What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Antivirus Live infection now cant log onto internet

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Ok, here we go. Friday I was on Tabcrawler.com searching guitar tabs. Machine, hp pavillion 750n with xp service pack 3, became infected with Antivirus Live, Kept telling me I was being attacked from a threat on the internet, wouldn't let me access anything, I shut the machine down, entered into safe mode, disabled all services, and startups, saved all important things on another disc. Ran Malware bytes that I had to import via my laptop, which functions correctly through my net gear WNR834Bv2 router, ran scan, said it found and repaird problems( even though adware and my antivirus didn't detect). Restarted in normal mode, virus appears gone but still can't access the internet, I have tried resetting IP address and numerous other things, One funny thing is that no restore point was available to me to go back too? Found this forum, did prelims and here we are: Should be 3 attachments, DDS log MBAM log, and attach log. Hope you can help. This is getting frustrating to say the least :wacko: Ok, I got back on the net with my HP Pavillion, but if anyone sees a problem with any of the logs, I'd appreciate a reply, I was putting my IP settings in my local area 2 connection settings and not in my 1394 connection settings. :blush: Just attached my ARK.txt file, forgot to earlier.

Attachments:

Post #2
Hi Ruger101,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Glad to hear you've gotten back on the internet.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #3
Down loaded and saved combofix, have not run it yet. Would like to know what it will be doing, I just want to make sure that I need to do it. Computer has been working pretty good since running Malewarebytes. I will run it if you reassure me that it is safe. Thanks again.
Post #4
Ruger101, I would not recommend that you do something I didn't consider safe. That being said, I'm not sure I convince you that it is safe. There is an inherit risk in any tool we run and therefore none of them are truly safe. I guess the best I can do is tell you that I've had "victims" use the tool 100's of times without adverse effects. Precautions are taken to be able to "undo" anything that is done if necessary.
Post #5
Ok, finally got back to this, (thankyou for being patient). Ran Combofix, it prompted that a newer version was available and asked if I would like to update, I DID NOT. I hope that was the right move, anyway, the rest of the process seemed to go smoothly. It did install the recovery console. Below you should find the log that it created.
Let me know how it looks, and what I should do next. :popcorn:

A little curious as to why it deleted shared files, not a big deal. And what were the other programs/files (if you know). Not worried about the coupon ones, I know who thought that would be a great deal. lol
One more thing, you'll see a file created ctfmon.exe - not sure why, but a buddy was walking me through(over the phone) a shut down of all unneccesary start up programs and asked if that file was present, I told him exactly how the file was (character for character) and he instructed me to create that file folder, and delete the one that exsisted, After this weeklong crash course in computer science, I wonder if that was a good Idea. haha


ComboFix 10-01-04.01 - Owner 01/11/2010 21:04:21.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.257 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AntiVir Personal Edition *On-access scanning disabled* (Outdated) {F50D9AC1-6409-476C-A8D6-8F5F82336C8F}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\My Documents\ZbThumbnail.info
c:\program files\Shared
c:\recycler\S-1-5-21-1409082233-2111687655-1801674531-1003
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\EventSystem.log
c:\windows\system\oeminfo.ini
c:\windows\system32\BSTIEPrintCtl1.dll
c:\windows\system32\ps2.bat

.
((((((((((((((((((((((((( Files Created from 2009-12-12 to 2010-01-12 )))))))))))))))))))))))))))))))
.

2010-01-10 04:08 . 2001-08-17 19:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2010-01-10 04:08 . 2001-08-17 19:48 12160 —-a-w- c:\windows\system32\dllcache\mouhid.sys
2010-01-10 04:08 . 2008-04-13 19:45 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2010-01-10 04:08 . 2008-04-13 19:45 10368 —-a-w- c:\windows\system32\dllcache\hidusb.sys
2010-01-07 21:20 . 2010-01-07 21:20 ——– d—–w- c:\documents and settings\Owner\Application Data\MAGIX
2010-01-07 21:05 . 2003-04-18 21:29 44544 —-a-w- c:\windows\system32\msxml4a.dll
2010-01-07 21:04 . 2010-01-07 21:05 ——– d—–w- c:\documents and settings\All Users\Application Data\MAGIX
2010-01-07 21:02 . 2001-05-11 19:18 420240 —-a-w- c:\windows\system32\mpg4c32.dll
2010-01-07 21:00 . 2010-01-07 21:05 ——– d—–w- c:\program files\Common Files\MAGIX Shared
2010-01-07 20:58 . 2010-01-07 21:04 ——– d—–w- c:\program files\MAGIX
2010-01-07 20:58 . 2002-09-21 05:33 1089536 —-a-w- c:\windows\system32\ROBOEX32.DLL
2010-01-07 20:58 . 1998-10-15 22:28 85504 —-a-w- c:\windows\system32\HtmlWH.dll
2010-01-07 20:56 . 2010-01-07 21:05 ——– d—–w- c:\windows\system32\MAGIX
2010-01-07 20:56 . 2007-02-07 16:53 663552 —-a-w- c:\windows\system32\mgxoschk.dll
2010-01-03 16:42 . 2010-01-03 16:49 ——– d—–w- c:\program files\ERUNT
2010-01-03 05:44 . 2010-01-03 05:44 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-03 05:44 . 2009-12-30 20:55 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-03 05:44 . 2010-01-03 05:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-03 05:44 . 2009-12-30 20:54 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-03 05:44 . 2010-01-03 05:44 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-02 20:06 . 2010-01-02 20:06 ——– d—–w- c:\windows\system32\ctfmon.exe
2010-01-01 21:31 . 2010-01-03 06:47 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\ymxfvg
2010-01-01 20:49 . 2010-01-01 20:49 ——– d–h–w- c:\documents and settings\All Users\Application Data\CanonIJEGV
2009-12-19 19:29 . 2009-12-19 19:29 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-12-19 19:28 . 2010-01-04 21:04 ——– d—–w- c:\documents and settings\Owner\Application Data\skypePM
2009-12-19 16:52 . 2008-04-13 19:39 5504 —-a-w- c:\windows\system32\drivers\MSTEE.sys
2009-12-19 16:52 . 2008-04-13 19:39 5504 —-a-w- c:\windows\system32\dllcache\mstee.sys
2009-12-19 16:52 . 2008-04-13 19:46 10880 —-a-w- c:\windows\system32\drivers\NdisIP.sys
2009-12-19 16:52 . 2008-04-13 19:46 10880 —-a-w- c:\windows\system32\dllcache\ndisip.sys
2009-12-19 16:52 . 2008-04-13 19:46 15232 —-a-w- c:\windows\system32\drivers\StreamIP.sys
2009-12-19 16:52 . 2008-04-13 19:46 15232 —-a-w- c:\windows\system32\dllcache\streamip.sys
2009-12-19 16:51 . 2008-04-13 19:46 11136 —-a-w- c:\windows\system32\drivers\SLIP.sys
2009-12-19 16:51 . 2008-04-13 19:46 11136 —-a-w- c:\windows\system32\dllcache\slip.sys
2009-12-19 16:51 . 2008-04-13 19:46 19200 —-a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-12-19 16:51 . 2008-04-13 19:46 19200 —-a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-12-19 16:51 . 2008-04-13 19:46 85248 —-a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-12-19 16:51 . 2008-04-13 19:46 85248 —-a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-12-19 16:51 . 2008-04-13 19:46 17024 —-a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-12-19 16:51 . 2008-04-13 19:46 17024 —-a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-12-19 16:51 . 2008-04-13 19:45 60032 —-a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-12-19 16:51 . 2008-04-13 19:45 60032 —-a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-12-19 16:50 . 2008-04-14 01:12 53760 —-a-w- c:\windows\system32\vfwwdm32.dll
2009-12-19 16:50 . 2008-04-14 01:12 53760 —-a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-12-19 16:19 . 2007-04-10 21:46 111976 —-a-w- c:\windows\VX3000.dll
2009-12-19 16:19 . 2007-04-10 21:46 476520 —-a-w- c:\windows\vVX3000.dll
2009-12-19 16:19 . 2007-04-10 21:46 202088 —-a-w- c:\windows\system32\LCCoin14.dll
2009-12-19 16:19 . 2007-04-10 21:46 185704 —-a-w- c:\windows\system32\cVX3000.dll
2009-12-19 16:19 . 2009-12-19 16:20 ——– dc—-w- c:\windows\system32\DRVSTORE
2009-12-19 16:19 . 2007-04-10 21:46 709992 —-a-w- c:\windows\vVX3000.exe
2009-12-19 16:19 . 2007-04-10 21:46 1966696 —-a-w- c:\windows\system32\drivers\VX3000.sys
2009-12-19 16:18 . 2009-12-19 16:19 ——– d—–w- c:\program files\Microsoft LifeCam
2009-12-15 23:40 . 2009-12-15 23:40 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Temp
2009-12-13 16:40 . 2009-12-13 16:40 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-12-13 16:32 . 2010-01-05 00:50 ——– d—–w- c:\documents and settings\Owner\Application Data\Skype
2009-12-13 16:27 . 2009-12-13 16:27 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-12-13 16:24 . 2009-12-13 16:24 ——– d—–w- c:\program files\Common Files\Skype
2009-12-13 16:24 . 2009-12-13 16:26 ——– d—–r- c:\program files\Skype
2009-12-13 16:24 . 2009-12-13 16:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-05 00:10 . 2008-01-11 05:01 ——– d—–w- c:\documents and settings\Owner\Application Data\AdobeUM
2010-01-05 00:10 . 2001-11-15 15:19 ——– d—–w- c:\program files\Common Files\Adobe
2010-01-04 21:01 . 2004-10-24 01:13 ——– d—–w- c:\program files\AVPersonal
2009-12-13 16:35 . 2008-10-27 15:48 ——– d—–w- c:\program files\Google
2009-12-10 08:07 . 2009-12-10 08:07 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-08 08:07 . 2009-12-08 08:07 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-12-08 08:07 . 2009-12-08 08:07 ——– d—–w- c:\program files\McAfee Security Scan
2009-12-08 07:24 . 2001-11-15 15:21 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-10-29 07:46 . 2004-01-08 20:23 832512 —-a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2001-08-18 05:36 17408 —-a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ——w- c:\windows\system32\drivers\http.sys
.

——- Sigcheck ——-

[7] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe
[7] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-31 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"S3TRAY2"="S3tray2.exe" [2001-10-04 69632]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-06-15 212992]
"PS2"="c:\windows\system32\ps2.exe" [2001-07-03 81920]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"MCUpdateExe"="c:\program files\mcafee.com\Agent\mcupdate.exe" [2001-10-12 122880]
"MCAgentExe"="c:\program files\mcafee.com\Agent\mcagent.exe" [2001-10-12 143360]
"KBD"="c:\hp\KBD\KBD.EXE" [2001-07-06 61440]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2001-08-08 143360]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-09-04 196608]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2001-08-08 90112]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648]
"AVGCtrl"="c:\program files\AVPersonal\AVGNT.EXE" [2004-09-30 127016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk
backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center UI.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp center UI.lnk
backup=c:\windows\pss\hp center UI.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp center.lnk
backup=c:\windows\pss\hp center.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor]
2002-10-07 06:23 90112 —-a-w- c:\program files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2008-12-12 01:31 722256 —-a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2007-05-17 21:45 279912 —-a-w- c:\program files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 21:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QAGENT]
2001-08-01 18:30 94208 —-a-w- c:\program files\QUICKENW\qagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2003-10-20 19:56 77824 —-a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-17 16:42 69632 —-a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 19:11 25623336 —-a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-10-31 14:05 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NBService"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"c:\\Program Files\\hp center\\137903\\Program\\BackWeb-137903.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 11:03 AM 169312]
R2 AVWUpSrv;AntiVir Update;c:\program files\AVPersonal\AVWUPSRV.EXE [10/23/2004 7:13 PM 36864]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\drivers\MrtRate.sys [1/21/2002 12:17 PM 34712]
R3 avgntdd;avgntdd;c:\program files\AVPersonal\AVGNTDD.SYS [10/13/2004 4:14 PM 31984]
S2 gupdate1ca7c112eb5d63c;Google Update Service (gupdate1ca7c112eb5d63c);c:\program files\Google\Update\GoogleUpdate.exe [12/13/2009 10:26 AM 133104]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [1/7/2010 3:04 PM 1527900]
S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [1/7/2010 3:01 PM 544768]
.
Contents of the 'Scheduled Tasks' folder

2010-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-13 16:26]

2010-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-13 16:26]

2002-01-20 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2001-08-18 00:12]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://srch-us4.hpwis.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei;=utf-8&fr;=b1ie7
mSearch Bar = hxxp://srch-us4.hpwis.com/
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = ;localhost
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{17A27031-71FC-11d4-815C-005004D0F1FA} - c:\program files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
TCP: {90B5F1E1-D732-4F56-B43A-04D9902D04B0} = 206.72.56.253,206.72.56.99
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} - hxxp://us-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
HKLM-Run-NWEReboot - (no file)
HKLM-Run-eboglnqo - c:\documents and settings\Owner\Local Settings\Application Data\ymxfvg\vietsysguard.exe
MSConfigStartUp-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
AddRemove-wtwebdriver - c:\windows\wt\updater\wcmdmgr.exe
AddRemove-{419C98C4-D884-4174-B710-CBF3863767DA} - c:\program files\wildtangent\apps\gamechannel.exe \removeitem {419C98C4-D884-4174-B710-CBF3863767DA}
AddRemove-{6E657D86-77B8-4D97-9E31-7D374469D3CB} - c:\program files\wildtangent\apps\gamechannel.exe \removeitem {6E657D86-77B8-4D97-9E31-7D374469D3CB}
AddRemove-{6F0DE0D5-2556-4A64-9892-07BAE121B7EC} - c:\program files\wildtangent\apps\gamechannel.exe \removeitem {6F0DE0D5-2556-4A64-9892-07BAE121B7EC}
AddRemove-{AF0DBCA4-1DBA-4507-89CC-883B25920FFB} - c:\program files\wildtangent\apps\gamechannel.exe \removeitem {AF0DBCA4-1DBA-4507-89CC-883B25920FFB}
AddRemove-{B279B0DA-6F60-4FBD-9847-0C9AB79A3674} - c:\program files\wildtangent\apps\gamechannel.exe \removeitem {B279B0DA-6F60-4FBD-9847-0C9AB79A3674}
AddRemove-{BF225650-36EB-45E8-9666-572A88F31D59} - c:\program files\wildtangent\apps\gamechannel.exe \removeitem {BF225650-36EB-45E8-9666-572A88F31D59}
AddRemove-{D6CAB2F4-26A4-48F4-A35D-CA83063E3928} - c:\program files\wildtangent\apps\gamechannel.exe \removeitem {D6CAB2F4-26A4-48F4-A35D-CA83063E3928}



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-11 21:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-173008773-919082819-4212676017-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Completion time: 2010-01-11 21:17:10
ComboFix-quarantined-files.txt 2010-01-12 03:17

Pre-Run: 6,933,184,512 bytes free
Post-Run: 7,690,698,752 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows Whistler Personal" /fastdetect /NoExecute=OptIn

- - End Of File - - D90D14A455CBDF0032DD7499FAEE14CE



Thanks again for all your help here at WHAT THE TECH!!!
Post #6
Ruger101,

OK. You got a little bit of weirdness going on in there.

Those coupon files carry known adware.

Weirdness #1. That shared file. Usually you have a shared folder. In your case, the file that was removed was a file (without an extension) called shared. Not normal windows file so it was removed.

I don't know what your "friend" had you doing but, ctfmon.exe is a file you need. However, it appears that on January 2nd, you created a folder called ctfmon.exe. It further appears that your actual needed file is gone so we will reinstall it.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    Folder::
c:\windows\system32\ctfmon.exe

FCopy::
c:\windows\ServicePackFiles\i386\ctfmon.exe | c:\windows\system32\ctfmon.exe
c:\windows\ServicePackFiles\i386\ctfmon.exe | c:\windows\system32\dllcache\ctfmon.exe
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.



Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Post #7
Ok, got the combo fix log, but not the Kasperkey, it said I needed Java framework 1.5 or higher, not knowing anything about Java, I'll wait for your instruction as to wether or not to download it. The only concern that I have is twice now since we've done the first combo-fix, my pavillion has failed to boot, it will get stuck at the blue screen that says "HP INVENT". not sure why, has never done this before, The first time was when combo fix had to restart my pc ater scan, the second was after installing some windows updates last night that it said I needed. Wasn't sure if I should do it since we were in the middle of this but thought "its from microsoft what possibly could it hurt" when it does this I have to remove power from the surge strip, as it wont shut off with the power button on the pc. It took 6-7 tries before it booted, and I had read on the web via my laptop to unplug all usb devices and try again, whew, it worked, was nervous about running 2nd combofix as I figured it would restart and get stuck(maybe for good) and I sure don't want to lose this baby.haha but it rebooted fine, but I'm definitly gunshy about shutting it off now. ( I had held down f1 and got it to go in to the system bios but still wouldn't boot from there, then tried the unplugging of the usb thing and it went through, there were no beeps from the pc when it would freeze) Yeah, I know, what a basket case. lol

Let me know what to do about the Kaspersky scan.


ComboFix 10-01-12.04 - Owner 01/12/2010 23:58:02.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.172 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ctfmon.exe
c:\windows\system32\twain_32.dll

.
————— FCopy —————

c:\windows\ServicePackFiles\i386\ctfmon.exe –> c:\windows\system32\ctfmon.exe
c:\windows\ServicePackFiles\i386\ctfmon.exe –> c:\windows\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((( Files Created from 2009-12-13 to 2010-01-13 )))))))))))))))))))))))))))))))
.

2010-01-13 05:58 . 2008-04-14 00:12 15360 —-a-w- c:\windows\system32\dllcache\ctfmon.exe
2010-01-13 05:58 . 2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
2010-01-12 19:40 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2010-01-12 05:22 . 2009-07-28 21:33 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-12 05:22 . 2009-03-30 15:33 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2010-01-12 05:22 . 2009-02-13 17:29 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-01-12 05:22 . 2009-02-13 17:17 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2010-01-12 05:22 . 2010-01-12 05:22 ——– d—–w- c:\program files\Avira
2010-01-12 05:22 . 2010-01-12 05:22 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2010-01-10 04:08 . 2001-08-17 19:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2010-01-10 04:08 . 2001-08-17 19:48 12160 —-a-w- c:\windows\system32\dllcache\mouhid.sys
2010-01-10 04:08 . 2008-04-13 19:45 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2010-01-10 04:08 . 2008-04-13 19:45 10368 —-a-w- c:\windows\system32\dllcache\hidusb.sys
2010-01-07 21:20 . 2010-01-07 21:20 ——– d—–w- c:\documents and settings\Owner\Application Data\MAGIX
2010-01-07 21:05 . 2003-04-18 21:29 44544 —-a-w- c:\windows\system32\msxml4a.dll
2010-01-07 21:04 . 2010-01-07 21:05 ——– d—–w- c:\documents and settings\All Users\Application Data\MAGIX
2010-01-07 21:02 . 2001-05-11 19:18 420240 —-a-w- c:\windows\system32\mpg4c32.dll
2010-01-07 21:00 . 2010-01-07 21:05 ——– d—–w- c:\program files\Common Files\MAGIX Shared
2010-01-07 20:58 . 2010-01-07 21:04 ——– d—–w- c:\program files\MAGIX
2010-01-07 20:58 . 2002-09-21 05:33 1089536 —-a-w- c:\windows\system32\ROBOEX32.DLL
2010-01-07 20:58 . 1998-10-15 22:28 85504 —-a-w- c:\windows\system32\HtmlWH.dll
2010-01-07 20:56 . 2010-01-07 21:05 ——– d—–w- c:\windows\system32\MAGIX
2010-01-07 20:56 . 2007-02-07 16:53 663552 —-a-w- c:\windows\system32\mgxoschk.dll
2010-01-03 16:42 . 2010-01-03 16:49 ——– d—–w- c:\program files\ERUNT
2010-01-03 05:44 . 2010-01-03 05:44 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-03 05:44 . 2009-12-30 20:55 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-03 05:44 . 2010-01-03 05:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-03 05:44 . 2009-12-30 20:54 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-03 05:44 . 2010-01-03 05:44 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-01 21:31 . 2010-01-03 06:47 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\ymxfvg
2010-01-01 20:49 . 2010-01-01 20:49 ——– d–h–w- c:\documents and settings\All Users\Application Data\CanonIJEGV
2009-12-19 19:29 . 2009-12-19 19:29 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-12-19 19:28 . 2010-01-04 21:04 ——– d—–w- c:\documents and settings\Owner\Application Data\skypePM
2009-12-19 16:52 . 2008-04-13 19:39 5504 —-a-w- c:\windows\system32\drivers\MSTEE.sys
2009-12-19 16:52 . 2008-04-13 19:39 5504 —-a-w- c:\windows\system32\dllcache\mstee.sys
2009-12-19 16:52 . 2008-04-13 19:46 10880 —-a-w- c:\windows\system32\drivers\NdisIP.sys
2009-12-19 16:52 . 2008-04-13 19:46 10880 —-a-w- c:\windows\system32\dllcache\ndisip.sys
2009-12-19 16:52 . 2008-04-13 19:46 15232 —-a-w- c:\windows\system32\drivers\StreamIP.sys
2009-12-19 16:52 . 2008-04-13 19:46 15232 —-a-w- c:\windows\system32\dllcache\streamip.sys
2009-12-19 16:51 . 2008-04-13 19:46 11136 —-a-w- c:\windows\system32\drivers\SLIP.sys
2009-12-19 16:51 . 2008-04-13 19:46 11136 —-a-w- c:\windows\system32\dllcache\slip.sys
2009-12-19 16:51 . 2008-04-13 19:46 19200 —-a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-12-19 16:51 . 2008-04-13 19:46 19200 —-a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-12-19 16:51 . 2008-04-13 19:46 85248 —-a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-12-19 16:51 . 2008-04-13 19:46 85248 —-a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-12-19 16:51 . 2008-04-13 19:46 17024 —-a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-12-19 16:51 . 2008-04-13 19:46 17024 —-a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-12-19 16:51 . 2008-04-13 19:45 60032 —-a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-12-19 16:51 . 2008-04-13 19:45 60032 —-a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-12-19 16:50 . 2008-04-14 01:12 53760 —-a-w- c:\windows\system32\vfwwdm32.dll
2009-12-19 16:50 . 2008-04-14 01:12 53760 —-a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-12-19 16:19 . 2007-04-10 21:46 111976 —-a-w- c:\windows\VX3000.dll
2009-12-19 16:19 . 2007-04-10 21:46 476520 —-a-w- c:\windows\vVX3000.dll
2009-12-19 16:19 . 2007-04-10 21:46 202088 —-a-w- c:\windows\system32\LCCoin14.dll
2009-12-19 16:19 . 2007-04-10 21:46 185704 —-a-w- c:\windows\system32\cVX3000.dll
2009-12-19 16:19 . 2009-12-19 16:20 ——– dc—-w- c:\windows\system32\DRVSTORE
2009-12-19 16:19 . 2007-04-10 21:46 709992 —-a-w- c:\windows\vVX3000.exe
2009-12-19 16:19 . 2007-04-10 21:46 1966696 —-a-w- c:\windows\system32\drivers\VX3000.sys
2009-12-19 16:18 . 2009-12-19 16:19 ——– d—–w- c:\program files\Microsoft LifeCam
2009-12-15 23:40 . 2009-12-15 23:40 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-12 06:39 . 2005-12-20 03:27 ——– d—–w- c:\program files\John Deere American Farmer
2010-01-12 05:04 . 2002-01-21 18:16 ——– d—–w- c:\program files\QUICKENW
2010-01-05 00:50 . 2009-12-13 16:32 ——– d—–w- c:\documents and settings\Owner\Application Data\Skype
2010-01-05 00:10 . 2008-01-11 05:01 ——– d—–w- c:\documents and settings\Owner\Application Data\AdobeUM
2010-01-05 00:10 . 2001-11-15 15:19 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-13 16:35 . 2008-10-27 15:48 ——– d—–w- c:\program files\Google
2009-12-13 16:26 . 2009-12-13 16:24 ——– d—–r- c:\program files\Skype
2009-12-13 16:24 . 2009-12-13 16:24 ——– d—–w- c:\program files\Common Files\Skype
2009-12-13 16:24 . 2009-12-13 16:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-12-10 08:07 . 2009-12-10 08:07 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-08 08:07 . 2009-12-08 08:07 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-12-08 08:07 . 2009-12-08 08:07 ——– d—–w- c:\program files\McAfee Security Scan
2009-12-08 07:24 . 2001-11-15 15:21 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-11-21 15:51 . 2002-03-25 19:01 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-10-29 07:46 . 2004-01-08 20:23 832512 ——w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2001-08-18 05:36 17408 —-a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ——w- c:\windows\system32\drivers\http.sys
2009-10-15 16:28 . 2001-08-18 05:36 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-10-15 16:28 . 2001-08-18 05:36 81920 —-a-w- c:\windows\system32\fontsub.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-31 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"S3TRAY2"="S3tray2.exe" [2001-10-04 69632]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-06-15 212992]
"PS2"="c:\windows\system32\ps2.exe" [2001-07-03 81920]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"MCUpdateExe"="c:\program files\mcafee.com\Agent\mcupdate.exe" [2001-10-12 122880]
"MCAgentExe"="c:\program files\mcafee.com\Agent\mcagent.exe" [2001-10-12 143360]
"KBD"="c:\hp\KBD\KBD.EXE" [2001-07-06 61440]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2001-08-08 143360]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-09-04 196608]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2001-08-08 90112]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk
backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center UI.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp center UI.lnk
backup=c:\windows\pss\hp center UI.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp center.lnk
backup=c:\windows\pss\hp center.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor]
2002-10-07 06:23 90112 —-a-w- c:\program files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2008-12-12 01:31 722256 —-a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2007-05-17 21:45 279912 —-a-w- c:\program files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 21:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2003-10-20 19:56 77824 —-a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-17 16:42 69632 —-a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 19:11 25623336 —-a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-10-31 14:05 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NBService"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"c:\\Program Files\\hp center\\137903\\Program\\BackWeb-137903.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 11:03 AM 169312]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/11/2010 11:22 PM 108289]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\drivers\MrtRate.sys [1/21/2002 12:17 PM 34712]
S2 gupdate1ca7c112eb5d63c;Google Update Service (gupdate1ca7c112eb5d63c);c:\program files\Google\Update\GoogleUpdate.exe [12/13/2009 10:26 AM 133104]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [1/7/2010 3:04 PM 1527900]
S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [1/7/2010 3:01 PM 544768]
.
Contents of the 'Scheduled Tasks' folder

2010-01-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-13 16:26]

2010-01-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-13 16:26]

2002-01-20 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2001-08-18 00:12]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://srch-us4.hpwis.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://srch-us4.hpwis.com/
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = ;localhost
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{17A27031-71FC-11d4-815C-005004D0F1FA} - c:\program files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
TCP: {90B5F1E1-D732-4F56-B43A-04D9902D04B0} = 206.72.56.253,206.72.56.99
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} - hxxp://us-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-QAGENT - c:\program files\QUICKENW\QAGENT.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-13 00:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-173008773-919082819-4212676017-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3988)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\ScsiAccess.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Avira\AntiVir Desktop\GUARDGUI.EXE
.
**************************************************************************
.
Completion time: 2010-01-13 00:21:27 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-13 06:21
ComboFix2.txt 2010-01-12 03:17

Pre-Run: 7,467,606,016 bytes free
Post-Run: 7,427,907,584 bytes free

- - End Of File - - 8D9C70B5A788BE5C90D6389DD2B6BBE9


Thanks again!!!!
Post #8
Ruger101,

Let's run this program instead of Kaspersky.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Post #9
Hello again, I've run the ESET online scanner, log is below. Thanks again for all your help, things are getting closer to normal on this computer! My Local Area 2 Connection, system tray Icon has reappeared, Its been missing for about 2 years, But at some point in all this troubleshooting it has reappeared, I'll bet I can set up my home network again if I try, have not been able to access this computer from our laptop(via the router) for as long as that icon has been missing, believe a virus got me back then too. Your help is truely appreciated!!! C:\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe Win32/Agent.NVP trojan C:\Documents and Settings\Owner\Local Settings\Application Data\Identities\{5692575C-2549-44B4-816F-D2676C27C45B}\Microsoft\Outlook Express\Sent Items.dbx HTML/Phishing.gen trojan C:\hp\bin\AUTOPLAY.EXE Win32/Agent.NVP trojan
Post #10
Ruger101,

You have a contaminated email in your sent items folder of Outlook Express. (Which means you have passed the infected email to someone else :wacko: ). Unfortunately I cannot tell which one or ones it is. What I need you to do is go through all of your email in your in box, sent box, and any other saved boxes you may have. Please delete any that you don't want/need/recognize. Odds are that the infected email will have an attachment or at least a link. Therefore, do not open any attachments or click on any links. Once you've been through all of the emails, please empty your deleted email box.

I'm not convinced that the other file found isn't a false positive. We need to check it out more thoroughly.

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\hp\bin\AUTOPLAY.EXE<===this file

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
Post #11
Jotti's malware scan Filename: AUTOPLAY.EXE Status: Scan finished. 7 out of 20 scanners reported malware. Scan taken on: Sat 16 Jan 2010 02:30:53 (CET) Permalink ——————————————————————————– Additional info File size: 36864 bytes Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5: cba42f5e4fefdc19295def916586bbda SHA1: e6aecab8323d9107e00f3876c06dad22d046177d Scanners 2010-01-15 Found nothing 2010-01-15 Found nothing 2010-01-16 Virus.Win32.Trojan!IK 2010-01-15 Trojan.Generic.1869566 2010-01-15 Found nothing 2010-01-15 Virus.Win32.Trojan 2010-01-15 Found nothing 2010-01-16 Found nothing 2010-01-15 Found nothing 2010-01-15 Win32/Agent.NVP 2010-01-15 Trojan.Generic.1869566 2010-01-15 Trj/Agent.MZR 2010-01-15 Found nothing 2010-01-15 Found nothing 2010-01-16 Found nothing 2010-01-16 Found nothing 2010-01-15 Found nothing 2010-01-15 Win32.Agent.NVP 2010-01-15 Found nothing 2010-01-15 Found nothing ——————————————————————————– For some reason can't get all the page to copy and paste, let me know if I need to do somthing different. Working on the email thing - like 1700 sent things to sort through. lol
Post #12
Ruger101,

You did fine. I think that's enough data to say that the file is hinky.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe
C:\hp\bin\AUTOPLAY.EXE
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #13
Here's the combofix log, Hope were gaining!!

ComboFix 10-01-15.05 - Owner 01/16/2010 9:28.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.181 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\documents and settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe"
"c:\hp\bin\AUTOPLAY.EXE"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe
c:\hp\bin\AUTOPLAY.EXE

.
((((((((((((((((((((((((( Files Created from 2009-12-16 to 2010-01-16 )))))))))))))))))))))))))))))))
.

2010-01-15 04:03 . 2010-01-15 04:03 ——– d—–w- c:\program files\ESET
2010-01-13 05:58 . 2008-04-14 00:12 15360 —-a-w- c:\windows\system32\dllcache\ctfmon.exe
2010-01-13 05:58 . 2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe
2010-01-12 19:40 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2010-01-12 05:22 . 2010-01-14 05:32 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-12 05:22 . 2009-03-30 15:33 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2010-01-12 05:22 . 2009-02-13 17:29 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-01-12 05:22 . 2009-02-13 17:17 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2010-01-12 05:22 . 2010-01-12 05:22 ——– d—–w- c:\program files\Avira
2010-01-12 05:22 . 2010-01-12 05:22 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2010-01-10 04:08 . 2001-08-17 19:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2010-01-10 04:08 . 2001-08-17 19:48 12160 —-a-w- c:\windows\system32\dllcache\mouhid.sys
2010-01-10 04:08 . 2008-04-13 19:45 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2010-01-10 04:08 . 2008-04-13 19:45 10368 —-a-w- c:\windows\system32\dllcache\hidusb.sys
2010-01-07 21:20 . 2010-01-07 21:20 ——– d—–w- c:\documents and settings\Owner\Application Data\MAGIX
2010-01-07 21:05 . 2003-04-18 21:29 44544 —-a-w- c:\windows\system32\msxml4a.dll
2010-01-07 21:04 . 2010-01-07 21:05 ——– d—–w- c:\documents and settings\All Users\Application Data\MAGIX
2010-01-07 21:02 . 2001-05-11 19:18 420240 —-a-w- c:\windows\system32\mpg4c32.dll
2010-01-07 21:00 . 2010-01-07 21:05 ——– d—–w- c:\program files\Common Files\MAGIX Shared
2010-01-07 20:58 . 2010-01-07 21:04 ——– d—–w- c:\program files\MAGIX
2010-01-07 20:58 . 2002-09-21 05:33 1089536 —-a-w- c:\windows\system32\ROBOEX32.DLL
2010-01-07 20:58 . 1998-10-15 22:28 85504 —-a-w- c:\windows\system32\HtmlWH.dll
2010-01-07 20:56 . 2010-01-07 21:05 ——– d—–w- c:\windows\system32\MAGIX
2010-01-07 20:56 . 2007-02-07 16:53 663552 —-a-w- c:\windows\system32\mgxoschk.dll
2010-01-03 16:42 . 2010-01-03 16:49 ——– d—–w- c:\program files\ERUNT
2010-01-03 05:44 . 2010-01-03 05:44 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-03 05:44 . 2009-12-30 20:55 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-03 05:44 . 2010-01-03 05:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-03 05:44 . 2009-12-30 20:54 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-03 05:44 . 2010-01-03 05:44 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-01 21:31 . 2010-01-03 06:47 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\ymxfvg
2010-01-01 20:49 . 2010-01-01 20:49 ——– d–h–w- c:\documents and settings\All Users\Application Data\CanonIJEGV
2009-12-19 19:29 . 2009-12-19 19:29 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-12-19 19:28 . 2010-01-04 21:04 ——– d—–w- c:\documents and settings\Owner\Application Data\skypePM
2009-12-19 16:52 . 2008-04-13 19:39 5504 —-a-w- c:\windows\system32\drivers\MSTEE.sys
2009-12-19 16:52 . 2008-04-13 19:39 5504 —-a-w- c:\windows\system32\dllcache\mstee.sys
2009-12-19 16:52 . 2008-04-13 19:46 10880 —-a-w- c:\windows\system32\drivers\NdisIP.sys
2009-12-19 16:52 . 2008-04-13 19:46 10880 —-a-w- c:\windows\system32\dllcache\ndisip.sys
2009-12-19 16:52 . 2008-04-13 19:46 15232 —-a-w- c:\windows\system32\drivers\StreamIP.sys
2009-12-19 16:52 . 2008-04-13 19:46 15232 —-a-w- c:\windows\system32\dllcache\streamip.sys
2009-12-19 16:51 . 2008-04-13 19:46 11136 —-a-w- c:\windows\system32\drivers\SLIP.sys
2009-12-19 16:51 . 2008-04-13 19:46 11136 —-a-w- c:\windows\system32\dllcache\slip.sys
2009-12-19 16:51 . 2008-04-13 19:46 19200 —-a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-12-19 16:51 . 2008-04-13 19:46 19200 —-a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-12-19 16:51 . 2008-04-13 19:46 85248 —-a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-12-19 16:51 . 2008-04-13 19:46 85248 —-a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-12-19 16:51 . 2008-04-13 19:46 17024 —-a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-12-19 16:51 . 2008-04-13 19:46 17024 —-a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-12-19 16:51 . 2008-04-13 19:45 60032 —-a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-12-19 16:51 . 2008-04-13 19:45 60032 —-a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-12-19 16:50 . 2008-04-14 01:12 53760 —-a-w- c:\windows\system32\vfwwdm32.dll
2009-12-19 16:50 . 2008-04-14 01:12 53760 —-a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-12-19 16:19 . 2007-04-10 21:46 111976 —-a-w- c:\windows\VX3000.dll
2009-12-19 16:19 . 2007-04-10 21:46 476520 —-a-w- c:\windows\vVX3000.dll
2009-12-19 16:19 . 2007-04-10 21:46 202088 —-a-w- c:\windows\system32\LCCoin14.dll
2009-12-19 16:19 . 2007-04-10 21:46 185704 —-a-w- c:\windows\system32\cVX3000.dll
2009-12-19 16:19 . 2009-12-19 16:20 ——– dc—-w- c:\windows\system32\DRVSTORE
2009-12-19 16:19 . 2007-04-10 21:46 709992 —-a-w- c:\windows\vVX3000.exe
2009-12-19 16:19 . 2007-04-10 21:46 1966696 —-a-w- c:\windows\system32\drivers\VX3000.sys
2009-12-19 16:18 . 2009-12-19 16:19 ——– d—–w- c:\program files\Microsoft LifeCam

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-13 06:26 . 2001-11-15 15:21 ——– dc—-w- c:\program files\HPSelect
2010-01-12 06:39 . 2005-12-20 03:27 ——– d—–w- c:\program files\John Deere American Farmer
2010-01-12 05:04 . 2002-01-21 18:16 ——– d—–w- c:\program files\QUICKENW
2010-01-05 00:50 . 2009-12-13 16:32 ——– d—–w- c:\documents and settings\Owner\Application Data\Skype
2010-01-05 00:10 . 2008-01-11 05:01 ——– d—–w- c:\documents and settings\Owner\Application Data\AdobeUM
2010-01-05 00:10 . 2001-11-15 15:19 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-13 16:35 . 2008-10-27 15:48 ——– d—–w- c:\program files\Google
2009-12-13 16:26 . 2009-12-13 16:24 ——– d—–r- c:\program files\Skype
2009-12-13 16:24 . 2009-12-13 16:24 ——– d—–w- c:\program files\Common Files\Skype
2009-12-13 16:24 . 2009-12-13 16:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2009-12-10 08:07 . 2009-12-10 08:07 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-12-08 08:07 . 2009-12-08 08:07 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-12-08 08:07 . 2009-12-08 08:07 ——– d—–w- c:\program files\McAfee Security Scan
2009-12-08 07:24 . 2001-11-15 15:21 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-11-21 15:51 . 2002-03-25 19:01 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-10-29 07:46 . 2004-01-08 20:23 832512 ——w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2001-08-18 05:36 17408 —-a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ——w- c:\windows\system32\drivers\http.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-01-12_03.12.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 08:19 . 2007-11-07 08:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 62976 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 46080 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 46592 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 64512 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 66048 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 56832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 66560 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 39936 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 38912 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
+ 2008-07-29 12:07 . 2008-07-29 12:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
+ 2008-07-29 12:07 . 2008-07-29 12:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
+ 2010-01-13 06:10 . 2010-01-13 06:10 16384 c:\windows\Temp\Perflib_Perfdata_558.dat
+ 2010-01-13 04:30 . 2009-05-26 11:40 17272 c:\windows\SYSTEM32\spmsg.dll
- 2001-08-18 05:36 . 2009-06-16 14:36 81920 c:\windows\SYSTEM32\fontsub.dll
+ 2001-08-18 05:36 . 2009-10-15 16:28 81920 c:\windows\SYSTEM32\fontsub.dll
+ 2010-01-12 05:22 . 2009-05-11 15:12 28520 c:\windows\SYSTEM32\drivers\ssmdrv.sys
+ 2009-06-16 14:36 . 2009-10-15 16:28 81920 c:\windows\SYSTEM32\dllcache\fontsub.dll
- 2009-06-16 14:36 . 2009-06-16 14:36 81920 c:\windows\SYSTEM32\dllcache\fontsub.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 572928 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
+ 2008-07-29 09:54 . 2008-07-29 09:54 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 161784 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
- 2001-08-18 05:36 . 2009-06-16 14:36 119808 c:\windows\SYSTEM32\t2embed.dll
+ 2001-08-18 05:36 . 2009-10-15 16:28 119808 c:\windows\SYSTEM32\t2embed.dll
+ 2009-06-16 14:36 . 2009-10-15 16:28 119808 c:\windows\SYSTEM32\dllcache\t2embed.dll
- 2009-06-16 14:36 . 2009-06-16 14:36 119808 c:\windows\SYSTEM32\dllcache\t2embed.dll
+ 2010-01-12 05:19 . 2010-01-12 05:19 228352 c:\windows\Installer\2ca9d.msi
+ 2008-07-29 14:05 . 2008-07-29 14:05 3783672 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
+ 2008-07-29 14:05 . 2008-07-29 14:05 3768312 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
+ 2005-05-11 13:26 . 2010-01-05 00:17 29634504 c:\windows\SYSTEM32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-31 68856]
"Microsoft Works Update Detection"="c:\program files\Microsoft Works\WkDetect.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"S3TRAY2"="S3tray2.exe" [2001-10-04 69632]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-06-15 212992]
"PS2"="c:\windows\system32\ps2.exe" [2001-07-03 81920]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"MCUpdateExe"="c:\program files\mcafee.com\Agent\mcupdate.exe" [2001-10-12 122880]
"MCAgentExe"="c:\program files\mcafee.com\Agent\mcagent.exe" [2001-10-12 143360]
"KBD"="c:\hp\KBD\KBD.EXE" [2001-07-06 61440]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2001-08-08 143360]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-09-04 196608]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2001-08-08 90112]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-27 199184]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk
backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center UI.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp center UI.lnk
backup=c:\windows\pss\hp center UI.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp center.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp center.lnk
backup=c:\windows\pss\hp center.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor]
2002-10-07 06:23 90112 —-a-w- c:\program files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2008-12-12 01:31 722256 —-a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2007-05-17 21:45 279912 —-a-w- c:\program files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 21:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2003-10-20 19:56 77824 —-a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-17 16:42 69632 —-a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 19:11 25623336 —-a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-10-31 14:05 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NBService"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"c:\\Program Files\\hp center\\137903\\Program\\BackWeb-137903.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 11:03 AM 169312]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/11/2010 11:22 PM 108289]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\drivers\MrtRate.sys [1/21/2002 12:17 PM 34712]
S2 gupdate1ca7c112eb5d63c;Google Update Service (gupdate1ca7c112eb5d63c);c:\program files\Google\Update\GoogleUpdate.exe [12/13/2009 10:26 AM 133104]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [1/7/2010 3:04 PM 1527900]
S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [1/7/2010 3:01 PM 544768]
.
Contents of the 'Scheduled Tasks' folder

2010-01-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-13 16:26]

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-13 16:26]

2002-01-20 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2001-08-18 00:12]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://srch-us4.hpwis.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://srch-us4.hpwis.com/
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = ;localhost
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{17A27031-71FC-11d4-815C-005004D0F1FA} - c:\program files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
TCP: {90B5F1E1-D732-4F56-B43A-04D9902D04B0} = 206.72.56.253,206.72.56.99
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} - hxxp://us-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-16 09:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-173008773-919082819-4212676017-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Completion time: 2010-01-16 09:43:52
ComboFix-quarantined-files.txt 2010-01-16 15:43
ComboFix2.txt 2010-01-13 06:21
ComboFix3.txt 2010-01-12 03:17

Pre-Run: 7,332,139,008 bytes free
Post-Run: 7,291,232,256 bytes free

- - End Of File - - 504C8289FF8982793438E50FBC64E5B8


Thanks again.
Post #15
Things seem to be great, I havn't noticed any problems. I'm a little concerened about it getting stuck at the hp invent screen, but other than that is seems fast, and more like it used to be when we got it. :yeah: THANKYOU, THANKYOU, THANKYOU. :notworthy: Its nice that some people (like yourself) will use your free time and expertise to undo what some SOB used his free time and "expertise" to mangle up. I have learned alot this last week, maybe now I won't be so helpless if it happens again. Even just reading other posts in these forums has shed light on how and what to look for. Let me know if I should do anything else, I updated my antivirus,(perhaps that is why this happened in the first place) it was v.6 updated to v.9. only 2 years out of date, :smack: Thanks again for all your help. You are truely appreciated!!!!! Jeff

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI