriver;c:\windows\system32\drivers\LDDriver.sys [31/07/2007 16:39 24064]
R1 LHDriver;LHDriver;c:\windows\system32\drivers\LHDriver.sys [31/07/2007 16:39 14336]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [05/08/2009 16:06 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [05/08/2009 16:06 74480]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [29/05/2009 21:02 95592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [03/05/2009 22:51 108289]
R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service –> c:\program files\ThreatFire\TFService.exe service [?]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [14/02/2007 21:55 35712]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [17/06/2009 13:20 12648]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [20/06/2008 21:51 33552]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [15/05/2009 03:10 16640]
S3 p17filt;p17filt;c:\windows\system32\drivers\p17filt.sys –> c:\windows\system32\drivers\p17filt.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [05/08/2009 16:06 7408]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-09-02 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-01-12 17:02]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.sky.com/
IE: &Download; All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download; with FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
IE: {{1F958B09-6612-7a0e-9223-4C7324C57B23}
Trusted Zone: microsoft.com\*.update
Trusted Zone: windowsupdate.com\download
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://prerelease.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {2D9F7B63-EC7C-43FF-A41D-6E9EC984A5B9} - hxxps://myaccount.gateway.gov.uk/ClientObjects/GGSecSign.cab
DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} - hxxp://drm1.reelsurvey.com/ePlayer/V3_2_0_0/ACNePlayer.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 02:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(732)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\program files\ThreatFire\TFWAH.dll
c:\program files\ThreatFire\TFNI.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll

- - - - - - - > 'lsass.exe'(788)
c:\program files\ThreatFire\TFWAH.dll

- - - - - - - > 'explorer.exe'(3228)
c:\windows\system32\WININET.dll
c:\program files\ThreatFire\TFWAH.dll
c:\program files\SourceTec\Sothink Web Video Downloader Stand-alone\VideoDownloader.dll
c:\program files\FlashGet\fgmgr.dll
c:\windows\system32\msutb.dll
c:\windows\system32\ieframe.dll
c:\program files\Atomic Alarm Clock\Clock.dll
c:\program files\ThreatFire\TFNI.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
c:\windows\ATKKBService.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Ashampoo\Ashampoo Magical Defrag\bin\defragActivityMonitor.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\PSIService.exe
c:\windows\system32\rundll32.exe
c:\program files\ThreatFire\TFService.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\msiexec.exe
c:\program files\TechSmith\SnagIt 7\TscHelp.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-09-02 2:16 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-02 01:16
ComboFix2.txt 2007-12-27 16:27

Pre-Run: 4,429,365,248 bytes free
Post-Run: 4,250,939,392 bytes free

287 — E O F — 2009-08-18 17:50

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, September 2, 2009
Operating system: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, September 02, 2009 03:20:54
Records in database: 2738855
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Objects scanned: 453345
Threats found: 2
Infected objects found: 3
Suspicious objects found: 0
Scan duration: 07:44:05

File name / Threat / Threats count
D:\### UTILITIES\VIDEO DOWNLOADS\VideoCacheView 1.50 (Nirsoft)\VideoCacheView.exe Infected: not-a-virus:PSWTool.Win32.NetPass.jr 1
D:\### UTILITIES\VIDEO DOWNLOADS\VideoCacheView 1.50 (Nirsoft)\videocacheview_setup.exe Infected: not-a-virus:PSWTool.Win32.NetPass.jr 1
D:\4dcf903d5cff6274f4e7c7dafaf4\update\Exe\ui.dllHIDDEN123456HIDDEN123456\### VARIOUS\PKR.com Poker\pkrinstall.exe Infected: not-a-virus:Monitor.Win32.PKRPoker.e 1

Selected area has been scanned.

I don't wish to delete any of the three suspicious files.

I've replaced the ntfs.sys file, as far as I'm aware, although I got a bit confused by copy X:\i386\ntfs.sys drive:\windows\system32\drivers. Replacing drive with C seemed to work. This is a little bit daunting for me. Also, I was unsure whether it was CF Script [incorrect] or CFScript [correct] - even as I've written this, it still looks like there's a space between CF and Script.

Am I correct in assuming the malware responsible for the problems I'm still experiencing, contrary to what I said in #3, haven't yet been removed?

The strange actions, below, seem to occur at random - I can't detect any pattern:
- IE7 windows won't open when some (but not all) web-links are clicked;
- Right-click context menu is disabled, occasionally;
- Occasionally, My Computer won't open, but I can navigate around existing Windows Explorer windows; and
- Once, the IE7 window I was using, crashed, but the others remained open, however I was able to re-log-on to all the sites I was on at the time, without any problems.

An A-squared On-line Scan found the same traces as before:
a-squared Web Malware Scanner v. 4.0
© 2003-2009 Emsi Software GmbH - www.emsisoft.com

ID Object
0 Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E5B91392-1DD4-4B12-8D8D-87577377F432}\InprocServer32 –> ThreadingModel detected: Trace.Registry.DDominator!A2
1 Value: HKEY_CLASSES_ROOT\CLSID\{E5B91392-1DD4-4B12-8D8D-87577377F432}\InprocServer32 –> ThreadingModel detected: Trace.Registry.DDominator!A2
2 c:\windows\system32\memman.vxd detected: Trace.File.Computer Monitor Keylogger!A2

Thanks for your help thus far.

CatByte

Post #7September 4, 2009, 11:21 PM UTC

Hi,

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Crimea

Post #8September 5, 2009, 12:22 AM UTC

Hi, Malwarebytes' Anti-Malware 1.40 Database version: 2743 Windows 5.1.2600 Service Pack 2 05/09/2009 01:14:37 mbam-log-2009-09-05 (01-14-37).txt Scan type: Quick Scan Objects scanned: 99079 Time elapsed: 15 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\Memman.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\Memman.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully.

CatByte

Post #9September 5, 2009, 12:38 AM UTC

Please post a fresh DDS and Attach.txt and advise how your computer is running now and if there are any outstanding issues

Crimea

Post #10September 6, 2009, 3:02 AM UTC

Hi,

I stil seem to have the same problems, although they are less severe.
I've run MBAM again and it has found and supposedly deleted "Memman.vxd"…again. Here's the latest log:

Malwarebytes' Anti-Malware 1.40
Database version: 2747
Windows 5.1.2600 Service Pack 2

06/09/2009 03:23:50
mbam-log-2009-09-06 (03-23-50).txt

Scan type: Quick Scan
Objects scanned: 99210
Time elapsed: 15 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\Memman.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\Memman.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully.

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 3:34:49.67 on 06/09/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.412 [GMT 1:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ShellLess\ShellLess.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\SSC Service Utility\ssc_serv.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
C:\Program Files\Abaiko Disk Space Monitor\ADSM.exe
C:\Program Files\SourceTec\Sothink Web Video Downloader Stand-alone\VideoDownloader.exe
C:\Program Files\Invisible Security Full\InvisibleSecurityFull.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe
C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
C:\Program Files\FastStone Capture\FSCapture.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\TechSmith\SnagIt 7\TSCHelp.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\defragActivityMonitor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Arjun\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sky.com/
BHO: HelperObject Class: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 7\SnagItBHO.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: FGCatchUrl: {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - c:\program files\flashget\jccatch.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - c:\program files\flashget\getflash.dll
TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 7\SnagItIEAddin.dll
TB: HDSPPropPage Class: {6f9def1a-c65a-f01a-b42d-9b6f763a94b3} - c:\program files\nero\nero 7\nero fast cd-dvd burning plug-in\NeroBurnPlugin.dll
TB: {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - No File
uRun: [SkinClock] c:\program files\atomic alarm clock\AtomicAlarmClock.exe
uRun: [ADSM] c:\program files\abaiko disk space monitor\ADSM.exe
uRun: [Web Video Downloader] "c:\program files\sourcetec\sothink web video downloader stand-alone\VideoDownloader.exe"
uRun: [Invisible Security] c:\program files\invisible security full\InvisibleSecurityFull.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [SkyTel] SkyTel.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [ThreatFire] c:\program files\threatfire\TFTray.exe
mRun: [P17Helper] Rundll32 P17.dll,P17Helper
mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [ShellLess] c:\program files\shellless\ShellLess.exe hide
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SSC Service Utility] c:\program files\ssc service utility\ssc_serv.exe /s
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Flashget] "c:\program files\flashget\FlashGet.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRunOnce: [MRUBlaster] c:\program files\mru-blaster\indexcleaner.exe -COOKIES
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\arjun\startm~1\programs\startup\fastst~1.lnk - c:\program files\faststone capture\FSCapture.exe
StartupFolder: c:\docume~1\arjun\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ashamp~1.lnk - c:\program files\ashampoo\ashampoo magical defrag\bin\aDefragCtrl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\snagit~1.lnk - c:\program files\techsmith\snagit 7\SnagIt32.exe
IE: &Download All with FlashGet - c:\program files\flashget\jc_all.htm
IE: &Download with FlashGet - c:\program files\flashget\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
IE: {1F958B09-6612-7a0e-9223-4C7324C57B23}
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe
IE: {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - {17A84966-F1E9-4645-AA9E-5E771EE1C859} - c:\progra~1\nuclea~1\videoget\plugins\VIDEOG~1.DLL
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: microsoft.com\*.update
Trusted Zone: windowsupdate.com\download
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {076169AA-8C3D-4CFC-AC23-3ACA88FC21B5} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - hxxp://www.creative.com/su/ocx/15030/CTSUEng.cab
DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} - hxxp://support.f-secure.com/ols/fscax.cab
DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} - hxxp://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://prerelease.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {2D9F7B63-EC7C-43FF-A41D-6E9EC984A5B9} - hxxps://myaccount.gateway.gov.uk/ClientObjects/GGSecSign.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} - hxxp://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197990575718
DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} - hxxp://esupport.epson-europe.com/selftest/en/Prg/ESTPTest.cab
DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - hxxp://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} - hxxp://www.nanoscan.com/cabs/nanoinst.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} - hxxp://drm1.reelsurvey.com/ePlayer/V3_2_0_0/ACNePlayer.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} - hxxp://support.f-secure.com/ols/fscax.cab
DPF: {C237A80A-4C55-4C68-BAA9-CBE4408D12B2} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} - hxxp://www.freedom.net/viruscenter/onlineviruscheck/cabs/cssweb.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://vpn.pharmalink.co.uk/dana-cached/setup/JuniperSetupSP1.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/su/ocx/15030/CTPID.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 AVG Anti-Rootkit;AVG Anti-Rootkit;c:\windows\system32\drivers\avgarkt.sys [2007-1-31 5632]
R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [2009-6-5 40560]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2008-6-20 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2008-6-20 46864]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2007-2-14 11264]
R1 anf0100.sys;anf0100.sys;c:\windows\system32\drivers\anf0100.sys [2008-9-10 9728]
R1 AvgArCln;Avg Anti-Rootkit Clean Driver;c:\windows\system32\drivers\AvgArCln.sys [2007-10-24 3968]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-5-3 11608]
R1 LADriver;LADriver;c:\windows\system32\drivers\LADriver.sys [2007-7-31 27136]
R1 LDDriver;LDDriver;c:\windows\system32\drivers\LDDriver.sys [2007-7-31 24064]
R1 LHDriver;LHDriver;c:\windows\system32\drivers\LHDriver.sys [2007-7-31 14336]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-8-5 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-8-5 74480]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [2009-5-29 95592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-5-3 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-5-3 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-3 55656]
R2 ThreatFire;ThreatFire;c:\program files\threatfire\tfservice.exe service –> c:\program files\threatfire\TFService.exe service [?]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [2007-2-14 35712]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2008-6-20 33552]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [2009-5-15 16640]
S3 p17filt;p17filt;c:\windows\system32\drivers\p17filt.sys –> c:\windows\system32\drivers\p17filt.sys [?]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-8-5 7408]
S3 Video3D;ASUS Video3D Service;c:\windows\system32\drivers\video3d32.sys –> c:\windows\system32\drivers\Video3D32.sys [?]

=============== Created Last 30 ================

2009-08-30 00:43 -cd—– c:\windows\system32\dllcache\cache
2009-08-30 00:34 a-dshr– C:\cmdcons
2009-08-30 00:32 229,376 a——- c:\windows\PEV.exe
2009-08-30 00:32 161,792 a——- c:\windows\SWREG.exe
2009-08-30 00:32 98,816 a——- c:\windows\sed.exe
2009-08-20 22:07 –d—– c:\program files\EASEUS
2009-08-20 03:33 40,960 a——- c:\windows\wavdest.ax
2009-08-20 03:33 –d—– c:\program files\Eltima Software
2009-08-19 02:34 –d—– c:\program files\FlashGet
2009-08-18 18:48 –d—– c:\windows\ServicePackFiles
2009-08-17 21:22 –d—– c:\program files\Secunia
2009-08-16 02:50 –d—– c:\program files\Digiarty
2009-08-13 05:32 –d—– c:\docume~1\alluse~1\applic~1\explauncher
2009-08-13 05:32 –d—– c:\docume~1\alluse~1\applic~1\launcher
2009-08-09 22:46 1,209 a——- C:\mxlog.dat
2009-08-09 22:44 53,248 a——- c:\windows\system32\MyFlashZip0.ax
2009-08-09 22:44 75,264 a——- c:\windows\system32\zlib1.dll
2009-08-09 21:54 –d—– c:\program files\SUPERAntiSpyware
2009-08-07 12:30 4,604,701 a——- c:\windows\system32\SNAGIT7

==================== Find3M ====================

2009-08-05 23:15 55,656 a——- c:\windows\system32\drivers\avgntflt.sys
2009-08-05 10:11 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-08-04 18:56 4,248,840 a——- c:\windows\system32\qtp-mt334.dll
2009-08-04 18:56 40,560 a——- c:\windows\system32\drivers\hotcore3.sys
2009-08-03 13:36 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 13:36 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-07-25 05:23 411,368 a——- c:\windows\system32\deploytk.dll
2009-07-17 19:55 58,880 a——- c:\windows\system32\atl.dll
2009-07-13 10:08 286,720 a——- c:\windows\system32\wmpdxm.dll
2009-06-29 17:12 827,392 ——– c:\windows\system32\wininet.dll
2009-06-29 17:12 78,336 a——- c:\windows\system32\ieencode.dll
2009-06-29 17:12 17,408 a——- c:\windows\system32\corpol.dll
2009-06-16 15:55 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 15:55 82,432 a——- c:\windows\system32\fontsub.dll
2009-06-12 12:50 76,288 a——- c:\windows\system32\telnet.exe
2009-06-10 15:21 84,992 a——- c:\windows\system32\avifil32.dll
2009-06-10 14:22 83,344 a——- c:\windows\system32\Erasext.dll
2009-06-10 14:22 307,088 a——- c:\windows\system32\Eraser.dll
2009-06-10 14:22 73,104 a——- c:\windows\system32\Eraserl.exe
2009-06-10 07:32 132,096 a——- c:\windows\system32\wkssvc.dll
2009-06-09 16:06 1,871,872 a——- c:\windows\system32\mstscax.dll
2008-11-07 02:09 382 a——- c:\program files\Shortcut to Program Files.lnk

============= FINISH: 3:36:32.92 ===============

Did I replace the "ntfs.sys" file correctly? This was my procedure:

———————————————
Microsoft Windows XP ™ Recovery Console
etc

1: C:\WINDOWS
Which Windows installation would you like to log onto
1 Enter
C:\WINDOWS>cd \windows\system32\drivers Enter
C:\WINDOWS\SYSTEM32\DRIVERS>ren ntfs.sys ntfs.old Enter
C:\WINDOWS\SYSTEM32\DRIVERS>copy E:\i386\ntfs.sys C:\windows\system32\drivers Enter
1 file(s) copied
C:\WINDOWS\SYSTEM32\DRIVERS>quit Enter
The command is not recognized
———————————————
I tried different commands, none of which were recognised, so I manually rebooted.

Attachments:

📎Attach_2.txt

CatByte

Post #11September 6, 2009, 11:25 AM UTC

Hi,

Yes, you have done everything perfectly, thank-you.

Can you please describe exactly what your symptoms are in more detail.

Memman.vxd seems to be found by MBAM after deletion.

Lets clean out all your temp folders, then have a look for where else this may be hiding on your system.

Please do the following:

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

It's normal after running TFC cleaner that the PC will be slower to boot the first time.

NEXT

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
*Memman*

:folderfind
*Memman*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Crimea

Post #12September 10, 2009, 10:38 PM UTC

Sorry for the delay in replying.

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 21:49 on 08/09/2009 by Arjun (Administrator - Elevation successful)

========== filefind ==========

Searching for "*Memman*"
C:\Documents and Settings\Arjun\Favorites\FORUM POSTS\What the Tech\2009-08 Memman.vxd\Memman.vxd (Rogue.SysCleanerPro) - can't get rid of..url –a— 885 bytes [19:37 24/08/2009] [22:36 04/09/2009] AFAB428213F9FAA43C3724200DE9717E
C:\Documents and Settings\Arjun\Favorites\FORUM POSTS\What the Tech\2009-08 Memman.vxd\memman.vxd problem - Security Cadets Forum.url –a— 289 bytes [03:14 24/08/2009] [03:14 24/08/2009] BE5B70DCFF620A323105E543CE164BC4
C:\Documents and Settings\Arjun\Local Settings\Temporary Internet Files\Content.IE5\EHDNH83X\Memman_vxd_Rogue_SysCleanerPro_can_t_get_rid_of_t106417[1].htm –a— 226698 bytes [20:47 08/09/2009] [20:47 08/09/2009] FD479CF9BA2393B608B6F559FED40726
C:\Qoobox\Quarantine\C\WINDOWS\system32\Memman.vxd.vir –a— 5765 bytes [21:41 22/09/2002] [21:41 22/09/2002] 73009575522F741FC9EE14391EF3F6BB
C:\WINDOWS\system32\Memman.vxd –a— 5765 bytes [21:41 22/09/2002] [21:41 22/09/2002] 73009575522F741FC9EE14391EF3F6BB

========== folderfind ==========

Searching for "*Memman*"
C:\Documents and Settings\Arjun\Favorites\FORUM POSTS\What the Tech\2009-08 Memman.vxd d—– [03:14 24/08/2009]

-=End Of File=-

I think the problems I had, as I haven’t experienced any of them for the past 2 days, may have had 3 separate causes (I’m guessing):

1. Memman.vxd.

2. The P.C. overheating. I might not have sufficient RAM or the MFT may be too fragmented and the hard-drive has to work harder than it should and everything is too hot. Maybe my puny processor fan can’t cope. To be honest, earlier in the year, when the P.C. had been on for a couple of days, it began to behave strangely – the DVD drive would no longer open, lots of prog. menus opened and closed of their own accord and the layout of the icons in Windows Explorer changed, which has become permanent. The forward and back icons have disappeared from the top left, above the blue bar, to be replaced with a single back button on the right. I presume this is a layout option you can choose, but I didn’t choose it. Because these only ever happened when I thought the P.C. was hot, I didn’t mention them. They began to occur much more frequently from that point onwards and sometimes the blue bar on the left of the screen disappeared, together with Windows Explorer freezing. The problems with Win Exp are the most common I experienced, but they haven’t occurred for 2 days.

3. Virtual Memory regularly being too low. I got a warning about this, a couple of days ago, for the first time. When the warning appeared, a whole host of functions were disabled, some of the same functions that had been playing up previously (couldn’t open Win Exp; no context menu was available anywhere; one of my screen-capture progs not working) and which I had attributed to Memman.vxd and the heat I presumed the P.C. was experiencing. Closing some of my open IE7 tabs and windows restored a lot of the features.

I’ve installed CleanMem and since then, everything seems reasonably O.K. IE pages which have been open for hours don’t take an age to reappear when I maximise them and saving a URL to the favourites is now almost instant, rather than the 60 secs it used to take each time.

I got hold of the Everest Ultimate Edition 4.6 diagnostic utility and can view the temps of everything, but I don’t know what the safe operating temps should be.

I’ve used PageDefrag 2.32, but it listed all of the components as single fragments and the defrag lasted only a second.

I don’t know whether to try tackling the MFT.

I don't know what "C:\Qoobox\Quarantine" is and it can't have been on the drive since 2002, as the whole P.C. is only 2 years old.

CatByte

Post #13September 10, 2009, 11:04 PM UTC

Hi,

Qoobox is where ComboFix stores the deleted files:

Please do the following:

Please download OTM by OldTimer.

Save it to your desktop.
Please click OTM and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Files
C:\Documents and Settings\Arjun\Favorites\FORUM POSTS\What the Tech\2009-08 Memman.vxd\Memman.vxd (Rogue.SysCleanerPro) - can't get rid of..url 
C:\Documents and Settings\Arjun\Favorites\FORUM POSTS\What the Tech\2009-08 Memman.vxd\memman.vxd problem - Security Cadets Forum.url 
C:\Documents and Settings\Arjun\Local Settings\Temporary Internet Files\Content.IE5\EHDNH83X\Memman_vxd_Rogue_SysCleanerPro_can_t_get_rid_of_t106417[1].htm
C:\WINDOWS\system32\Memman.vxd 

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

NEXT:

Download and run Auslogics Disc Defragmenter

NEXT

Please post a fresh DDS and Attach.txt

Crimea

Post #14September 16, 2009, 1:48 AM UTC

OTM
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\Documents and Settings\Arjun\Favorites\FORUM POSTS\What the Tech\2009-08 Memman.vxd\Memman.vxd (Rogue.SysCleanerPro) - can't get rid of..url moved successfully.
C:\Documents and Settings\Arjun\Favorites\FORUM POSTS\What the Tech\2009-08 Memman.vxd\memman.vxd problem - Security Cadets Forum.url moved successfully.
File/Folder C:\Documents and Settings\Arjun\Local Settings\Temporary Internet Files\Content.IE5\EHDNH83X\Memman_vxd_Rogue_SysCleanerPro_can_t_get_rid_of_t106417[1].htm not found.
C:\WINDOWS\system32\Memman.vxd moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Arjun
->Temp folder emptied: 3592676 bytes
->Temporary Internet Files folder emptied: 4623955 bytes
->Java cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 7.87 mb

OTM by OldTimer - Version 3.0.0.6 log created on 09142009_023712

Files moved on Reboot…

Registry entries deleted on Reboot…
————————————————————————————–

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 3:37:31.89 on 15/09/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.638 [GMT 1:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ShellLess\ShellLess.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\SSC Service Utility\ssc_serv.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\FlashGet\FlashGet.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
C:\Program Files\Abaiko Disk Space Monitor\ADSM.exe
C:\Program Files\SourceTec\Sothink Web Video Downloader Stand-alone\VideoDownloader.exe
C:\Program Files\Invisible Security Full\InvisibleSecurityFull.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe
C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe
C:\Program Files\FastStone Capture\FSCapture.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\TechSmith\SnagIt 7\TSCHelp.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\defragActivityMonitor.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Arjun\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.sky.com/
BHO: HelperObject Class: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 7\SnagItBHO.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: FGCatchUrl: {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - c:\program files\flashget\jccatch.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - c:\program files\flashget\getflash.dll
TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 7\SnagItIEAddin.dll
TB: HDSPPropPage Class: {6f9def1a-c65a-f01a-b42d-9b6f763a94b3} - c:\program files\nero\nero 7\nero fast cd-dvd burning plug-in\NeroBurnPlugin.dll
TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
TB: {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - No File
uRun: [SkinClock] c:\program files\atomic alarm clock\AtomicAlarmClock.exe
uRun: [ADSM] c:\program files\abaiko disk space monitor\ADSM.exe
uRun: [Web Video Downloader] "c:\program files\sourcetec\sothink web video downloader stand-alone\VideoDownloader.exe"
uRun: [Invisible Security] c:\program files\invisible security full\InvisibleSecurityFull.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [SkyTel] SkyTel.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [P17Helper] Rundll32 P17.dll,P17Helper
mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [ShellLess] c:\program files\shellless\ShellLess.exe hide
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SSC Service Utility] c:\program files\ssc service utility\ssc_serv.exe /s
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Flashget] "c:\program files\flashget\FlashGet.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\arjun\startm~1\programs\startup\fastst~1.lnk - c:\program files\faststone capture\FSCapture.exe
StartupFolder: c:\docume~1\arjun\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ashamp~1.lnk - c:\program files\ashampoo\ashampoo magical defrag\bin\aDefragCtrl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\snagit~1.lnk - c:\program files\techsmith\snagit 7\SnagIt32.exe
IE: &Download All with FlashGet - c:\program files\flashget\jc_all.htm
IE: &Download with FlashGet - c:\program files\flashget\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
IE: {1F958B09-6612-7a0e-9223-4C7324C57B23}
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe
IE: {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - {17A84966-F1E9-4645-AA9E-5E771EE1C859} - c:\progra~1\nuclea~1\videoget\plugins\VIDEOG~1.DLL
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: microsoft.com\*.update
Trusted Zone: windowsupdate.com\download
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {076169AA-8C3D-4CFC-AC23-3ACA88FC21B5} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - hxxp://www.creative.com/su/ocx/15030/CTSUEng.cab
DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} - hxxp://support.f-secure.com/ols/fscax.cab
DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} - hxxp://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://prerelease.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {2D9F7B63-EC7C-43FF-A41D-6E9EC984A5B9} - hxxps://myaccount.gateway.gov.uk/ClientObjects/GGSecSign.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} - hxxp://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197990575718
DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} - hxxp://esupport.epson-europe.com/selftest/en/Prg/ESTPTest.cab
DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - hxxp://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} - hxxp://www.nanoscan.com/cabs/nanoinst.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} - hxxp://drm1.reelsurvey.com/ePlayer/V3_2_0_0/ACNePlayer.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} - hxxp://support.f-secure.com/ols/fscax.cab
DPF: {C237A80A-4C55-4C68-BAA9-CBE4408D12B2} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} - hxxp://www.freedom.net/viruscenter/onlineviruscheck/cabs/cssweb.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://vpn.pharmalink.co.uk/dana-cached/setup/JuniperSetupSP1.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/su/ocx/15030/CTPID.cab
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 AVG Anti-Rootkit;AVG Anti-Rootkit;c:\windows\system32\drivers\avgarkt.sys [2007-1-31 5632]
R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [2009-6-5 40560]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2007-2-14 11264]
R1 anf0100.sys;anf0100.sys;c:\windows\system32\drivers\anf0100.sys [2008-9-10 9728]
R1 AvgArCln;Avg Anti-Rootkit Clean Driver;c:\windows\system32\drivers\AvgArCln.sys [2007-10-24 3968]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-5-3 11608]
R1 LADriver;LADriver;c:\windows\system32\drivers\LADriver.sys [2007-7-31 27136]
R1 LDDriver;LDDriver;c:\windows\system32\drivers\LDDriver.sys [2007-7-31 24064]
R1 LHDriver;LHDriver;c:\windows\system32\drivers\LHDriver.sys [2007-7-31 14336]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-9-4 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-9-4 74480]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [2009-5-29 95592]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-5-3 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-5-3 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-3 55656]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [2007-2-14 35712]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [2009-5-15 16640]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-9-14 8704]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-9-14 3072]
S3 p17filt;p17filt;c:\windows\system32\drivers\p17filt.sys –> c:\windows\system32\drivers\p17filt.sys [?]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-9-4 7408]
S3 Video3D;ASUS Video3D Service;c:\windows\system32\drivers\video3d32.sys –> c:\windows\system32\drivers\Video3D32.sys [?]

=============== Created Last 30 ================

2009-09-15 00:40 –d—– c:\docume~1\arjun\applic~1\Auslogics
2009-09-15 00:40 –d—– c:\program files\Auslogics
2009-09-14 21:55 1,663,488 a——- c:\windows\system32\BootMan.exe
2009-09-14 21:55 86,408 a——- c:\windows\system32\setupempdrv03.exe
2009-09-14 21:55 14,848 a——- c:\windows\system32\EuEpmGdi.dll
2009-09-14 21:55 8,704 a——- c:\windows\system32\epmntdrv.sys
2009-09-14 21:55 3,072 a——- c:\windows\system32\EuGdiDrv.sys
2009-09-14 02:37 –d—– C:\_OTM
2009-09-11 02:04 –d—– c:\program files\Runtime Software
2009-09-10 02:22 121,856 a——- c:\windows\system32\schtasks.exe
2009-09-10 02:22 32,768 a——- c:\windows\system32\CleanMem.exe
2009-09-10 01:09 –d—– c:\windows\CleanMem
2009-09-10 01:09 –d—– c:\program files\CleanMem
2009-09-09 21:57 –d—– c:\docume~1\arjun\applic~1\ContentGuard
2009-09-08 00:18 25,992 a——- c:\windows\system32\pgdfgsvc.exe
2009-09-07 01:31 –d—– c:\program files\WOT
2009-09-06 21:55 –d—– c:\program files\SUPERAntiSpyware
2009-08-30 00:43 -cd—– c:\windows\system32\dllcache\cache
2009-08-30 00:34 a-dshr– C:\cmdcons
2009-08-30 00:32 229,376 a——- c:\windows\PEV.exe
2009-08-30 00:32 161,792 a——- c:\windows\SWREG.exe
2009-08-30 00:32 98,816 a——- c:\windows\sed.exe
2009-08-20 22:07 –d—– c:\program files\EASEUS
2009-08-20 03:33 40,960 a——- c:\windows\wavdest.ax
2009-08-20 03:33 –d—– c:\program files\Eltima Software
2009-08-19 02:34 –d—– c:\program files\FlashGet
2009-08-18 18:48 –d—– c:\windows\ServicePackFiles
2009-08-17 21:22 –d—– c:\program files\Secunia

==================== Find3M ====================

2009-09-10 14:54 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 14:53 19,160 a——- c:\windows\system32\drivers\mbam.sys
2009-08-09 22:51 1,209 a——- C:\mxlog.dat
2009-08-05 23:15 55,656 a——- c:\windows\system32\drivers\avgntflt.sys
2009-08-05 10:11 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-08-04 18:56 4,248,840 a——- c:\windows\system32\qtp-mt334.dll
2009-08-04 18:56 40,560 a——- c:\windows\system32\drivers\hotcore3.sys
2009-07-25 05:23 411,368 a——- c:\windows\system32\deploytk.dll
2009-07-17 19:55 58,880 a——- c:\windows\system32\atl.dll
2009-07-13 10:08 286,720 a——- c:\windows\system32\wmpdxm.dll
2009-06-29 17:12 827,392 ——– c:\windows\system32\wininet.dll
2009-06-29 17:12 78,336 a——- c:\windows\system32\ieencode.dll
2009-06-29 17:12 17,408 a——- c:\windows\system32\corpol.dll
2008-11-07 02:09 382 a——- c:\program files\Shortcut to Program Files.lnk

============= FINISH: 3:38:26.34 ===============

I still experience some of the problems, but don't know whether they are caused by the sluggish P.C. or Memman.vxd, which appears to still be present, as shown below:

Malwarebytes' Anti-Malware 1.41
Database version: 2798
Windows 5.1.2600 Service Pack 2

15/09/2009 04:15:40
mbam-log-2009-09-15 (04-15-29).txt

Scan type: Quick Scan
Objects scanned: 99923
Time elapsed: 2 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\Memman.vxd (Rogue.sysCleaner) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\Memman.vxd (Rogue.sysCleaner) -> No action taken.

Attachments:

📎Attach_3.txt

CatByte

Post #15September 16, 2009, 2:13 AM UTC last edited September 16, 2009, 2:15 AM UTC

Hi,

The MalwareBytes scan shows "no action taken"…did you allow it to delete the items?

For some reason this is recreating on your system

Lets clear out your DNS,

reset your hosts and clean all your removable media, to see if we can find the source of this issue.

Please do the following:

Go to Start > Run > type: cmd
Press OK or Hit Enter.
At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
Hit Enter.
You will get a confirmation that the flush was successful.
Close the command box.

NEXT

Please download HostsXpert

Unzip HostsXpert to it's own folder in a convenient place such as C:\HostsXpert
Run: HostsXpert.exe
Click: Make Writable? in the upper left corner.
Click: Restore MS Hosts File
Click: Replace
Click: OK
Click: Make ReadOnly
Close HostsXpert.

NEXT

Download Flash_Disinfector.exe from HERE and save it to your desktop.

Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

NEXT

Download & extract this file to it's own folder - http://www.xs4all.nl/~fstaal01/downloads/regsearch.zip

Launch Registry Search

In the search box, enter …

Memman.vxd

Then click "Ok".

Notepad will open with some text in it (the file will also be saved in the program's folder as well).

Post this text in your next reply

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Memman.vxd (Rogue.SysCleanerPro) - can't get rid of.

✨ Ask AI

Ask AI