Spyware / Malware / Virus Removal

[Resolved] browser popup problems, cpu overworked, error message at sh

8 min read

Looking for the outcome? Ask AI

fertigline Topic Starter

Post #1September 7, 2009, 9:29 AM UTC

A couple days ago my Internet explorer web browser stopped working, my computer started working very slowly an I now have a "rundll32 not responding" message when I shutdown. I have done a system scan with Norton, ran Spybot and a few hours of research on the internet which brought me here. I hope you can help me. Thanks in advance. Here are my reports: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 4:19:03.68 on Mon 09/07/2009 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.464 [GMT -4:00] AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton AntiVirus *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Michele\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://news.google.com/nwshp?hl=en&tab=wn uSearchURL,(Default) = hxxp://www.google.com/keyword/%s BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File TB: {5BED3930-2E9E-76D8-BACC-80DF2188D455} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [EPSON Stylus CX7400 Series] c:\windows\system32\spool\drivers\w32x86\3\e_faticda.exe /fu "c:\docume~1\michele\locals~1\temp\E_S2E.tmp" /EF "HKCU" uRun: [EasyLinkAdvisor] "c:\program files\linksys easylink advisor\LinksysAgent.exe" /startup uRun: [A00F5BBB6.exe] c:\docume~1\michele\locals~1\temp\_A00F5BBB6.exe uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe uRun: [A00F7828B.exe] c:\docume~1\michele\locals~1\temp\_A00F7828B.exe mRun: [VTTimer] VTTimer.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [osCheck] "c:\program files\norton antivirus\osCheck.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot dRun: [ALUAlert] c:\program files\symantec\liveupdate\ALUNotify.exe StartupFolder: c:\docume~1\michele\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe IE: Web Savings - file://c:\program files\websavings_from_ebates\sy400\tp400\scri400a.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: Yahoo! Checkers - hxxp://origin.games.yahoo.net/games/clients/y/kt4_x.cab DPF: Yahoo! Euchre - hxxp://origin.games.yahoo.net/games/clients/y/et3_x.cab DPF: Yahoo! Gin - hxxp://origin.games.yahoo.net/games/clients/y/nt1_x.cab DPF: Yahoo! MahJong - hxxp://origin.games.yahoo.net/games/clients/y/ot0_x.cab DPF: Yahoo! Poker - hxxp://origin.games.yahoo.net/games/clients/y/pt3_x.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38201.5160416667 DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Notify: 60b14da9665 - c:\windows\system32\dmdskmgr32.dll Notify: __c0048D10 - c:\windows\system32\__c0048D10.dat Notify: __c00ACBFE - c:\windows\system32\__c00ACBFE.dat AppInit_DLLs: c:\windows\system32\dmdskmgr32.dll ============= SERVICES / DRIVERS =============== R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2004-9-29 9344] R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2004-8-5 77056] R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2004-9-29 459648] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-1-25 149352] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-1-25 149352] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-1-25 149352] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-26 102448] R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090906.019\NAVENG.SYS [2009-9-6 84912] R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090906.019\NAVEX15.SYS [2009-9-6 1323568] S2 gupdate1c986d62011e7dc;Google Update Service (gupdate1c986d62011e7dc);c:\program files\google\update\GoogleUpdate.exe [2009-2-4 133104] S2 mrtRate;mrtRate; [x] S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-1-12 23888] S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2008-5-13 1245064] =============== Created Last 30 ================ 2009-09-07 03:57 28,160 a——- c:\windows\system32\__c00FB771.dat 2009-09-07 03:33 28,160 a——- c:\windows\system32\__c001C5CA.dat 2009-09-06 21:59 28,160 a——- c:\windows\system32\__c0085BFC.dat 2009-09-06 21:45 28,160 a——- c:\windows\system32\__c00D1D5E.dat 2009-09-06 21:16 28,160 a——- c:\windows\system32\__c0048D10.dat 2009-09-06 21:16 –dsh— c:\documents and settings\michele\IECompatCache 2009-09-06 08:46 0 a——- c:\windows\system32\GroupPolicy000.dat 2009-09-05 20:41 –dsh— c:\documents and settings\michele\PrivacIE 2009-09-05 20:36 –dsh— c:\documents and settings\michele\IETldCache 2009-09-05 20:32 –d—– c:\windows\ie8updates 2009-09-05 20:28 -cd-h— c:\windows\ie8 2009-09-05 20:26 100,352 -c—— c:\windows\system32\dllcache\iecompat.dll 2009-09-05 20:26 246,272 -c—— c:\windows\system32\dllcache\ieproxy.dll 2009-09-05 20:26 12,800 -c—— c:\windows\system32\dllcache\xpshims.dll 2009-09-05 15:50 615 a——- c:\windows\system32\uAzgbPu.vbs 2009-09-05 15:49 615 a——- c:\windows\system32\qPOumkB.vbs 2009-09-05 15:34 615 a——- c:\windows\system32\xYcbWp3rpmNPGej.vbs 2009-09-05 15:32 615 a——- c:\windows\system32\iTgGwiw.vbs 2009-09-05 14:21 17,852 a——- c:\windows\GnuHashes.ini 2009-09-05 14:13 615 a——- c:\windows\system32\d3uMJ8stHApTR0e.vbs 2009-09-05 14:12 –dsh— c:\windows\system32\LocalService 2009-09-05 14:12 523,776 a–sh— c:\windows\system32\22.tmp 2009-09-05 14:12 121,856 a——- c:\windows\system32\dmdskmgr32.dll 2009-09-05 14:12 615 a——- c:\windows\system32\IHOTlPWkRcaUFFR.vbs 2009-08-29 06:39 –d—– c:\program files\PowerLayers 2009-08-29 06:11 –d—– c:\program files\Photo Stamp Remover 2009-08-15 19:52 1,089,593 -c—— c:\windows\system32\dllcache\ntprint.cat 2009-08-15 09:18 –d—– c:\windows\system32\XPSViewer 2009-08-15 09:17 597,504 -c—— c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-08-15 09:17 89,088 -c—— c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-08-15 09:17 117,760 ——– c:\windows\system32\prntvpt.dll 2009-08-15 09:17 1,676,288 -c—— c:\windows\system32\dllcache\xpssvcs.dll 2009-08-15 09:17 575,488 -c—— c:\windows\system32\dllcache\xpsshhdr.dll 2009-08-15 09:17 1,676,288 ——– c:\windows\system32\xpssvcs.dll 2009-08-15 09:17 575,488 ——– c:\windows\system32\xpsshhdr.dll 2009-08-15 09:17 –d—– C:\721240bc5bc824d3bf8140 2009-08-15 09:17 –d—– c:\windows\SxsCaPendDel 2009-08-11 15:06 128,512 -c—— c:\windows\system32\dllcache\dhtmled.ocx 2009-08-11 15:06 1,315,328 -c—— c:\windows\system32\dllcache\msoe.dll ==================== Find3M ==================== 2009-08-05 05:01 204,800 a——- c:\windows\system32\mswebdvd.dll 2009-07-17 15:01 58,880 a——- c:\windows\system32\atl.dll 2009-07-12 12:21 233,472 a——- c:\windows\system32\wmpdxm.dll 2009-07-03 13:09 915,456 a——- c:\windows\system32\wininet.dll 2009-06-24 11:02 76,487 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2009-06-16 10:36 119,808 a——- c:\windows\system32\t2embed.dll 2009-06-16 10:36 81,920 a——- c:\windows\system32\fontsub.dll 2009-06-12 08:31 76,288 a——- c:\windows\system32\telnet.exe 2009-06-10 10:13 84,992 a——- c:\windows\system32\avifil32.dll 2009-06-10 09:19 2,066,432 a——- c:\windows\system32\mstscax.dll 2009-06-10 02:14 132,096 a——- c:\windows\system32\wkssvc.dll 2007-07-08 14:12 374 a——- c:\docume~1\michele\applic~1\internaldb6334.dat 2007-06-01 22:27 18,432 a——- c:\docume~1\michele\applic~1\internaldb41.dat 2007-06-01 22:25 538 a——- c:\docume~1\michele\applic~1\internaldb8467.dat ============= FINISH: 4:21:21.00 =============== ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/09/07 04:24 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xF5AF5000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7C2D000 Size: 8192 File Visible: No Signed: - Status: - SSDT ——————- #: 012 Function Name: NtAlertResumeThread Status: Hooked by "" at address 0x860776a0 #: 013 Function Name: NtAlertThread Status: Hooked by "" at address 0x8602f0c8 #: 017 Function Name: NtAllocateVirtualMemory Status: Hooked by "" at address 0x86219188 #: 031 Function Name: NtConnectPort Status: Hooked by "" at address 0x85e381d8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xf5d99020 #: 043 Function Name: NtCreateMutant Status: Hooked by "" at address 0x8607abb8 #: 053 Function Name: NtCreateThread Status: Hooked by "" at address 0x860eea78 #: 057 Function Name: NtDebugActiveProcess Status: Hooked by "" at address 0x8607d2d0 #: 063 Function Name: NtDeleteKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xf5d992a0 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xf5d99800 #: 083 Function Name: NtFreeVirtualMemory Status: Hooked by "" at address 0x86221708 #: 089 Function Name: NtImpersonateAnonymousToken Status: Hooked by "" at address 0x860796a8 #: 091 Function Name: NtImpersonateThread Status: Hooked by "" at address 0x8608f6f8 #: 108 Function Name: NtMapViewOfSection Status: Hooked by "" at address 0x860ce588 #: 114 Function Name: NtOpenEvent Status: Hooked by "" at address 0x860796e0 #: 123 Function Name: NtOpenProcessToken Status: Hooked by "" at address 0x860260e0 #: 125 Function Name: NtOpenSection Status: Hooked by "" at address 0x8607ab78 #: 129 Function Name: NtOpenThreadToken Status: Hooked by "" at address 0x860148c8 #: 206 Function Name: NtResumeThread Status: Hooked by "" at address 0x85d44988 #: 213 Function Name: NtSetContextThread Status: Hooked by "" at address 0x8602dda0 #: 228 Function Name: NtSetInformationProcess Status: Hooked by "" at address 0x860082f0 #: 229 Function Name: NtSetInformationThread Status: Hooked by "" at address 0x8602f810 #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xf5d99a50 #: 253 Function Name: NtSuspendProcess Status: Hooked by "" at address 0x8607a608 #: 254 Function Name: NtSuspendThread Status: Hooked by "" at address 0x8602ed50 #: 257 Function Name: NtTerminateProcess Status: Hooked by "" at address 0x86024810 #: 258 Function Name: NtTerminateThread Status: Hooked by "" at address 0x8602e6b8 #: 267 Function Name: NtUnmapViewOfSection Status: Hooked by "" at address 0x8602d548 #: 277 Function Name: NtWriteVirtualMemory Status: Hooked by "" at address 0x86224b60 ==EOF==

Attachments:

📎Attach.txt

Raktor

Post #2September 7, 2009, 9:38 AM UTC

[external image: Posted Image]

Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

Absence of symptoms does not always mean the computer is clean
Please do not run any scans or fixes without my direction.
Finally, stay with this topic until I give you the final 'All clear' post.

Please read through the instructions to familiarize yourself with what to expect when the tool runs.

Please download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link:How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts. Close all browsers/windows first.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

fertigline

Post #3September 7, 2009, 10:38 AM UTC

After Combo ran, my computer restarted and Spybot asked me to allow a few items that I ok'd, then I had to shutdown and turn my powerstrip off, wait a minute and back on again before I could get back on the internet. Everthing seems to be working normally now.

Thank you very much, I am grateful for your help and that this website exsists.

p.s. (I have Spybot running and there is a spyware program on my Norton that I believe is running also, is this a problem?)

Here is the ComboFix report:

ComboFix 09-09-06.04 - Michele 09/07/2009 5:52.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.563 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton AntiVirus *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Michele\LOCALS~1\Temp\C.tmp
c:\documents and settings\Michele\Application Data\02000000eeff4b66665C.manifest
c:\documents and settings\Michele\Application Data\02000000eeff4b66665O.manifest
c:\documents and settings\Michele\Application Data\02000000eeff4b66665P.manifest
c:\documents and settings\Michele\Application Data\02000000eeff4b66665S.manifest
c:\documents and settings\Michele\Local Settings\Temp\C.tmp
c:\windows\GnuHashes.ini
c:\windows\system32\__c001C5CA.dat
c:\windows\system32\__c0048D10.dat
c:\windows\system32\__c005DFB9.dat
c:\windows\system32\__c0085BFC.dat
c:\windows\system32\__c00CC854.dat
c:\windows\system32\__c00D1D5E.dat
c:\windows\system32\__c00FB771.dat
c:\windows\system32\d3uMJ8stHApTR0e.vbs
c:\windows\system32\DMDSKMGR32.DLL
c:\windows\system32\GroupPolicy000.dat
c:\windows\system32\IHOTlPWkRcaUFFR.vbs
c:\windows\system32\iTgGwiw.vbs
c:\windows\system32\LocalService\277.crack.zip
c:\windows\system32\LocalService\277.crack.zip.kwd
c:\windows\system32\LocalService\278.keygen.zip
c:\windows\system32\LocalService\278.keygen.zip.kwd
c:\windows\system32\LocalService\279.serial.zip
c:\windows\system32\LocalService\279.serial.zip.kwd
c:\windows\system32\LocalService\280.setup.zip
c:\windows\system32\LocalService\280.setup.zip.kwd
c:\windows\system32\LocalService\281.music.au
c:\windows\system32\LocalService\281.music.au.kwd
c:\windows\system32\LocalService\282.music2.au
c:\windows\system32\LocalService\282.music2.au.kwd
c:\windows\system32\LocalService\283.music3.au
c:\windows\system32\LocalService\283.music3.au.kwd
c:\windows\system32\LocalService\284.music4.au
c:\windows\system32\LocalService\284.music4.au.kwd
c:\windows\system32\qPOumkB.vbs
c:\windows\system32\twain.dll
c:\windows\system32\uAzgbPu.vbs
c:\windows\system32\xYcbWp3rpmNPGej.vbs

.
((((((((((((((((((((((((( Files Created from 2009-08-07 to 2009-09-07 )))))))))))))))))))))))))))))))
.

2009-09-07 08:14 . 2009-09-07 08:14 ——– d—–w- c:\program files\ERUNT
2009-09-07 01:16 . 2009-09-07 01:16 ——– d-sh–w- c:\documents and settings\Michele\IECompatCache
2009-09-06 11:37 . 2009-09-06 11:37 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-09-06 00:41 . 2009-09-06 00:41 ——– d-sh–w- c:\documents and settings\Michele\PrivacIE
2009-09-06 00:36 . 2009-09-06 00:36 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-09-06 00:36 . 2009-09-06 00:36 ——– d-sh–w- c:\documents and settings\Michele\IETldCache
2009-09-06 00:32 . 2009-09-06 00:32 ——– d—–w- c:\windows\ie8updates
2009-09-06 00:28 . 2009-09-06 00:30 ——– dc-h–w- c:\windows\ie8
2009-09-06 00:26 . 2009-08-07 08:48 100352 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2009-09-06 00:26 . 2009-07-03 17:09 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2009-09-06 00:26 . 2009-07-03 17:09 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-05 18:12 . 2009-09-07 09:57 ——– d-sh–w- c:\windows\system32\LocalService
2009-08-29 10:39 . 2009-08-29 10:39 ——– d—–w- c:\program files\PowerLayers
2009-08-29 10:11 . 2009-08-29 10:11 ——– d—–w- c:\program files\Photo Stamp Remover
2009-08-15 13:18 . 2009-08-15 13:18 ——– d—–w- c:\windows\system32\XPSViewer
2009-08-15 13:18 . 2009-08-15 13:18 ——– d—–w- c:\program files\MSBuild
2009-08-15 13:18 . 2009-08-15 13:18 ——– d—–w- c:\program files\Reference Assemblies
2009-08-15 13:17 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-15 13:17 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-08-15 13:17 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-15 13:17 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-15 13:17 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-08-15 13:17 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-15 13:17 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-08-15 13:17 . 2009-08-15 13:18 ——– d—–w- C:\721240bc5bc824d3bf8140
2009-08-15 13:17 . 2009-08-15 23:28 ——– d—–w- c:\windows\SxsCaPendDel
2009-08-11 19:06 . 2009-07-10 13:27 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-07 08:23 . 2009-09-07 08:23 34816 —-a-w- c:\windows\system32\drivers\rootrepeal.sys
2009-09-07 01:52 . 2009-02-04 14:36 ——– d—–w- c:\program files\Google
2009-09-06 11:22 . 2009-02-04 14:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-09-06 04:57 . 2004-08-18 20:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-06 04:36 . 2004-08-18 20:19 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-09-05 19:36 . 2007-05-22 23:04 ——– d—–w- c:\documents and settings\Michele\Application Data\LimeWire
2009-09-05 18:13 . 2007-04-15 15:55 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-09-05 18:12 . 2009-09-05 18:12 523776 –sha-w- c:\windows\system32\22.tmp
2009-08-18 21:44 . 2004-09-04 22:03 43224 —-a-w- c:\documents and settings\Michele\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 09:01 . 2004-07-30 20:40 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-02 01:52 . 2005-12-17 04:28 ——– d—–w- c:\program files\Starry Night Sky Explorer
2009-07-17 19:01 . 2004-07-30 20:40 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-12 16:21 . 2004-08-04 07:56 233472 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-02-06 23:05 915456 —-a-w- c:\windows\system32\wininet.dll
2009-06-16 14:36 . 2001-08-18 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2001-08-18 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2002-08-29 07:41 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-07-30 20:40 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2004-07-30 20:40 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2001-08-18 12:00 132096 —-a-w- c:\windows\system32\wkssvc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 454784]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-12-17 98304]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2008-02-07 718704]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-04 198160]
"VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2003-05-07 36864]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2003-08-05 57344]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2008-02-10 152952]

c:\documents and settings\Michele\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Forget Me Not.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Forget Me Not.lnk
backup=c:\windows\pss\Forget Me Not.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [9/29/2004 5:20 PM 9344]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [8/5/2004 4:02 PM 77056]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [9/29/2004 5:20 PM 459648]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [1/25/2008 9:47 PM 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/26/2009 8:10 PM 102448]
S2 gupdate1c986d62011e7dc;Google Update Service (gupdate1c986d62011e7dc);c:\program files\Google\Update\GoogleUpdate.exe [2/4/2009 10:37 AM 133104]
S2 mrtRate;mrtRate; [x]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [1/12/2008 10:32 PM 23888]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-04 20:39]

2009-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 14:37]

2009-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 14:37]

2009-08-31 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Michele.job
- c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 14:05]
.
- - - - ORPHANS REMOVED - - - -

Notify-60b14da9665 - c:\windows\System32\dmdskmgr32.dll
Notify-__c00ACBFE - c:\windows\system32\__c00ACBFE.dat

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://news.google.com/nwshp?hl=en&tab=wn
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Web Savings - file://c:\program files\WebSavings_from_Ebates\Sy400\Tp400\scri400a.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: Yahoo! Checkers - hxxp://origin.games.yahoo.net/games/clients/y/kt4_x.cab
DPF: Yahoo! Euchre - hxxp://origin.games.yahoo.net/games/clients/y/et3_x.cab
DPF: Yahoo! Gin - hxxp://origin.games.yahoo.net/games/clients/y/nt1_x.cab
DPF: Yahoo! MahJong - hxxp://origin.games.yahoo.net/games/clients/y/ot0_x.cab
DPF: Yahoo! Poker - hxxp://origin.games.yahoo.net/games/clients/y/pt3_x.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-07 06:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1456)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\program files\Common Files\Symantec Shared\NPC\2.0\NPCEXT.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2009-09-07 6:03 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-07 10:03

Pre-Run: 63,021,096,960 bytes free
Post-Run: 63,126,622,208 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

218 — E O F — 2009-09-02 01:14

Raktor

Post #4September 7, 2009, 11:26 AM UTC

1) Combofix

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
File:: 
c:\windows\system32\22.tmp
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
If you need help to disable your protection programs see here.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

2) MBAM
Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

3) ESET
You can use either Internet Explorer or Mozilla FireFox for this scan.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

4) What You Will Need To Post:

The new Combofix log
MBAM log
ESET log

fertigline

Post #5September 7, 2009, 2:06 PM UTC

ComboFix 09-09-06.05 - Michele 09/07/2009 7:42.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.606 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Michele\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton AntiVirus *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::
"c:\windows\system32\22.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\22.tmp
c:\windows\system32\LocalService

.
((((((((((((((((((((((((( Files Created from 2009-08-07 to 2009-09-07 )))))))))))))))))))))))))))))))
.

2009-09-07 08:23 . 2009-09-07 08:23 34816 —-a-w- c:\windows\system32\drivers\rootrepeal.sys
2009-09-07 08:14 . 2009-09-07 08:14 ——– d—–w- c:\program files\ERUNT
2009-09-07 01:16 . 2009-09-07 01:16 ——– d-sh–w- c:\documents and settings\Michele\IECompatCache
2009-09-06 11:37 . 2009-09-06 11:37 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-09-06 00:41 . 2009-09-06 00:41 ——– d-sh–w- c:\documents and settings\Michele\PrivacIE
2009-09-06 00:36 . 2009-09-06 00:36 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-09-06 00:36 . 2009-09-06 00:36 ——– d-sh–w- c:\documents and settings\Michele\IETldCache
2009-09-06 00:32 . 2009-09-06 00:32 ——– d—–w- c:\windows\ie8updates
2009-09-06 00:28 . 2009-09-06 00:30 ——– dc-h–w- c:\windows\ie8
2009-09-06 00:26 . 2009-08-07 08:48 100352 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2009-09-06 00:26 . 2009-07-03 17:09 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2009-09-06 00:26 . 2009-07-03 17:09 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-29 10:39 . 2009-08-29 10:39 ——– d—–w- c:\program files\PowerLayers
2009-08-29 10:11 . 2009-08-29 10:11 ——– d—–w- c:\program files\Photo Stamp Remover
2009-08-15 13:18 . 2009-08-15 13:18 ——– d—–w- c:\windows\system32\XPSViewer
2009-08-15 13:18 . 2009-08-15 13:18 ——– d—–w- c:\program files\MSBuild
2009-08-15 13:18 . 2009-08-15 13:18 ——– d—–w- c:\program files\Reference Assemblies
2009-08-15 13:17 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-15 13:17 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-08-15 13:17 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-15 13:17 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-15 13:17 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-08-15 13:17 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-15 13:17 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-08-15 13:17 . 2009-08-15 13:18 ——– d—–w- C:\721240bc5bc824d3bf8140
2009-08-15 13:17 . 2009-08-15 23:28 ——– d—–w- c:\windows\SxsCaPendDel
2009-08-11 19:06 . 2009-07-10 13:27 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-07 11:35 . 2007-04-15 15:55 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-09-07 01:52 . 2009-02-04 14:36 ——– d—–w- c:\program files\Google
2009-09-06 11:22 . 2009-02-04 14:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-09-06 04:57 . 2004-08-18 20:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-06 04:36 . 2004-08-18 20:19 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-09-05 19:36 . 2007-05-22 23:04 ——– d—–w- c:\documents and settings\Michele\Application Data\LimeWire
2009-08-18 21:44 . 2004-09-04 22:03 43224 —-a-w- c:\documents and settings\Michele\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 09:01 . 2004-07-30 20:40 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-02 01:52 . 2005-12-17 04:28 ——– d—–w- c:\program files\Starry Night Sky Explorer
2009-07-17 19:01 . 2004-07-30 20:40 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-12 16:21 . 2004-08-04 07:56 233472 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-02-06 23:05 915456 ——w- c:\windows\system32\wininet.dll
2009-06-16 14:36 . 2001-08-18 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2001-08-18 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2002-08-29 07:41 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-07-30 20:40 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2004-07-30 20:40 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2001-08-18 12:00 132096 —-a-w- c:\windows\system32\wkssvc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 454784]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-12-17 98304]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton AntiVirus\osCheck.exe" [2008-02-07 718704]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-04 198160]
"VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2003-05-07 36864]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2003-08-05 57344]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2008-02-10 152952]

c:\documents and settings\Michele\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\60b14da9665]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00ACBFE]
[BU]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Forget Me Not.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Forget Me Not.lnk
backup=c:\windows\pss\Forget Me Not.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [9/29/2004 5:20 PM 9344]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [8/5/2004 4:02 PM 77056]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [9/29/2004 5:20 PM 459648]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [1/25/2008 9:47 PM 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/26/2009 8:10 PM 102448]
S2 gupdate1c986d62011e7dc;Google Update Service (gupdate1c986d62011e7dc);c:\program files\Google\Update\GoogleUpdate.exe [2/4/2009 10:37 AM 133104]
S2 mrtRate;mrtRate; [x]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [1/12/2008 10:32 PM 23888]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-04 20:39]

2009-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 14:37]

2009-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 14:37]

2009-08-31 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Michele.job
- c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 14:05]
.
- - - - ORPHANS REMOVED - - - -

Notify-__c0048D10 - (no file)

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Web Savings - file://c:\program files\WebSavings_from_Ebates\Sy400\Tp400\scri400a.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: Yahoo! Checkers - hxxp://origin.games.yahoo.net/games/clients/y/kt4_x.cab
DPF: Yahoo! Euchre - hxxp://origin.games.yahoo.net/games/clients/y/et3_x.cab
DPF: Yahoo! Gin - hxxp://origin.games.yahoo.net/games/clients/y/nt1_x.cab
DPF: Yahoo! MahJong - hxxp://origin.games.yahoo.net/games/clients/y/ot0_x.cab
DPF: Yahoo! Poker - hxxp://origin.games.yahoo.net/games/clients/y/pt3_x.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-07 07:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-09-07 7:50
ComboFix-quarantined-files.txt 2009-09-07 11:50
ComboFix2.txt 2009-09-07 10:03

Pre-Run: 63,130,742,784 bytes free
Post-Run: 63,092,330,496 bytes free

163 — E O F — 2009-09-02 01:14

Malwarebytes' Anti-Malware 1.40
Database version: 2750
Windows 5.1.2600 Service Pack 3

9/7/2009 8:01:39 AM
mbam-log-2009-09-07 (08-01-39).txt

Scan type: Quick Scan
Objects scanned: 89089
Time elapsed: 4 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00acbfe (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

C:\Documents and Settings\Michele\My Documents\My Music\LimeWire\pirates of caribbean.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Qoobox\Quarantine\C\DOCUME~1\Michele\LOCALS~1\Temp\C.tmp.vir a variant of Win32/Kryptik.AJU trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\22.tmp.vir a variant of Win32/Kryptik.AJU trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\d3uMJ8stHApTR0e.vbs.vir VBS/Disabler.NAB trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\IHOTlPWkRcaUFFR.vbs.vir VBS/Disabler.NAB trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\iTgGwiw.vbs.vir VBS/Disabler.NAB trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\qPOumkB.vbs.vir VBS/Disabler.NAB trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\uAzgbPu.vbs.vir VBS/Disabler.NAB trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\xYcbWp3rpmNPGej.vbs.vir VBS/Disabler.NAB trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\LocalService\278.keygen.zip.vir a variant of Win32/Kryptik.AJU trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\LocalService\281.music.au.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\LocalService\282.music2.au.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\LocalService\283.music3.au.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\LocalService\284.music4.au.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\System Volume Information\_restore{CD12A592-C555-4823-89CD-0C9DF2564DFC}\RP1166\A0112775.exe a variant of Win32/Kryptik.AJU trojan
C:\System Volume Information\_restore{CD12A592-C555-4823-89CD-0C9DF2564DFC}\RP1166\A0112776.exe a variant of Win32/Kryptik.AJU trojan
C:\System Volume Information\_restore{CD12A592-C555-4823-89CD-0C9DF2564DFC}\RP1171\A0114497.vbs VBS/Disabler.NAB trojan
C:\System Volume Information\_restore{CD12A592-C555-4823-89CD-0C9DF2564DFC}\RP1171\A0114499.vbs VBS/Disabler.NAB trojan
C:\System Volume Information\_restore{CD12A592-C555-4823-89CD-0C9DF2564DFC}\RP1171\A0114500.vbs VBS/Disabler.NAB trojan
C:\System Volume Information\_restore{CD12A592-C555-4823-89CD-0C9DF2564DFC}\RP1171\A0114501.vbs VBS/Disabler.NAB trojan
C:\System Volume Information\_restore{CD12A592-C555-4823-89CD-0C9DF2564DFC}\RP1171\A0114503.vbs VBS/Disabler.NAB trojan
C:\System Volume Information\_restore{CD12A592-C555-4823-89CD-0C9DF2564DFC}\RP1171\A0114504.vbs VBS/Disabler.NAB trojan

Raktor

Post #6September 8, 2009, 10:43 AM UTC

Delete this file, it is infected. - C:\Documents and Settings\Michele\My Documents\My Music\LimeWire\pirates of caribbean.mp3

After that, you're all clean.

We still have a few steps to tidy up though.

1) Step 1
Your current version of Adobe Reader is out of date, and may contain security issues. Please uninstall the version you have now from Add/Remove programs, and then download and install the latest Adobe Reader.

2) Step 2
P2P - I see you have P2P software (LimeWire) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.

3) Step 3
Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
[external image: Posted Image]

The above procedure will reset your System Restore and clear out the backups and quarantines created during the course of this fix.
You can delete the other tools we used during this fix.

========================

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab.
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt.
- Change the Download unsigned ActiveX controls to Disable.
- Change the Initialise and script ActiveX controls not marked as safe to Disable.
- Change the Installation of desktop items to Prompt.
- Change the Launching programs and files in an IFRAME to Prompt.
- Change the Navigate sub-frames across different domains to Prompt.
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

6. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

7. Finally, I strongly recommend that you read Miekiemoses' good advice - How to prevent Malware

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

fertigline

Post #7September 9, 2009, 12:05 AM UTC

Thanks Raktor, I could not have done this without you. I now consider myself a beginner in internet security. I will read all the stuff you suggested. You have no idea (or maybe you do) what a relief it is to have all that malicious software gone from my computer. Thanks again, Fertigline

Raktor

Post #8September 9, 2009, 3:12 AM UTC

Not a problem.

Incase you might be interested, I'll mention that I got trained here at WTT to help other people. If you have enough free time to dedicate, and the will to learn, you might be interested in the WTT Classroom.

Raktor

Post #9September 9, 2009, 3:12 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] browser popup problems, cpu overworked, error message at sh

✨ Ask AI

Ask AI