What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] [Closed] laptop was ravaged by viruses...

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
read thru the "should i reformat" info. i'd rather not, if possible. reasons:
1. this laptop is older and only used as a backup. nothing sensitive is on it, usually used for general mundane tasks.
2. the original manufacturers backup disks are at my parents house in denver and i'm on the east coast. will be out there in a couple of months probably, but would have to wait till i get the disks to do a full reformat.
3. according to the tech article, computers that are left on and connected to the internet for long periods of time are at greater risk - this never really is. it is always closed and turned off after use, often not even connected to the internet.
4. i have never noticed any problems with any passworded online accounts (but will change everything from another comp), and this virus stuff has been on here at least several months (although i'm starting to think longer? possibly years??). if it was being accessed, that SHOULD have happened long ago…

HOWEVER!! (this one depends on your thoughts) the "reformat/reinstall?" tech page asked about the specific types of backdoors installed and what they were doing/accessing, if it was pertinent tasks, or merely listening/adware objectives. you said it had keylogger and some other capabilities. your thoughts?

not sure what files were freezing kapersky. when i noticed it frozen, i just followed the address listed and deleted. they were zip files in the downloads folder, so figured it wouldn't matter to delete them. but, didn't keep a log of them, sorry. i checked the recycle bin, but its empty (i'm guessing one of the internal functions with combofix?) the KAPERSKY.log is in my last post. did you want me to run it again? (you asked for the log at the end of your post, but never mentioned running it again)

the C:\MY DOCUMENTS\VIRUS SOFTWARE folder is the location i keep copies of virus and adware scanning software. here is a list of everything that is in the file (not including those you had the ComboFix script delete):
Ad-AwareAE.exe
AntivirusBootCD.7z
asc-setup.exe
bitdefender_free_v10.exe
ccsetup220.exe
ComboFix.exe
mbam-setup.exe
spybotsd162.exe
SUPERAntiSpyware(2).exe
VundoFix.exe

i'm sure they are all out of date. most have a modified date of 6/19/09, the others are from 3/3/09. i had ran into a problem a year or two ago with some viruses that messed up all the anti-virus software, and wouldn't let any new stuff d/l. so as a precaution, istarted keeping a copy of some av software on the comp, in case of emergency. btw, could these issues really be stemming back to then? i cleaned up the comp on my own, using a ton of different virus scanners, but nothing indepth, and had no help from someone like yourself. no combofix, or anything of the sort. i thought everything was eliminated, but… perhaps not? (the "advanced uninstaller pro" was installed at that time, and it seems to be one of the main things coming up in your ComboFix scripts. how annoying, d/l'd it to help eliminate problems… lesson learned on the cracked software. can i uninstall the rest of this program now, or wait?)

there is also a C:\PROGRAM FILES\VIRUS SOFTWARE folder. that is where all of the installed virus scanning software is located. the sub-folders here are:
C:\Program Files\Virus Software\Innovative Solutions\Advanced Uninstaller PRO - Version 9
C:\Program Files\Virus Software\Registry Backup\ERUNT
ok, thats where i THOUGHT all the virus scanning software was installed. looks like i let alot of it just be installed in the traditional program files directory (AVG, LavaSoft, Malwarebytes, etc). i also noticed limewire is still installed there. thought i had uninstalled it already…


ComboFix was deleted from desktop and d/l'd. computer appears to be running smoother and faster.

COMBOFIX.txt

ComboFix 10-01-26.02 - Bitten 01/26/2010 23:42:18.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.91 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bitten\Desktop\CFScript.txt

FILE ::
"c:\documents and settings\Bitten\My Documents\Downloads\Advanced Uninstaller Pro v9.6\Crack\uninstaller.exe"
"c:\documents and settings\Bitten\My Documents\Downloads\Windows XP Home SP2 [OEM Edition]\Windows XP Home SP2 [OEM Edition].rar"
"c:\documents and settings\Bitten\My Documents\Virus Software\bootwizard.exe"
"c:\documents and settings\Bitten\My Documents\Virus Software\VirtumundoBeGone.exe"
"c:\program files\Virus Software\Innovative Solutions\Advanced Uninstaller PRO - Version 9\uninstaller.exe"
"c:\recycler\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bitten\My Documents\Downloads\Windows XP Home SP2 [OEM Edition]\Windows XP Home SP2 [OEM Edition].rar
c:\documents and settings\Bitten\My Documents\Virus Software\bootwizard.exe
c:\documents and settings\Bitten\My Documents\Virus Software\VirtumundoBeGone.exe
c:\program files\Coupons
c:\program files\Coupons\uninstall.exe
c:\program files\Virus Software\Innovative Solutions\Advanced Uninstaller PRO - Version 9\uninstaller.exe

.
((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))
.

2010-01-22 20:01 . 2010-01-22 20:01 ——– d—–w- c:\program files\ESET
2010-01-15 02:16 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-11 17:40 . 2010-01-11 17:40 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-16 01:36 . 2009-06-12 19:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-14 06:42 . 2009-11-01 19:51 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-12 02:25 . 2009-07-01 22:55 ——– d—–w- c:\program files\Google
2010-01-11 17:41 . 2009-11-04 13:06 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-11 17:39 . 2009-06-16 06:20 ——– d—–w- c:\program files\Virus Software
2010-01-07 21:07 . 2009-11-04 13:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-11-04 13:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00 . 2006-06-23 18:33 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2003-04-17 22:56 17408 ——w- c:\windows\system32\corpol.dll
2009-12-04 15:03 . 2009-12-04 15:03 251376 —-a-w- c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-11-21 15:51 . 2003-04-17 22:55 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-10 23:25 . 2009-06-15 11:24 117760 —-a-w- c:\documents and settings\Bitten\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-10 18:22 . 2007-04-24 18:55 110856 —-a-w- c:\documents and settings\Bitten\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-01 17:31 . 2009-11-01 17:27 56316 —-a-w- C:\BdUninstallTool2009.11.01-12.27.00.reg
2009-11-01 17:26 . 2008-09-16 01:19 81984 —-a-w- c:\windows\system32\bdod.bin
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-30 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-02 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00THotkey"="c:\windows\System32\00THotkey.exe" [2003-01-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-24 24576]
"PmProxy"="c:\program files\Analog Devices\SoundMAX\PmProxy.exe" [2003-03-01 40960]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2002-12-25 159744]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-01-22 184320]
"Tpwrtray"="TPWRTRAY.EXE" [2002-12-10 237568]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2003-01-22 126976]
"TFNF5"="TFNF5.exe" [2001-08-04 73728]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2002-10-17 159744]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"ezShieldProtector for Px"="c:\windows\system32\EZSP_PX.EXE" [2002-08-20 40960]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-06-12 503808]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HPAiODevice(hp officejet g series) - 1.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet g series) - 1.lnk
backup=c:\windows\pss\HPAiODevice(hp officejet g series) - 1.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
2002-08-20 17:29 40960 —-a-w- c:\windows\system32\EZSP_PX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-05-30 13:51 133104 —-atw- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 10:24 286720 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Startup Manager]
2007-06-22 15:55 919280 —-a-w- c:\program files\Advanced System Optimizer\startUp manager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"navapsvc"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=3 (0x3)
"XCOMM"=2 (0x2)
"VSSERV"=2 (0x2)
"LIVESRV"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"Dnscache"=2 (0x2)
"bdss"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

R0 ALiAGP;ALi AGP Bus Filter Driver;c:\windows\system32\drivers\ALiAGP.SYS [5/6/2003 5:09 PM 26880]
R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\aliirda.sys [5/6/2003 5:22 PM 26112]
R3 tridxp;tridxp;c:\windows\system32\drivers\tridxpm.sys [4/24/2003 4:39 PM 248448]
S1 SASDIFSV;SASDIFSV;\??\e:\sas\SASDIFSV.SYS –> e:\sas\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\sas\SASKUTIL.sys –> e:\sas\SASKUTIL.sys [?]
S2 gupdate1c9fac07a8f59d0;Google Update Service (gupdate1c9fac07a8f59d0);c:\program files\Google\Update\GoogleUpdate.exe [7/1/2009 7:54 PM 133104]
S2 mrtRate;mrtRate; [x]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 SASENUM;SASENUM;\??\e:\sas\SASENUM.SYS –> e:\sas\SASENUM.SYS [?]
S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [5/6/2003 5:21 PM 156672]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/3/2009 7:43 PM 717296]
.
Contents of the 'Scheduled Tasks' folder

2010-01-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-01 19:46]

2010-01-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2010-01-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2009-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005Core.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]

2010-01-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005UA.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.toshiba.com/
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 23:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(596)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-01-27 00:00:44
ComboFix-quarantined-files.txt 2010-01-27 07:00
ComboFix2.txt 2010-01-22 19:34
ComboFix3.txt 2010-01-16 02:44
ComboFix4.txt 2010-01-14 07:29

Pre-Run: 20,130,353,152 bytes free
Post-Run: 20,185,559,040 bytes free

- - End Of File - - 6950C4BB31B5E4E3408FEB9FA33C241F


after running, it said it wanted to send some quarantined files to headqtrs for further analysis. it failed however, for unknown reasons and asked me to send a zip file manually. i tried and it failed again, so i was nervous and ran ComboFix again, with the same script - just in case. the file is 8megs, so too big to attach here, or i would have attached for you.


2nd run of COMBOFIX.txt

ComboFix 10-01-26.02 - Bitten 01/27/2010 0:27.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.138 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bitten\Desktop\CFScript.txt

FILE ::
"c:\documents and settings\Bitten\My Documents\Downloads\Advanced Uninstaller Pro v9.6\Crack\uninstaller.exe"
"c:\documents and settings\Bitten\My Documents\Downloads\Windows XP Home SP2 [OEM Edition]\Windows XP Home SP2 [OEM Edition].rar"
"c:\documents and settings\Bitten\My Documents\Virus Software\bootwizard.exe"
"c:\documents and settings\Bitten\My Documents\Virus Software\VirtumundoBeGone.exe"
"c:\program files\Virus Software\Innovative Solutions\Advanced Uninstaller PRO - Version 9\uninstaller.exe"
"c:\recycler\S-1-5-21-4068261247-545617434-2479243949-1005\Dc1\Data Doctor.exe"
.

((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 )))))))))))))))))))))))))))))))
.

2010-01-22 20:01 . 2010-01-22 20:01 ——– d—–w- c:\program files\ESET
2010-01-15 02:16 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-11 17:40 . 2010-01-11 17:40 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-16 01:36 . 2009-06-12 19:19 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-14 06:42 . 2009-11-01 19:51 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-12 02:25 . 2009-07-01 22:55 ——– d—–w- c:\program files\Google
2010-01-11 17:41 . 2009-11-04 13:06 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-11 17:39 . 2009-06-16 06:20 ——– d—–w- c:\program files\Virus Software
2010-01-07 21:07 . 2009-11-04 13:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-11-04 13:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00 . 2006-06-23 18:33 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 07:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2003-04-17 22:56 17408 ——w- c:\windows\system32\corpol.dll
2009-12-04 15:03 . 2009-12-04 15:03 251376 —-a-w- c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-11-21 15:51 . 2003-04-17 22:55 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-10 23:25 . 2009-06-15 11:24 117760 —-a-w- c:\documents and settings\Bitten\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-10 18:22 . 2007-04-24 18:55 110856 —-a-w- c:\documents and settings\Bitten\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-01 17:31 . 2009-11-01 17:27 56316 —-a-w- C:\BdUninstallTool2009.11.01-12.27.00.reg
2009-11-01 17:26 . 2008-09-16 01:19 81984 —-a-w- c:\windows\system32\bdod.bin
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-30 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-02 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"00THotkey"="c:\windows\System32\00THotkey.exe" [2003-01-17 253952]
"000StTHK"="000StTHK.exe" [2001-06-24 24576]
"PmProxy"="c:\program files\Analog Devices\SoundMAX\PmProxy.exe" [2003-03-01 40960]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2002-12-25 159744]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-01-22 184320]
"Tpwrtray"="TPWRTRAY.EXE" [2002-12-10 237568]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2003-01-22 126976]
"TFNF5"="TFNF5.exe" [2001-08-04 73728]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2002-10-17 159744]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"ezShieldProtector for Px"="c:\windows\system32\EZSP_PX.EXE" [2002-08-20 40960]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2009-06-12 503808]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HPAiODevice(hp officejet g series) - 1.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet g series) - 1.lnk
backup=c:\windows\pss\HPAiODevice(hp officejet g series) - 1.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezShieldProtector for Px]
2002-08-20 17:29 40960 —-a-w- c:\windows\system32\EZSP_PX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-05-30 13:51 133104 —-atw- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 10:24 286720 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Startup Manager]
2007-06-22 15:55 919280 —-a-w- c:\program files\Advanced System Optimizer\startUp manager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"navapsvc"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=3 (0x3)
"XCOMM"=2 (0x2)
"VSSERV"=2 (0x2)
"LIVESRV"=2 (0x2)
"Lavasoft Ad-Aware Service"=2 (0x2)
"Dnscache"=2 (0x2)
"bdss"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Bitten\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\ScanMgr.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Scan2Pc.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\CLX3170\\Sscan2io.exe"=

R0 ALiAGP;ALi AGP Bus Filter Driver;c:\windows\system32\drivers\ALiAGP.SYS [5/6/2003 5:09 PM 26880]
R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\aliirda.sys [5/6/2003 5:22 PM 26112]
R3 tridxp;tridxp;c:\windows\system32\drivers\tridxpm.sys [4/24/2003 4:39 PM 248448]
S1 SASDIFSV;SASDIFSV;\??\e:\sas\SASDIFSV.SYS –> e:\sas\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\sas\SASKUTIL.sys –> e:\sas\SASKUTIL.sys [?]
S2 gupdate1c9fac07a8f59d0;Google Update Service (gupdate1c9fac07a8f59d0);c:\program files\Google\Update\GoogleUpdate.exe [7/1/2009 7:54 PM 133104]
S2 mrtRate;mrtRate; [x]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 SASENUM;SASENUM;\??\e:\sas\SASENUM.SYS –> e:\sas\SASENUM.SYS [?]
S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [5/6/2003 5:21 PM 156672]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3/3/2009 7:43 PM 717296]
.
Contents of the 'Scheduled Tasks' folder

2010-01-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-01 19:46]

2010-01-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2010-01-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 02:54]

2009-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005Core.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]

2010-01-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4068261247-545617434-2479243949-1005UA.job
- c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 13:51]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.toshiba.com/
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\Firefox\Profiles\gtbanp75.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Bitten\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Bitten\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-27 00:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(596)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3632)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2010-01-27 00:43:06
ComboFix-quarantined-files.txt 2010-01-27 07:43
ComboFix2.txt 2010-01-27 07:00
ComboFix3.txt 2010-01-22 19:34
ComboFix4.txt 2010-01-16 02:44
ComboFix5.txt 2010-01-27 07:25

Pre-Run: 20,186,177,536 bytes free
Post-Run: 20,175,040,512 bytes free

- - End Of File - - 5968B4FA6C05E3718A036A007ECC2507
Post #17
Hi,

Please don't run combofix unless advised.

The important thing here is to remove the infection whatever they are monitoring. Personally, I would do a complete reformat and reinstall if this types of infections (backdoor, keyloggers) are in my computer.
However, this is your choice.

You are running more than 1 anti spyware at the same time, doing so would not protect your computer properly as they will conflict with each other. I suggest you uninstall Spybot search and destroy as your spyware doctor has an anti virus with it.

Please delete this folder: C:\MY DOCUMENTS\VIRUS SOFTWARE

–Next–

Let's do another MAlwarebytes' scan.
  • Open Malwarebytes.
  • Click on the Update tab.
  • Click Check for Updates button.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post back the log.
–Next–

Please run another DDS scan for me.

To post in your next reply:
1. Malwarebytes' log.
2. DDS logs.
Post #20
Inzanity was helping me with a virus issue. i was out of town last week and didn't respond in time. the post was closed, so opened this one to continue. actions taken as requested: Spybot S&D was uninstalled. C:\MY DOCUMENTS\VIRUS SOFTWARE folder was deleted MBAM and DDS were run. MBAM LOG.txt Malwarebytes' Anti-Malware 1.44 Database version: 3717 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 2/9/2010 7:35:09 PM mbam-log-2010-02-09 (19-35-09).txt Scan type: Quick Scan Objects scanned: 128974 Time elapsed: 11 minute(s), 34 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) DDS.txt DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 19:41:40.17 on Tue 02/09/2010 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.176 [GMT -7:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE svchost.exe C:\WINDOWS\System32\DVDRAMSV.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\00THotkey.exe C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\ltmoh\Ltmoh.exe C:\WINDOWS\system32\TPWRTRAY.EXE C:\Program Files\TOSHIBA\TouchED\TouchED.Exe C:\WINDOWS\system32\TFNF5.exe C:\toshiba\ivp\ism\pinger.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\EZSP_PX.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Java\jre6\bin\jucheck.exe C:\Documents and Settings\Bitten\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = hxxp://www.toshiba.com/ uInternet Settings,ProxyOverride = 127.0.0.1 uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [Google Update] "c:\documents and settings\bitten\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\NPSWF32_FlashUtil.exe -p mRun: [00THotkey] c:\windows\system32\00THotkey.exe mRun: [000StTHK] 000StTHK.exe mRun: [PmProxy] c:\program files\analog devices\soundmax\PmProxy.exe mRun: [Apoint] c:\program files\apoint2k\Apoint.exe mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe mRun: [Tpwrtray] TPWRTRAY.EXE mRun: [TouchED] c:\program files\toshiba\touched\TouchED.Exe mRun: [TFNF5] TFNF5.exe mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [ezShieldProtector for Px] c:\windows\system32\EZSP_PX.EXE mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [3170 Scan2PC] "c:\windows\twain_32\samsung\clx3170\Scan2pc.exe" IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL DPF: DirectAnimation Java Classes DPF: Microsoft XML Parser for Java DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1208719407125 DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177041749379 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177041738043 DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?39191.7537384259 DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\bitten\applic~1\mozilla\firefox\profiles\gtbanp75.default\ FF - prefs.js: browser.startup.homepage - google.com FF - plugin: c:\documents and settings\bitten\application data\mozilla\firefox\profiles\gtbanp75.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll FF - plugin: c:\documents and settings\bitten\application data\mozilla\plugins\npgoogletalk.dll FF - plugin: c:\documents and settings\bitten\local settings\application data\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\google updater\2.4.1739.5352\npCIDetect13.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R0 ALiAGP;ALi AGP Bus Filter Driver;c:\windows\system32\drivers\ALiAGP.SYS [2003-5-6 26880] R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968] R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\aliirda.sys [2003-5-6 26112] R3 tridxp;tridxp;c:\windows\system32\drivers\tridxpm.sys [2003-4-24 248448] S1 SASDIFSV;SASDIFSV;\??\e:\sas\sasdifsv.sys –> e:\sas\SASDIFSV.SYS [?] S1 SASKUTIL;SASKUTIL;\??\e:\sas\saskutil.sys –> e:\sas\SASKUTIL.sys [?] S2 gupdate1c9fac07a8f59d0;Google Update Service (gupdate1c9fac07a8f59d0);c:\program files\google\update\GoogleUpdate.exe [2009-7-1 133104] S2 mrtRate;mrtRate; [x] S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys –> c:\windows\system32\drivers\SSPORT.sys [?] S3 SASENUM;SASENUM;\??\e:\sas\sasenum.sys –> e:\sas\SASENUM.SYS [?] S3 wlags48b;Wireless LAN PCCard Driver;c:\windows\system32\drivers\wlags48b.sys [2003-5-6 156672] =============== Created Last 30 ================ 2010-01-27 06:42:13 1224 —-a-w- C:\CF-Submit.htm 2010-01-22 20:01:39 0 d—–w- c:\program files\ESET 2010-01-15 02:16:16 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll 2010-01-14 07:04:51 0 d-sha-r- C:\cmdcons 2010-01-14 07:03:13 98816 —-a-w- c:\windows\sed.exe 2010-01-14 07:03:13 77312 —-a-w- c:\windows\MBR.exe 2010-01-14 07:03:13 261632 —-a-w- c:\windows\PEV.exe 2010-01-14 07:03:13 161792 —-a-w- c:\windows\SWREG.exe ==================== Find3M ==================== 2010-01-07 21:07:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 21:07:04 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-01-05 10:00:29 832512 ——w- c:\windows\system32\wininet.dll 2010-01-05 10:00:21 78336 —-a-w- c:\windows\system32\ieencode.dll 2010-01-05 10:00:20 17408 ——w- c:\windows\system32\corpol.dll 2009-02-21 07:17:07 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009022120090222\index.dat ============= FINISH: 19:43:03.21 =============== ATTACH.txt UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-12-01.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume1 Install Date: 4/19/2007 9:52:21 PM System Uptime: 2/9/2010 7:10:47 PM (0 hours ago) Motherboard: TOSHIBA | | Portable PC Processor: Intel® Pentium® 4 CPU 3.06GHz | uFC-PGA Socket | 3055/133mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 56 GiB total, 18.731 GiB free. D: is CDROM (CDFS) ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP395: 10/24/2009 6:00:43 AM - Software Distribution Service 3.0 RP396: 10/26/2009 12:21:17 PM - Software Distribution Service 3.0 RP397: 10/26/2009 7:49:27 PM - Printer Driver Samsung CLX-3170 Series Installed RP398: 10/28/2009 12:15:29 PM - System Checkpoint RP399: 10/29/2009 6:00:48 AM - Software Distribution Service 3.0 RP400: 10/30/2009 11:01:58 AM - Software Distribution Service 3.0 RP401: 10/31/2009 9:34:12 AM - Software Distribution Service 3.0 RP402: 11/1/2009 12:21:06 PM - Removed BitDefender Free Edition v10 RP403: 11/1/2009 1:14:40 PM - Removed SUPERAntiSpyware Free Edition RP404: 11/2/2009 7:07:30 AM - Software Distribution Service 3.0 RP405: 11/2/2009 11:20:00 PM - Software Distribution Service 3.0 RP406: 11/3/2009 11:59:37 PM - Installed SUPERAntiSpyware Free Edition RP407: 11/4/2009 7:05:22 AM - Software Distribution Service 3.0 RP408: 11/6/2009 11:26:40 PM - System Checkpoint RP409: 11/7/2009 10:13:01 AM - Software Distribution Service 3.0 RP410: 11/8/2009 12:07:19 PM - Software Distribution Service 3.0 RP411: 11/10/2009 4:57:53 AM - Software Distribution Service 3.0 RP412: 11/10/2009 4:13:45 PM - Unsigned printer driver Samsung CLX-3170 Series installed. RP413: 11/11/2009 5:34:49 PM - System Checkpoint RP414: 11/12/2009 10:37:38 PM - System Checkpoint RP415: 11/17/2009 6:39:55 PM - Software Distribution Service 3.0 RP416: 11/18/2009 8:25:13 PM - Software Distribution Service 3.0 RP417: 11/18/2009 9:52:16 PM - Software Distribution Service 3.0 RP418: 11/21/2009 3:39:19 PM - System Checkpoint RP419: 11/27/2009 6:11:49 PM - Software Distribution Service 3.0 RP420: 12/1/2009 1:04:44 PM - Software Distribution Service 3.0 RP421: 12/5/2009 9:49:48 AM - System Checkpoint RP422: 12/6/2009 12:31:19 PM - Software Distribution Service 3.0 RP423: 12/6/2009 6:06:42 PM - Software Distribution Service 3.0 RP424: 12/8/2009 11:34:47 AM - System Checkpoint RP425: 12/9/2009 10:30:59 PM - System Checkpoint RP426: 12/10/2009 6:54:01 AM - Software Distribution Service 3.0 RP427: 1/10/2010 1:55:18 PM - System Checkpoint RP428: 1/11/2010 7:55:46 PM - Removed Apple Software Update RP429: 1/12/2010 8:14:48 AM - Software Distribution Service 3.0 RP430: 1/13/2010 11:56:07 PM - before whatthetech help RP431: 1/15/2010 6:24:59 PM - Software Distribution Service 3.0 RP432: 1/16/2010 10:35:16 AM - Software Distribution Service 3.0 RP433: 1/21/2010 12:33:30 PM - Software Distribution Service 3.0 RP434: 1/22/2010 12:02:02 PM - Software Distribution Service 3.0 RP435: 1/25/2010 1:00:10 PM - Software Distribution Service 3.0 RP436: 2/9/2010 6:55:16 PM - Software Distribution Service 3.0 ==== Installed Programs ====================== 7-Zip 4.65 AAC Decoder AC3Filter (remove only) Adobe Acrobat 5.0 Adobe Flash Player 10 Plugin Adobe Flash Player ActiveX Adobe Photoshop CS Advanced System Optimizer Advanced Uninstaller PRO - Version 9 AIM 6 ALi AGP Driver 2.00 Alps Pointing-device Driver Atheros Client Utility AutoCAD 2007 - English Autodesk DWF Viewer AutoUpdate BitDefender Free Edition v10 Choice Guard DivX Codec DivX Converter DivX Player DivX Plus DirectShow Filters DivX Version Checker DivX Web Player Drag'n Drop CD+DVD DVD-RAM Driver ERUNT 1.1j ESET Online Scanner v3 FileZilla Client [removed] Google Earth Google Talk Plugin Google Update Helper Google Updater H.264 Decoder Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) hp instant support hp officejet g series InterVideo WinDVD 4 Java™ 6 Update 15 Java™ 6 Update 2 Java™ 6 Update 3 Java™ 6 Update 7 Java™ SE Runtime Environment 6 Update 1 LimeWire 4.12.11 Macromedia Flash Player 8 Malwarebytes' Anti-Malware Managed DirectX (0900) Microsoft .NET Framework (English) Microsoft .NET Framework (English) v1.0.3705 Microsoft .NET Framework 1.0 Hotfix (KB928367) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Application Error Reporting Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Software Update for Web Folders (English) 12 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Works 7.0 MKV Splitter Mozilla Firefox (3.5.7) MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Notebook Maximizer Picasa 3 PokerStars PokerStove version 1.21 PurePlay Poker Quicken 2003 New User Edition QuickTime Samsung CLX-3170 Series Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB973704) Security Update for Microsoft Office Excel 2007 (KB973593) Security Update for Microsoft Office Outlook 2007 (KB972363) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Microsoft Office Publisher 2007 (KB969693) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB969613) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB969604) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Internet Explorer 7 (KB974455) Security Update for Windows Internet Explorer 7 (KB976325) Security Update for Windows Internet Explorer 7 (KB978207) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Segoe UI Skype™ 3.8 Software Suite SoundMAX SUPERAntiSpyware Free Edition TOSHIBA Access TOSHIBA ConfigFree TOSHIBA Console TOSHIBA Controls Toshiba Hotkey Utility for Display Devices TOSHIBA Power Saver Toshiba Registration TOSHIBA Software Modem TOSHIBA Software Upgrades Toshiba Tbiosdrv Driver TOSHIBA TouchPad On/Off Utility V2.05.00 TOSHIBA Utilities Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office InfoPath 2007 (KB976416) Update for Outlook 2007 Junk Email Filter (kb977839) Update for Windows Internet Explorer 7 (KB976749) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB961503) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) VC_MergeModuleToMSI VC80CRTRedist - 8.0.50727.762 Viewpoint Media Player Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Internet Explorer 7 Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Messenger Windows Live OneCare safety scanner Windows Live Sign-in Assistant Windows Live Upload Tool Windows XP Service Pack 3 ==== Event Viewer Messages From Past Week ======== 2/9/2010 6:57:36 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SASDIFSV SASKUTIL 2/9/2010 6:57:21 PM, error: Service Control Manager [7000] - The SSPORT service failed to start due to the following error: The system cannot find the file specified. 2/9/2010 6:57:21 PM, error: Service Control Manager [7000] - The mrtRate service failed to start due to the following error: The system cannot find the file specified. 2/9/2010 6:57:21 PM, error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the file specified. ==== End Of File ===========================
Post #21
Hi,

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
To post in your next reply:
1. Kaspersky log.
2. How is your computer?
Post #22
its running about the same as after the previous more recent fixes. much better than before, but still a distinct lag from where it once was. KAPERSKY.txt ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Thursday, February 11, 2010 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Thursday, February 11, 2010 03:35:24 Records in database: 3471956 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 81655 Threats found: 9 Infected objects found: 10 Suspicious objects found: 0 Scan duration: 04:18:11 File name / Threat / Threats count C:\Qoobox\Quarantine\[4]-Submit_2010-01-26_23.41.47.zip Infected: Trojan-PSW.Win32.LdPinch.ajmd 1 C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP435\A0109327.exe Infected: Trojan-PSW.Win32.LdPinch.ajmd 1 C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP435\A0109333.exe Infected: Backdoor.Win32.IRCBot.lff 1 C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP435\A0109333.exe Infected: Backdoor.Win32.IRCBot.lao 1 C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP435\A0109333.exe Infected: Backdoor.Win32.IRCBot.krx 1 C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP435\A0109333.exe Infected: Backdoor.Win32.IRCBot.mwo 1 C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP435\A0109333.exe Infected: Backdoor.Win32.IRCBot.mdm 1 C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP435\A0109333.exe Infected: Backdoor.Win32.IRCBot.mdl 1 C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP435\A0109333.exe Infected: Backdoor.Win32.IRCBot.lfe 1 C:\System Volume Information\_restore{BDA63D9D-E3C3-4638-918C-F0CFFCB25A85}\RP435\A0109333.exe Infected: Backdoor.Win32.IRCBot.lfk 1 Selected area has been scanned.
Post #23
Hi,

Those infections found are from your restore points. We will be removing them.

Please delete DDS, GMER, CKScanner and all the logs we've created.

You can keep Malwarebytes, it is an excellent malware removal tool. Update atleast once a week then run a complete scan.

–Next–

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

[external image: Posted Image]

–Next–

Enable TeaTimer:
  • Open Spybot Search & Destroy.
  • In the Mode menu click Advanced mode if not already selected.
  • Choose Yes at the Warning prompt.
  • Expand the Tools menu.
  • Click Resident.
  • Check the Resident TeaTimer (Protection of overall system settings) active. box.
  • In the File menu click Exit to exit Spybot Search & Destroy.
–Next–

Java
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

The latest update is Java 6 update 18

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon.
  • Under Temporary Internet Files, click the Settings… button
  • click the Delete Files button.
  • There are two options in the window to clear the cache - Leave both Checked
    Applications and Applets
    Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Settings
  • Click OK to leave the Java Control Panel.
To keep your operating system up to date visit
  • Secunia Software inspector to check your program update status.
  • Microsoft Windows Update .

Here are some tips to reduce the potential for spyware infection in the future:

1. It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.

2. Make your Internet Explorer More Secure
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.

    • Change the Download signed ActiveX controls to Prompt.
    • Change the Download unsigned ActiveX controls to Disable.
    • Change the Initialise and script ActiveX controls not marked as safe to Disable.
    • Change the Installation of desktop items to Prompt.
    • Change the Launching programs and files in an IFRAME to Prompt.
    • Change the Navigate sub-frames across different domains to Prompt.
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
3. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. SpywareBlaster - Download and install SpywareBlaster. This program prevents the installation of ActiveX-based spyware and other potentially unwanted programs.

8. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

9. Some excellent free firewalls. Note: Use only one firewall at a time.
Agnitum Outpost Firewall
Comodo Firewall - If you are installing this and already have an anti spyware then please do not install Comodo's anti spyware program.
Online Armor Personal Firewall

10. And finally, please read these excellent articles:
Malware: Help prevent the Infection by Sandi Hardmeier,
Preventing Malware - Tools and Practices for Safe Computing

For more safe computing tips please read the guide by Rorschach112 on how to prevent malware and about safe computing here.



Good luck, happy computing and stay clean! ^_^
Post #24
deleted DDS, GMER, CKScanner and all the logs. java updated. uninstalled combofix. as per your previous instructions, Spybot S&D was uninstalled, so i can't enable TeaTimer. should i reinstall it, or is there another you would recommend? i use Mozilla Firefox. any specific tips for this browser? installed: WinPatrol Spyware Blaster (also installed Spyware Guard) MVPS Hosts Windows Firewall is on. I should turn this off and choose one of those you listed? Will install Avast Antivirus, unless you have a better suggestion. thanks again for all of the help!
Post #25
Hi, Am seeing BitDefender installed on your system, no need to add more anti virus. You could uninstall BitDefender and go for Avast if you like. Just keep in mind to choose only one. You can reinstall Spybot as they don't conflict with your SuperAntispyware and has an Immunization feature that blocks a lot of bad sites.
Post #26
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI