What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] [Closed] laptop was ravaged by viruses...

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
well, as with most people looking for help on here, my computer has been ravaged by viruses. and not in a good way! this laptop is several years old now, but used to run very well. after being infected, almost all general functions have slowed to a trickle. i was able to get rid of most issues on my own by individually downloading and running every decent virus scanner known to man, but the poor thing seems to be running more like a vintage 486dx2 than a modern day laptop! thanks so much for any and all help. so i'm not sure if there are more virus related problems, or if maybe its just registry issues caused by the infections?

i read thru the "what to do if you are infected" topic, performing all the preliminary tasks requested - except running SystemRestorePoint. every time i tried to run the program, it "encountered a problem and was forced to close."

here are the requested logs:


MBAM -

Malwarebytes' Anti-Malware 1.44
Database version: 3540
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

1/11/2010 2:01:26 PM
mbam-log-2010-01-11 (14-01-26).txt

Scan type: Full Scan (C:\|)
Objects scanned: 202832
Time elapsed: 1 hour(s), 10 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


DDS.txt


DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 16:36:46.75 on Sun 01/10/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.212 [GMT -5:00]

AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\EZSP_PX.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\Documents and Settings\Bitten\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.toshiba.com/
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: {1DA54180-443D-4680-BF07-2D7E4D2B713C} - No File
BHO: {247A1DB9-DAF7-4F5B-BAC3-750B20E696D5} - No File
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\bitten\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\NPSWF32_FlashUtil.exe -p
mRun: [00THotkey] c:\windows\system32\00THotkey.exe
mRun: [000StTHK] 000StTHK.exe
mRun: [PmProxy] c:\program files\analog devices\soundmax\PmProxy.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
mRun: [Tpwrtray] TPWRTRAY.EXE
mRun: [TouchED] c:\program files\toshiba\touched\TouchED.Exe
mRun: [TFNF5] TFNF5.exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [ezShieldProtector for Px] c:\windows\system32\EZSP_PX.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [3170 Scan2PC] "c:\windows\twain_32\samsung\clx3170\Scan2pc.exe"
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1208719407125
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177041749379
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177041738043
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?39191.7537384259
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
LSA: Authentication Packages = msv1_0 c:\windows\system32\hgGyawTl
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\bitten\applic~1\mozilla\firefox\profiles\gtbanp75.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\bitten\application data\mozilla\firefox\profiles\gtbanp75.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\bitten\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\bitten\local settings\application data\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 ALiAGP;ALi AGP Bus Filter Driver;c:\windows\system32\drivers\ALiAGP.SYS [2003-5-6 26880]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-11-1 207280]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968]
R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\aliirda.sys [2003-5-6 26112]
R3 tridxp;tridxp;c:\windows\system32\drivers\tridxpm.sys [2003-4-24 248448]
S1 SASDIFSV;SASDIFSV;\??\e:\sas\sasdifsv.sys –> e:\sas\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\sas\saskutil.sys –> e:\sas\SASKUTIL.sys [?]
S2 gupdate1c9fac07a8f59d0;Google Update Service (gupdate1c9fac07a8f59d0);c:\program files\google\update\GoogleUpdate.exe [2009-7-1 133104]
S2 mrtRate;mrtRate; [x]
S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys –> c:\windows\system32\drivers\SSPORT.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-11-4 38224]
S3 SASENUM;SASENUM;\??\e:\sas\sasenum.sys –> e:\sas\SASENUM.SYS [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-11-1 358600]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-11-1 1141200]
S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [2003-5-6 156672]
S4 Tsdessutaf;Tsdessutaf; [x]

=============== Created Last 30 ================


==================== Find3M ====================

2009-11-01 17:31:45 56316 —-a-w- C:\BdUninstallTool2009.11.01-12.27.00.reg
2009-11-01 17:26:59 81984 —-a-w- c:\windows\system32\bdod.bin
2009-10-29 07:46:59 832512 —-a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46:52 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46:50 17408 ——w- c:\windows\system32\corpol.dll
2009-10-21 05:38:36 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38:36 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-13 10:30:16 270336 —-a-w- c:\windows\system32\oakley.dll
2009-02-21 07:17:07 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009022120090222\index.dat

============= FINISH: 16:38:09.94 ===============



ATTACH.txt


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/19/2007 11:52:21 PM
System Uptime: 1/10/2010 2:52:38 PM (2 hours ago)

Motherboard: TOSHIBA | | Portable PC
Processor: Intel® Pentium® 4 CPU 3.06GHz | uFC-PGA Socket | 3055/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 56 GiB total, 12.59 GiB free.
D: is CDROM (CDFS)
F: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP381: 10/7/2009 12:09:06 AM - Software Distribution Service 3.0
RP382: 10/8/2009 11:06:15 AM - Software Distribution Service 3.0
RP383: 10/9/2009 8:00:28 AM - Software Distribution Service 3.0
RP384: 10/10/2009 9:31:34 AM - Software Distribution Service 3.0
RP385: 10/11/2009 1:50:41 PM - Software Distribution Service 3.0
RP386: 10/12/2009 12:26:33 PM - Software Distribution Service 3.0
RP387: 10/13/2009 6:42:48 PM - Software Distribution Service 3.0
RP388: 10/15/2009 3:55:09 AM - System Checkpoint
RP389: 10/15/2009 1:16:06 PM - Software Distribution Service 3.0
RP390: 10/16/2009 1:36:00 PM - System Checkpoint
RP391: 10/19/2009 6:43:44 PM - System Checkpoint
RP392: 10/22/2009 1:22:21 AM - System Checkpoint
RP393: 10/22/2009 2:13:17 PM - Software Distribution Service 3.0
RP394: 10/24/2009 4:02:27 AM - Software Distribution Service 3.0
RP395: 10/24/2009 8:00:43 AM - Software Distribution Service 3.0
RP396: 10/26/2009 2:21:17 PM - Software Distribution Service 3.0
RP397: 10/26/2009 9:49:27 PM - Printer Driver Samsung CLX-3170 Series Installed
RP398: 10/28/2009 2:15:29 PM - System Checkpoint
RP399: 10/29/2009 8:00:48 AM - Software Distribution Service 3.0
RP400: 10/30/2009 1:01:58 PM - Software Distribution Service 3.0
RP401: 10/31/2009 11:34:12 AM - Software Distribution Service 3.0
RP402: 11/1/2009 2:21:06 PM - Removed BitDefender Free Edition v10
RP403: 11/1/2009 3:14:40 PM - Removed SUPERAntiSpyware Free Edition
RP404: 11/2/2009 9:07:30 AM - Software Distribution Service 3.0
RP405: 11/3/2009 1:20:00 AM - Software Distribution Service 3.0
RP406: 11/4/2009 1:59:37 AM - Installed SUPERAntiSpyware Free Edition
RP407: 11/4/2009 9:05:22 AM - Software Distribution Service 3.0
RP408: 11/7/2009 1:26:40 AM - System Checkpoint
RP409: 11/7/2009 12:13:01 PM - Software Distribution Service 3.0
RP410: 11/8/2009 2:07:19 PM - Software Distribution Service 3.0
RP411: 11/10/2009 6:57:53 AM - Software Distribution Service 3.0
RP412: 11/10/2009 6:13:45 PM - Unsigned printer driver Samsung CLX-3170 Series installed.
RP413: 11/11/2009 7:34:49 PM - System Checkpoint
RP414: 11/13/2009 12:37:38 AM - System Checkpoint
RP415: 11/17/2009 8:39:55 PM - Software Distribution Service 3.0
RP416: 11/18/2009 10:25:13 PM - Software Distribution Service 3.0
RP417: 11/18/2009 11:52:16 PM - Software Distribution Service 3.0
RP418: 11/21/2009 5:39:19 PM - System Checkpoint
RP419: 11/27/2009 8:11:49 PM - Software Distribution Service 3.0
RP420: 12/1/2009 3:04:44 PM - Software Distribution Service 3.0
RP421: 12/5/2009 11:49:48 AM - System Checkpoint
RP422: 12/6/2009 2:31:19 PM - Software Distribution Service 3.0
RP423: 12/6/2009 8:06:42 PM - Software Distribution Service 3.0
RP424: 12/8/2009 1:34:47 PM - System Checkpoint
RP425: 12/10/2009 12:30:59 AM - System Checkpoint
RP426: 12/10/2009 8:54:01 AM - Software Distribution Service 3.0
RP427: 1/10/2010 3:55:18 PM - System Checkpoint

==== Installed Programs ======================

µTorrent
7-Zip 4.65
AAC Decoder
AC3Filter (remove only)
Adobe Acrobat 5.0
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Photoshop CS
Advanced System Optimizer
Advanced Uninstaller PRO - Version 9
AIM 6
ALi AGP Driver 2.00
Alps Pointing-device Driver
Apple Software Update
Atheros Client Utility
AutoCAD 2007 - English
Autodesk DWF Viewer
AutoUpdate
BitDefender Free Edition v10
BitTorrent
Choice Guard
Coupon Printer for Windows
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DNA
Drag'n Drop CD+DVD
DVD-RAM Driver
FileZilla Client [removed]
Google Earth
Google Talk Plugin
Google Update Helper
Google Updater
H.264 Decoder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
hp instant support
hp officejet g series
InterVideo WinDVD 4
Java™ 6 Update 15
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 7
Java™ SE Runtime Environment 6 Update 1
LimeWire 4.12.11
Macromedia Flash Player 8
Malwarebytes' Anti-Malware
Managed DirectX (0900)
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works 7.0
MKV Splitter
Mozilla Firefox (3.5.5)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Notebook Maximizer
Picasa 3
PokerStars
PokerStove version 1.21
PurePlay Poker
Quicken 2003 New User Edition
QuickTime
Samsung CLX-3170 Series
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
Skype™ 3.8
Software Suite
SoundMAX
Spybot - Search & Destroy
Spyware Doctor 7.0
SUPERAntiSpyware Free Edition
TOSHIBA Access
TOSHIBA ConfigFree
TOSHIBA Console
TOSHIBA Controls
Toshiba Hotkey Utility for Display Devices
TOSHIBA Power Saver
Toshiba Registration
TOSHIBA Software Modem
TOSHIBA Software Upgrades
Toshiba Tbiosdrv Driver
TOSHIBA TouchPad On/Off Utility V2.05.00
TOSHIBA Utilities
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office InfoPath 2007 (KB976416)
Update for Outlook 2007 Junk Email Filter (kb976884)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC_MergeModuleToMSI
VC80CRTRedist - 8.0.50727.762
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 7
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

1/10/2010 2:56:53 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
1/10/2010 2:54:08 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SASDIFSV SASKUTIL
1/10/2010 2:53:57 PM, error: Service Control Manager [7000] - The SSPORT service failed to start due to the following error: The system cannot find the file specified.
1/10/2010 2:53:57 PM, error: Service Control Manager [7000] - The mrtRate service failed to start due to the following error: The system cannot find the file specified.
1/10/2010 2:53:57 PM, error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the file specified.

==== End Of File ===========================



GMER.txt

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-10 22:51:45
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Bitten\LOCALS~1\Temp\pwrdipow.sys


—- System - GMER 1.0.15 —-

SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xF75FAE22]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF75DBCDC]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF75DBECE]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xF75FB610]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xF75FB8C4]
SSDT spgb.sys ZwEnumerateKey [0xF7706CA2]
SSDT spgb.sys ZwEnumerateValueKey [0xF7707030]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xF75F9B14]
SSDT spgb.sys ZwQueryKey [0xF7707108]
SSDT spgb.sys ZwQueryValueKey [0xF7706F88]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF75FBD30]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xF75FB0E2]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xF75DB982]

INT 0x3B ? 85131BF8
INT 0x3B ? 85131BF8
INT 0x3B ? 85131BF8
INT 0x3E ? 8538BBF8
INT 0x3F ? 8538BBF8

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 853891F8
Device \FileSystem\Udfs \UdfsCdRom 84B891F8
Device \FileSystem\Udfs \UdfsDisk 84B891F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{8DAC7BE3-B2A6-42CC-B1E1-217E30582B26} 84B461F8
Device \Driver\sptd \Device\2331406080 spgb.sys
Device \Driver\usbohci \Device\USBPDO-0 850871F8
Device \Driver\usbohci \Device\USBPDO-1 850871F8
Device \Driver\usbehci \Device\USBPDO-2 851251F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8538C1F8
Device \Driver\Cdrom \Device\CdRom0 8516D1F8
Device \Driver\Cdrom \Device\CdRom1 8516D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F7624B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 [F7624B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [F7624B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [F7624B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\NetBT \Device\NetBT_Tcpip_{D9363D48-B620-476A-ACCD-BC8267FACB4C} 84B461F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 84B461F8
Device \Driver\NetBT \Device\NetbiosSmb 84B461F8
Device \Driver\PCI_PNP5072 \Device\0000004c spgb.sys
Device \Driver\PCI_PNP5072 \Device\0000004c spgb.sys
Device \Driver\usbohci \Device\USBFDO-0 850871F8
Device \Driver\usbohci \Device\USBFDO-1 850871F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 84B381F8
Device \Driver\usbehci \Device\USBFDO-2 851251F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 84B381F8
Device \Driver\Ftdisk \Device\FtControl 8538C1F8
Device \Driver\ao9uwe31 \Device\Scsi\ao9uwe311Port2Path0Target0Lun0 851021F8
Device \Driver\ao9uwe31 \Device\Scsi\ao9uwe311 851021F8
Device \FileSystem\Cdfs \Cdfs 84B2B1F8

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x54 0x6E 0x32 0x67 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x88 0x95 0xA6 0xA2 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x57 0xE5 0x09 0x68 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x54 0x6E 0x32 0x67 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x88 0x95 0xA6 0xA2 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x57 0xE5 0x09 0x68 …

—- EOF - GMER 1.0.15 —-
Post #2
Hello and :welcome: Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise. This may cause a delay, but I will do my best to keep it as short as possible. I am checking over your log , I will post back shortly with instructions.
Post #3
hey, thats great. no worries on a time delay. glad to hear you're getting trained properly, then you'll be able to help lots of people!
Post #4
Hi,

:welcome:

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not install/uninstall anything on your computer unless advised.
  • Do not run any other scanning tools other than those instructed for you to use.
  • Follow the instructions on the order they are given.
  • Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
  • If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
  • And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________


You have BitTorrent and µTorrent, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

P2P (File Sharing ) programs form a direct conduit onto your computer, their security measures are easily circumvented, and Malware writers are increasingly exploiting them to spread their wares onto your computer. Further to that, if your P2P program is not configured correctly you may be sharing more files than you realize. There have been cases where people's Passwords, Address Books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

Many of the programs come bundled with other unwanted programs, but even the ones free of any bundled software are not safe to use.

This article from InfoWorld illustrates the dangers of a poorly configured P2P program.
http://www.infoworld.com/article/07/09/06/…ID-theft_1.html

When you use them you are downloading software from an unknown source directly onto your computer, bypassing your Firewall and Anti-Virus software. Hardly surprising then that many of these Downloads are being targeted to carry infections.

I would recommend that you uninstall BitTorrent and µTorrent, via Control Panel -> Add or Remove Programs.

However, if you do not wish to remove this program please be advised not to use the said program during the course of cleaning your machine.

–Next–

Let's try to create a Restore Point manually:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
–Next–

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your log is clean.
  • Open Spybot Search & Destroy.
  • In the Mode menu click Advanced mode if not already selected.
  • Choose Yes at the Warning prompt.
  • Expand the Tools menu.
  • Click Resident.
  • Uncheck the Resident TeaTimer (Protection of overall system settings) active. box.
  • In the File menu click Exit to exit Spybot Search & Destroy.
–Next–

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs
——————————————————————–
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log.
Post #5
ok,

- p2p's uninstalled.
- manual restore point created
- teatimer turned off
- combofix run


COMBOFIX.txt

ComboFix 10-01-13.09 - Bitten 01/14/2010 2:08.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.205 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-3039638043-2243914288-458458751-1003
c:\recycler\S-1-5-21-57989841-920026266-1343024091-1003
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\system32\_000006_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2009-12-14 to 2010-01-14 )))))))))))))))))))))))))))))))
.

2010-01-11 17:40 . 2010-01-11 17:40 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-14 07:18 . 2008-09-03 02:43 ——– d—–w- c:\program files\DNA
2010-01-14 07:18 . 2008-09-03 02:43 ——– d—–w- c:\documents and settings\Bitten\Application Data\DNA
2010-01-14 06:42 . 2009-11-01 19:51 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-12 02:25 . 2009-07-01 22:55 ——– d—–w- c:\program files\Google
2010-01-11 17:41 . 2009-11-04 13:06 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-11 17:39 . 2009-06-16 06:20 ——– d—–w- c:\program files\Virus Software
2010-01-07 21:07 . 2009-11-04 13:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-11-04 13:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-10 14:08 . 2009-06-12 19:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-04 15:03 . 2009-12-04 15:03 251376 —-a-w- c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-11-10 23:25 . 2009-06-15 11:24 117760 —-a-w- c:\documents and settings\Bitten\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-10 18:22 . 2007-04-24 18:55 110856 —-a-w- c:\documents and settings\Bitten\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-01 17:31 . 2009-11-01 17:27 56316 —-a-w- C:\BdUninstallTool2009.11.01-12.27.00.reg
2009-11-01 17:26 . 2008-09-16 01:19 81984 —-a-w- c:\windows\system32\bdod.bin
2009-10-29 07:46 . 2006-06-23 18:33 832512 —-a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2003-04-17 22:56 17408 ——w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-30 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-02 39408]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-10-07 323392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00THotkey"="c:\windows\System32\00THotkey.exe" [2003-01-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-24 24576]
"PmProxy"="c:\program files\Analog Devices\SoundMAX\PmProxy.exe" [2003-03-01 40960]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2002-12-25 159744]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-01-22 184320]
"Tpwrtray"="TPWRTRAY.EXE" [2002-12-10 237568]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2003-01-22 126976]
"TFNF5"="TFNF5.exe" [2001-08-04 73728]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2002-10-17 159744]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"ezShieldProtector for Px"="c:\windows\system32\EZSP_PX.EXE" [2002-08-20 40960]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-06-12 503808]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HPAiODevice(hp officejet g series) - 1.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet g series) - 1.lnk
backup=c:\windows\pss\HPAiODevice(hp officejet g series) - 1.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM4b5851ad
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2009-10-07 04:07 323392 —-a-w- c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
2002-08-20 17:29 40960 —-a-w- c:\windows\system32\EZSP_PX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-05-30 13:51 133104 —-atw- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 10:24 286720 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Startup Manager]
2007-06-22 15:55 919280 —-a-w- c:\program files\Advanced System Optimizer\startUp manager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"navapsvc"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=3 (0x3)
"XCOMM"=2 (0x2)
"VSSERV"=2 (0x2)
"LIVESRV"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"Dnscache"=2 (0x2)
"bdss"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

R0 ALiAGP;ALi AGP Bus Filter Driver;c:\windows\system32\drivers\ALiAGP.SYS [5/6/2003 7:09 PM 26880]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/3/2009 9:43 PM 717296]
R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\aliirda.sys [5/6/2003 7:22 PM 26112]
R3 tridxp;tridxp;c:\windows\system32\drivers\tridxpm.sys [4/24/2003 6:39 PM 248448]
S1 SASDIFSV;SASDIFSV;\??\e:\sas\SASDIFSV.SYS –> e:\sas\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\sas\SASKUTIL.sys –> e:\sas\SASKUTIL.sys [?]
S2 gupdate1c9fac07a8f59d0;Google Update Service (gupdate1c9fac07a8f59d0);c:\program files\Google\Update\GoogleUpdate.exe [7/1/2009 9:54 PM 133104]
S2 mrtRate;mrtRate; [x]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 SASENUM;SASENUM;\??\e:\sas\SASENUM.SYS –> e:\sas\SASENUM.SYS [?]
S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [5/6/2003 7:21 PM 156672]
S4 Tsdessutaf;Tsdessutaf; [x]
.
Contents of the 'Scheduled Tasks' folder

2010-01-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-01 19:46]

2010-01-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2010-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2009-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005Core.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]

2010-01-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005UA.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.toshiba.com/
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

BHO-{1DA54180-443D-4680-BF07-2D7E4D2B713C} - (no file)
BHO-{247A1DB9-DAF7-4F5B-BAC3-750B20E696D5} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-14 02:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sphv.sys >>UNKNOWN [0x853CD938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf784cf28
\Driver\ACPI -> ACPI.sys @ 0xf76a7cb8
\Driver\atapi -> atapi.sys @ 0xf7644b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Atheros AR5001X Mini PCI Wireless Network Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf754ebd4
PacketIndicateHandler -> NDIS.sys @ 0xf753ca0d
SendHandler -> NDIS.sys @ 0xf7550b40
user & kernel MBR OK

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(604)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3508)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\DVDRAMSV.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\TPWRTRAY.EXE
c:\windows\system32\TFNF5.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Java\jre6\bin\jucheck.exe
c:\progra~1\COMMON~1\MICROS~1\DW\DW20.EXE
.
**************************************************************************
.
Completion time: 2010-01-14 02:29:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-14 07:29

Pre-Run: 19,454,124,032 bytes free
Post-Run: 19,405,058,048 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - F596A1F8957A1E71B8E94A3AFCCD0E42
Post #6
Hi,

Please do the following:

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs
——————————————————————–

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

Folder::
c:\program files\DNA
c:\documents and settings\Bitten\Application Data\DNA

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\DNA\\btdna.exe"=-

Driver::
Tsdessutaf

Firefox::
FF - ProfilePath - c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

–Next–

  • Open Malwarebytes.
  • Click on the Update tab.
  • Click Check for Updates button.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post back the log.
To post in your next reply:
1. CF Script log.
2. Malwarebytes' log.
3. How is your computer?
Post #7
COMBOFIX.txt

ComboFix 10-01-15.01 - Bitten 01/15/2010 21:22:26.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.149 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bitten\Desktop\cfscript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bitten\Application Data\DNA
c:\documents and settings\Bitten\Application Data\DNA\dht.dat
c:\documents and settings\Bitten\Application Data\DNA\dht.dat.old
c:\documents and settings\Bitten\Application Data\DNA\dna.lng
c:\documents and settings\Bitten\Application Data\DNA\resume.dat
c:\documents and settings\Bitten\Application Data\DNA\resume.dat.old
c:\documents and settings\Bitten\Application Data\DNA\rss.dat
c:\documents and settings\Bitten\Application Data\DNA\rss.dat.old
c:\documents and settings\Bitten\Application Data\DNA\settings.dat
c:\documents and settings\Bitten\Application Data\DNA\settings.dat.old
c:\program files\DNA
c:\program files\DNA\btdna.exe
c:\program files\DNA\DNAcpl.cpl
c:\program files\DNA\plugins\npbtdna.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_Tsdessutaf


((((((((((((((((((((((((( Files Created from 2009-12-16 to 2010-01-16 )))))))))))))))))))))))))))))))
.

2010-01-15 02:16 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-11 17:40 . 2010-01-11 17:40 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-16 01:36 . 2009-06-12 19:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-14 06:42 . 2009-11-01 19:51 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-12 02:25 . 2009-07-01 22:55 ——– d—–w- c:\program files\Google
2010-01-11 17:41 . 2009-11-04 13:06 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-11 17:39 . 2009-06-16 06:20 ——– d—–w- c:\program files\Virus Software
2010-01-07 21:07 . 2009-11-04 13:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-11-04 13:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-04 15:03 . 2009-12-04 15:03 251376 —-a-w- c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-11-10 23:25 . 2009-06-15 11:24 117760 —-a-w- c:\documents and settings\Bitten\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-10 18:22 . 2007-04-24 18:55 110856 —-a-w- c:\documents and settings\Bitten\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-01 17:31 . 2009-11-01 17:27 56316 —-a-w- C:\BdUninstallTool2009.11.01-12.27.00.reg
2009-11-01 17:26 . 2008-09-16 01:19 81984 —-a-w- c:\windows\system32\bdod.bin
2009-10-29 07:46 . 2006-06-23 18:33 832512 ——w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2003-04-17 22:56 17408 ——w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-30 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-02 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00THotkey"="c:\windows\System32\00THotkey.exe" [2003-01-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-24 24576]
"PmProxy"="c:\program files\Analog Devices\SoundMAX\PmProxy.exe" [2003-03-01 40960]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2002-12-25 159744]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-01-22 184320]
"Tpwrtray"="TPWRTRAY.EXE" [2002-12-10 237568]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2003-01-22 126976]
"TFNF5"="TFNF5.exe" [2001-08-04 73728]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2002-10-17 159744]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"ezShieldProtector for Px"="c:\windows\system32\EZSP_PX.EXE" [2002-08-20 40960]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-06-12 503808]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HPAiODevice(hp officejet g series) - 1.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet g series) - 1.lnk
backup=c:\windows\pss\HPAiODevice(hp officejet g series) - 1.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
2002-08-20 17:29 40960 —-a-w- c:\windows\system32\EZSP_PX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-05-30 13:51 133104 —-atw- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 10:24 286720 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Startup Manager]
2007-06-22 15:55 919280 —-a-w- c:\program files\Advanced System Optimizer\startUp manager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"navapsvc"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=3 (0x3)
"XCOMM"=2 (0x2)
"VSSERV"=2 (0x2)
"LIVESRV"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"Dnscache"=2 (0x2)
"bdss"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

R0 ALiAGP;ALi AGP Bus Filter Driver;c:\windows\system32\drivers\ALiAGP.SYS [5/6/2003 7:09 PM 26880]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/3/2009 9:43 PM 717296]
R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\aliirda.sys [5/6/2003 7:22 PM 26112]
R3 tridxp;tridxp;c:\windows\system32\drivers\tridxpm.sys [4/24/2003 6:39 PM 248448]
S1 SASDIFSV;SASDIFSV;\??\e:\sas\SASDIFSV.SYS –> e:\sas\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\sas\SASKUTIL.sys –> e:\sas\SASKUTIL.sys [?]
S2 gupdate1c9fac07a8f59d0;Google Update Service (gupdate1c9fac07a8f59d0);c:\program files\Google\Update\GoogleUpdate.exe [7/1/2009 9:54 PM 133104]
S2 mrtRate;mrtRate; [x]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 SASENUM;SASENUM;\??\e:\sas\SASENUM.SYS –> e:\sas\SASENUM.SYS [?]
S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [5/6/2003 7:21 PM 156672]
.
Contents of the 'Scheduled Tasks' folder

2010-01-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-01 19:46]

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2009-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005Core.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005UA.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.toshiba.com/
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-BitTorrent DNA - c:\program files\DNA\btdna.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 21:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys speu.sys >>UNKNOWN [0x853CD938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf784cf28
\Driver\ACPI -> ACPI.sys @ 0xf76a7cb8
\Driver\atapi -> atapi.sys @ 0xf7644b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Atheros AR5001X Mini PCI Wireless Network Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf754ebd4
PacketIndicateHandler -> NDIS.sys @ 0xf755aa21
SendHandler -> NDIS.sys @ 0xf754ed44
user & kernel MBR OK

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(604)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2120)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\DVDRAMSV.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\TPWRTRAY.EXE
c:\windows\system32\TFNF5.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-01-15 21:44:55 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-16 02:44
ComboFix2.txt 2010-01-14 07:29

Pre-Run: 19,613,253,632 bytes free
Post-Run: 19,586,109,440 bytes free

- - End Of File - - AD023945DCE14609277D5E8835223A50



MBAM.txt


Malwarebytes' Anti-Malware 1.44
Database version: 3576
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

1/16/2010 10:53:21 AM
mbam-log-2010-01-16 (10-53-21).txt

Scan type: Quick Scan
Objects scanned: 124538
Time elapsed: 8 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)




PC is running very well! it is definitely still slower than when she was brand new, but much improved from what it had become - barely chugging along. so what was causing general speed retardation?
Post #8
Hi,

Many of what we removed are from Bittorrent and some files from Coupon Printer for Windows which may have been one of the causes of your computer slowing down.

Here is an interesting topic regarding Coupon Printer for Windows which is installed in your computer:
http://www.benedelman.org/news/031808-1.html

If you wish to remove it you can do the following:
Click on Start then Control Panel
Open Add or Remove Programs then uninstall the following:
  • Coupon Printer for Windows
Close Control Panel.

–Next–

Please do a scan with Kaspersky Online Scanner.
  • Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run. (At times it may appear to stall)
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Once the scan is complete, click on View scan report To obtain the report:
  • Click on: Save Report As
  • Next, in the Save as prompt, Save in area, select: Desktop
  • In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt]
  • Then, click: Save
  • Please post the Kaspersky Online Scanner Report in your reply.
–Next–

Please run another DDS scan for me then post the logs.

To post in your next reply:
1. Kaspersky log.
2. DDS logs.
3. How is your computer?
Post #10
hey, sorry. interesting about that coupon.com stuff. i had to d/l it for a coupon once and have never used (nor planned on using) again. at least it looks like TRUSTe finally took them off their whitelist. i'm having trouble with the Kapersky test. it keeps freezing up after about 30min. it says there is one threat object found and i think that is what is freezing it… any suggestions? maybe i'll try it in internet explorer.
Post #11
Hi,

Please do the following:

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs
——————————————————————–

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll

Firefox::
Firefox -: Profile - c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

–Next–

maybe i'll try it in internet explorer.

Yes please, but if you are still having trouble with Kaspersky, you can do the following instead:

Go here to run an online scanner from ESET.

  • Note: You will need to use Internet explorer for this scan
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic and also let me know how things are now.
To post in your next reply:
1. CF Script log.
2. Kaspersky or ESET log.
3. How is your computer?
Post #12
ok, i was able to get everything you wanted, including the kapersky log. it wasn't working with windows exploerer either, finally got it to work by deleting the infected files that seemed to be stopping it.

as far as how the computer is running, sometimes it is very snappy, other times seems to be bogged down.


ESET.txt

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.16981 (vista_gdr.091215-2244)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=02e1b22ad9a2964fb2864c724eb5a53c
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-01-22 10:19:40
# local_time=2010-01-22 03:19:40 (-0700, Mountain Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=78953
# found=5
# cleaned=0
# scan_time=7563
C:\Documents and Settings\Bitten\My Documents\Downloads\Windows XP Home SP2 [OEM Edition]\Windows XP Home SP2 [OEM Edition].rar Win32/HackTool.WpaKill.B application 00000000000000000000000000000000 I
C:\Documents and Settings\Bitten\My Documents\Virus Software\VirtumundoBeGone.exe Win32/PrcView application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP399\A0098048.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP399\A0098049.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP399\A0098050.ini Win32/Adware.Virtumonde.NEO application 00000000000000000000000000000000 I


COMBOFIX.txt

ComboFix 10-01-21.08 - Bitten 01/22/2010 12:15:41.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.162 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bitten\Desktop\cfscript.txt

FILE ::
"c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll"
.

((((((((((((((((((((((((( Files Created from 2009-12-22 to 2010-01-22 )))))))))))))))))))))))))))))))
.

2010-01-15 02:16 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-11 17:40 . 2010-01-11 17:40 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-21 19:37 . 2009-10-12 00:07 ——– d—–w- c:\program files\Coupons
2010-01-16 01:36 . 2009-06-12 19:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-14 06:42 . 2009-11-01 19:51 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-12 02:25 . 2009-07-01 22:55 ——– d—–w- c:\program files\Google
2010-01-11 17:41 . 2009-11-04 13:06 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-11 17:39 . 2009-06-16 06:20 ——– d—–w- c:\program files\Virus Software
2010-01-07 21:07 . 2009-11-04 13:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-11-04 13:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00 . 2006-06-23 18:33 832512 —-a-w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2003-04-17 22:56 17408 ——w- c:\windows\system32\corpol.dll
2009-12-04 15:03 . 2009-12-04 15:03 251376 —-a-w- c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-11-21 15:51 . 2003-04-17 22:55 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-10 23:25 . 2009-06-15 11:24 117760 —-a-w- c:\documents and settings\Bitten\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-10 18:22 . 2007-04-24 18:55 110856 —-a-w- c:\documents and settings\Bitten\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-01 17:31 . 2009-11-01 17:27 56316 —-a-w- C:\BdUninstallTool2009.11.01-12.27.00.reg
2009-11-01 17:26 . 2008-09-16 01:19 81984 —-a-w- c:\windows\system32\bdod.bin
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-30 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-02 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00THotkey"="c:\windows\System32\00THotkey.exe" [2003-01-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-24 24576]
"PmProxy"="c:\program files\Analog Devices\SoundMAX\PmProxy.exe" [2003-03-01 40960]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2002-12-25 159744]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-01-22 184320]
"Tpwrtray"="TPWRTRAY.EXE" [2002-12-10 237568]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2003-01-22 126976]
"TFNF5"="TFNF5.exe" [2001-08-04 73728]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2002-10-17 159744]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"ezShieldProtector for Px"="c:\windows\system32\EZSP_PX.EXE" [2002-08-20 40960]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-06-12 503808]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HPAiODevice(hp officejet g series) - 1.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet g series) - 1.lnk
backup=c:\windows\pss\HPAiODevice(hp officejet g series) - 1.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
2002-08-20 17:29 40960 —-a-w- c:\windows\system32\EZSP_PX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-05-30 13:51 133104 —-atw- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 10:24 286720 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Startup Manager]
2007-06-22 15:55 919280 —-a-w- c:\program files\Advanced System Optimizer\startUp manager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"navapsvc"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=3 (0x3)
"XCOMM"=2 (0x2)
"VSSERV"=2 (0x2)
"LIVESRV"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"Dnscache"=2 (0x2)
"bdss"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

R0 ALiAGP;ALi AGP Bus Filter Driver;c:\windows\system32\drivers\ALiAGP.SYS [5/6/2003 5:09 PM 26880]
R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\aliirda.sys [5/6/2003 5:22 PM 26112]
R3 tridxp;tridxp;c:\windows\system32\drivers\tridxpm.sys [4/24/2003 4:39 PM 248448]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/3/2009 7:43 PM 717296]
S1 SASDIFSV;SASDIFSV;\??\e:\sas\SASDIFSV.SYS –> e:\sas\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\sas\SASKUTIL.sys –> e:\sas\SASKUTIL.sys [?]
S2 gupdate1c9fac07a8f59d0;Google Update Service (gupdate1c9fac07a8f59d0);c:\program files\Google\Update\GoogleUpdate.exe [7/1/2009 7:54 PM 133104]
S2 mrtRate;mrtRate; [x]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 SASENUM;SASENUM;\??\e:\sas\SASENUM.SYS –> e:\sas\SASENUM.SYS [?]
S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [5/6/2003 5:21 PM 156672]
.
Contents of the 'Scheduled Tasks' folder

2010-01-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-01 19:46]

2010-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2010-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2009-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005Core.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]

2010-01-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005UA.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.toshiba.com/
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-22 12:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(592)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3036)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2010-01-22 12:34:25
ComboFix-quarantined-files.txt 2010-01-22 19:34
ComboFix2.txt 2010-01-16 02:44
ComboFix3.txt 2010-01-14 07:29

Pre-Run: 19,488,800,768 bytes free
Post-Run: 19,566,465,024 bytes free

- - End Of File - - 31E82F872F25FCCB95C8F67A6AE239D7



KAPERSKY.txt

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Saturday, January 23, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, January 23, 2010 06:50:28
Records in database: 3360709
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 80965
Threats found: 10
Infected objects found: 11
Suspicious objects found: 0
Scan duration: 04:20:46


File name / Threat / Threats count
C:\Documents and Settings\Bitten\My Documents\Downloads\Advanced Uninstaller Pro v9.6\Crack\uninstaller.exe Infected: Trojan-PSW.Win32.LdPinch.ajmd 1
C:\Documents and Settings\Bitten\My Documents\Virus Software\bootwizard.exe Infected: Backdoor.Win32.Agent.anvy 1
C:\Program Files\Virus Software\Innovative Solutions\Advanced Uninstaller PRO - Version 9\uninstaller.exe Infected: Trojan-PSW.Win32.LdPinch.ajmd 1
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe Infected: Backdoor.Win32.IRCBot.lff 1
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe Infected: Backdoor.Win32.IRCBot.lao 1
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe Infected: Backdoor.Win32.IRCBot.krx 1
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe Infected: Backdoor.Win32.IRCBot.mwo 1
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe Infected: Backdoor.Win32.IRCBot.mdm 1
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe Infected: Backdoor.Win32.IRCBot.mdl 1
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe Infected: Backdoor.Win32.IRCBot.lfe 1
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe Infected: Backdoor.Win32.IRCBot.lfk 1

Selected area has been scanned.


DDS.txt


DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 10:52:42.33 on Sat 01/23/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.145 [GMT -7:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Bitten\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.toshiba.com/
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [Google Update] "c:\documents and settings\bitten\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [00THotkey] c:\windows\system32\00THotkey.exe
mRun: [000StTHK] 000StTHK.exe
mRun: [PmProxy] c:\program files\analog devices\soundmax\PmProxy.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
mRun: [Tpwrtray] TPWRTRAY.EXE
mRun: [TouchED] c:\program files\toshiba\touched\TouchED.Exe
mRun: [TFNF5] TFNF5.exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [ezShieldProtector for Px] c:\windows\system32\EZSP_PX.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [3170 Scan2PC] "c:\windows\twain_32\samsung\clx3170\Scan2pc.exe"
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1208719407125
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177041749379
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177041738043
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?39191.7537384259
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\bitten\applic~1\mozilla\firefox\profiles\gtbanp75.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\bitten\application data\mozilla\firefox\profiles\gtbanp75.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\bitten\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\bitten\local settings\application data\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 ALiAGP;ALi AGP Bus Filter Driver;c:\windows\system32\drivers\ALiAGP.SYS [2003-5-6 26880]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968]
R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\aliirda.sys [2003-5-6 26112]
R3 tridxp;tridxp;c:\windows\system32\drivers\tridxpm.sys [2003-4-24 248448]
S1 SASDIFSV;SASDIFSV;\??\e:\sas\sasdifsv.sys –> e:\sas\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\sas\saskutil.sys –> e:\sas\SASKUTIL.sys [?]
S2 gupdate1c9fac07a8f59d0;Google Update Service (gupdate1c9fac07a8f59d0);c:\program files\google\update\GoogleUpdate.exe [2009-7-1 133104]
S2 mrtRate;mrtRate; [x]
S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys –> c:\windows\system32\drivers\SSPORT.sys [?]
S3 SASENUM;SASENUM;\??\e:\sas\sasenum.sys –> e:\sas\SASENUM.SYS [?]
S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [2003-5-6 156672]

=============== Created Last 30 ================

2010-01-22 20:01:39 0 d—–w- c:\program files\ESET
2010-01-15 02:16:16 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-14 07:04:51 0 d-sha-r- C:\cmdcons
2010-01-14 07:03:13 98816 —-a-w- c:\windows\sed.exe
2010-01-14 07:03:13 77312 —-a-w- c:\windows\MBR.exe
2010-01-14 07:03:13 261632 —-a-w- c:\windows\PEV.exe
2010-01-14 07:03:13 161792 —-a-w- c:\windows\SWREG.exe

==================== Find3M ====================

2010-01-07 21:07:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07:04 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00:29 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00:21 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00:20 17408 ——w- c:\windows\system32\corpol.dll
2009-11-01 17:31:45 56316 —-a-w- C:\BdUninstallTool2009.11.01-12.27.00.reg
2009-11-01 17:26:59 81984 —-a-w- c:\windows\system32\bdod.bin
2009-02-21 07:17:07 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009022120090222\index.dat

============= FINISH: 10:54:27.13 ===============



ATTACH.txt


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/19/2007 9:52:21 PM
System Uptime: 1/22/2010 6:30:53 PM (16 hours ago)

Motherboard: TOSHIBA | | Portable PC
Processor: Intel® Pentium® 4 CPU 3.06GHz | uFC-PGA Socket | 3055/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 56 GiB total, 18.503 GiB free.
D: is CDROM (CDFS)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP395: 10/24/2009 6:00:43 AM - Software Distribution Service 3.0
RP396: 10/26/2009 12:21:17 PM - Software Distribution Service 3.0
RP397: 10/26/2009 7:49:27 PM - Printer Driver Samsung CLX-3170 Series Installed
RP398: 10/28/2009 12:15:29 PM - System Checkpoint
RP399: 10/29/2009 6:00:48 AM - Software Distribution Service 3.0
RP400: 10/30/2009 11:01:58 AM - Software Distribution Service 3.0
RP401: 10/31/2009 9:34:12 AM - Software Distribution Service 3.0
RP402: 11/1/2009 12:21:06 PM - Removed BitDefender Free Edition v10
RP403: 11/1/2009 1:14:40 PM - Removed SUPERAntiSpyware Free Edition
RP404: 11/2/2009 7:07:30 AM - Software Distribution Service 3.0
RP405: 11/2/2009 11:20:00 PM - Software Distribution Service 3.0
RP406: 11/3/2009 11:59:37 PM - Installed SUPERAntiSpyware Free Edition
RP407: 11/4/2009 7:05:22 AM - Software Distribution Service 3.0
RP408: 11/6/2009 11:26:40 PM - System Checkpoint
RP409: 11/7/2009 10:13:01 AM - Software Distribution Service 3.0
RP410: 11/8/2009 12:07:19 PM - Software Distribution Service 3.0
RP411: 11/10/2009 4:57:53 AM - Software Distribution Service 3.0
RP412: 11/10/2009 4:13:45 PM - Unsigned printer driver Samsung CLX-3170 Series installed.
RP413: 11/11/2009 5:34:49 PM - System Checkpoint
RP414: 11/12/2009 10:37:38 PM - System Checkpoint
RP415: 11/17/2009 6:39:55 PM - Software Distribution Service 3.0
RP416: 11/18/2009 8:25:13 PM - Software Distribution Service 3.0
RP417: 11/18/2009 9:52:16 PM - Software Distribution Service 3.0
RP418: 11/21/2009 3:39:19 PM - System Checkpoint
RP419: 11/27/2009 6:11:49 PM - Software Distribution Service 3.0
RP420: 12/1/2009 1:04:44 PM - Software Distribution Service 3.0
RP421: 12/5/2009 9:49:48 AM - System Checkpoint
RP422: 12/6/2009 12:31:19 PM - Software Distribution Service 3.0
RP423: 12/6/2009 6:06:42 PM - Software Distribution Service 3.0
RP424: 12/8/2009 11:34:47 AM - System Checkpoint
RP425: 12/9/2009 10:30:59 PM - System Checkpoint
RP426: 12/10/2009 6:54:01 AM - Software Distribution Service 3.0
RP427: 1/10/2010 1:55:18 PM - System Checkpoint
RP428: 1/11/2010 7:55:46 PM - Removed Apple Software Update
RP429: 1/12/2010 8:14:48 AM - Software Distribution Service 3.0
RP430: 1/13/2010 11:56:07 PM - before whatthetech help
RP431: 1/15/2010 6:24:59 PM - Software Distribution Service 3.0
RP432: 1/16/2010 10:35:16 AM - Software Distribution Service 3.0
RP433: 1/21/2010 12:33:30 PM - Software Distribution Service 3.0
RP434: 1/22/2010 12:02:02 PM - Software Distribution Service 3.0

==== Installed Programs ======================

7-Zip 4.65
AAC Decoder
AC3Filter (remove only)
Adobe Acrobat 5.0
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Photoshop CS
Advanced System Optimizer
Advanced Uninstaller PRO - Version 9
AIM 6
ALi AGP Driver 2.00
Alps Pointing-device Driver
Atheros Client Utility
AutoCAD 2007 - English
Autodesk DWF Viewer
AutoUpdate
BitDefender Free Edition v10
Choice Guard
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
Drag'n Drop CD+DVD
DVD-RAM Driver
ERUNT 1.1j
ESET Online Scanner v3
FileZilla Client [removed]
Google Earth
Google Talk Plugin
Google Update Helper
Google Updater
H.264 Decoder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
hp instant support
hp officejet g series
InterVideo WinDVD 4
Java™ 6 Update 15
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 7
Java™ SE Runtime Environment 6 Update 1
LimeWire 4.12.11
Macromedia Flash Player 8
Malwarebytes' Anti-Malware
Managed DirectX (0900)
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works 7.0
MKV Splitter
Mozilla Firefox (3.5.7)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Notebook Maximizer
Picasa 3
PokerStars
PokerStove version 1.21
PurePlay Poker
Quicken 2003 New User Edition
QuickTime
Samsung CLX-3170 Series
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
Skype™ 3.8
Software Suite
SoundMAX
Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
TOSHIBA Access
TOSHIBA ConfigFree
TOSHIBA Console
TOSHIBA Controls
Toshiba Hotkey Utility for Display Devices
TOSHIBA Power Saver
Toshiba Registration
TOSHIBA Software Modem
TOSHIBA Software Upgrades
Toshiba Tbiosdrv Driver
TOSHIBA TouchPad On/Off Utility V2.05.00
TOSHIBA Utilities
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office InfoPath 2007 (KB976416)
Update for Outlook 2007 Junk Email Filter (kb977839)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC_MergeModuleToMSI
VC80CRTRedist - 8.0.50727.762
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 7
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

1/22/2010 12:15:08 PM, error: Service Control Manager [7034] - The DVD-RAM_Service service terminated unexpectedly. It has done this 1 time(s).
1/21/2010 3:42:58 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SASDIFSV SASKUTIL
1/21/2010 3:42:51 PM, error: Service Control Manager [7000] - The SSPORT service failed to start due to the following error: The system cannot find the file specified.
1/21/2010 3:42:51 PM, error: Service Control Manager [7000] - The mrtRate service failed to start due to the following error: The system cannot find the file specified.
1/21/2010 3:42:51 PM, error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the file specified.
1/21/2010 12:35:19 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework 3.5 Family Update for .NET versions 2.0 through 3.5 (KB951847) x86.
1/16/2010 9:46:37 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Netman service.

==== End Of File ===========================
Post #13
Hi,

Please advise where you downloaded or bought your copy of windows.

–Next–

Download CKScanner by askey127 from Here & save it to your Desktop.
  • Doubleclick CKScanner.exe then click Search For Files
  • When the cursor hourglass disappears, click Save List To File
  • A message box will verify the file saved
  • Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
To post in your next reply:
1. Regarding your windows
2. CKScanner log.
Post #14
i have the original Windows XP software that was on the laptop when i purchased it at best buy in… '03 or '04. its a Toshiba.A-25 i noticed that XP OEM in the last scan also. that file was downloaded a few years ago when i couldn't find the original Toshiba Manufacturer CD's. it was never used though and i had forgotten that it was on here. should i delete it? is it corrupt? CKFILES.txt CKScanner - Additional Security Risks - These are not necessarily bad scanner sequence 3.RP.11 —– EOF —–
Post #15
Hi,

Some of the infections are from cracked software. Downloading cracks or cracked software will almost certainly infect your computer.

finally got it to work by deleting the infected files that seemed to be stopping it.

Deleted by Kaspersky? Can you post what those infected files are? Thanks.

Can you also tell more about this program: C:\Program Files\Virus Software

–Next–

Your log shows signs of a trojan infection. The capabilities of this particular trojan include keylogging and password stealing so I advise you to take all precautions to safeguard your accounts, passwords, and sensitive data. If you have entered any credit card details or use your computer for financial/banking transactions, you should notify your banks and financial institutions that you may have been a victim of identity theft and to put a watch on your accounts. For more information, please read How to report ID theft, fraud, drive-by installs, hijacking and malware. I also recommend that you change your online passwords for email, banks, etc., immediately – from a clean computer. It bears repeating to change passwords from a clean computer only.

Many experts believe that once a computer has been infected with this type of Trojan, it is best to reformat and reinstall the Operating System. The reason is that even after cleaning, there may be some remnants left in the system. It is hard to discern how much damage has been done. Only you can decide whether it would be best to reformat and start over. We can proceed with the cleanup process if you prefer. If you decide to reformat, be sure save your important data to backup media but make sure that you scan it all before you put it back on a clean system. Please read the following: When should I re-format? How should I reinstall?

If you wish to continue with the clean up, please proceed with the following:

NOTE: Delete your copy of Combofix.

Download ComboFix from one of these locations:

Link 1
Link 2

–Next–

Please do the following:

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs
——————————————————————–

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\Bitten\My Documents\Downloads\Windows XP Home SP2 [OEM Edition]\Windows XP Home SP2 [OEM Edition].rar
C:\Documents and Settings\Bitten\My Documents\Virus Software\VirtumundoBeGone.exe
C:\Documents and Settings\Bitten\My Documents\Downloads\Advanced Uninstaller Pro v9.6\Crack\uninstaller.exe
C:\Documents and Settings\Bitten\My Documents\Virus Software\bootwizard.exe
C:\Program Files\Virus Software\Innovative Solutions\Advanced Uninstaller PRO - Version 9\uninstaller.exe
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe
C:\RECYCLER\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe

Folder::
c:\program files\Coupons

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

To post in your next reply:
1. Regarding C:\Program Files\Virus Software and the deleted infections.
2. CKScanner log.
3. CFScript log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI