What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Malware defense/ Rootkit.win32.agent.pp/ twunk_32.exe

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I stumbled onto this site last night after putting out some of the fires on this, but some issues are still lingering, like browser redirects, attempted popups or something(title bar for whatever I'm viewing goes grey) audio for ads playing in background with nothing visible. Before doing the steps posted in "Are you infected?" on this board, all I did was remove all program files and registry items associated with malware defense, rootkit.win32.agent.pp and twunk_32.exe. Anyway, here are the logs:

Malwarebytes

Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

1/14/2010 6:35:43 PM
mbam-log-2010-01-14 (18-35-43).txt

Scan type: Quick Scan
Objects scanned: 121904
Time elapsed: 4 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
\\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\UACd.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
\\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt\Local Settings\Temp\Installer.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt\Local Settings\Temp\twunk_32x.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt\Local Settings\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UACgrcixgiebn.db (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Matt\Desktop\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

——————————–

GMER

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-15 08:08:18
Windows 5.1.2600 Service Pack 3
Running: gspot.exe; Driver: C:\DOCUME~1\Matt\LOCALS~1\Temp\pxtdypow.sys


—- System - GMER 1.0.15 —-

Code 8AE48E38 ZwEnumerateKey
Code 8AE48460 ZwFlushInstructionCache
Code 8AE4914E IofCallDriver
Code 8AD5D79E IofCompleteRequest

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\iteatapi \Device\Scsi\iteatapi1Port3Path0Target3Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\iteatapi \Device\Scsi\iteatapi1 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\iteatapi \Device\Scsi\iteatapi1Port3Path0Target2Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\iteatapi \Device\Scsi\iteatapi1Port3Path0Target0Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

—- Modules - GMER 1.0.15 —-

Module \systemroot\system32\drivers\H8SRTblisenqvlw.sys (*** hidden *** ) B2126000-B2142000 (114688 bytes)
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [676] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1040] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1080] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1140] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1260] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1316] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1348] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\Program Files\Mozilla Firefox\firefox.exe [2176] 0x01080000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [2716] 0x00D50000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [3020] 0x00D50000
Library \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [3212] 0x00860000

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\H8SRTblisenqvlw.sys (*** hidden *** ) [SYSTEM] H8SRTd.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTblisenqvlw.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTblisenqvlw.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTsnolhypuhb.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTdwhxnrgrqo.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTwykmxduptn.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtmsg \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTtnotcppylq.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTblisenqvlw.sys
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTblisenqvlw.sys
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTsnolhypuhb.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTdwhxnrgrqo.dat
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTwykmxduptn.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtmsg \\?\globalroot\systemroot\system32\H8SRTilxwpkvsxp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTtnotcppylq.dll
Reg HKLM\SOFTWARE\Classes\.application\bootstrap@ bootstrap.application.1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\iexplore@Count 1224
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\iexplore@Count 2253
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\iexplore@Blocked 2253
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore@Count 1918
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore@Blocked 1918
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore@Count 2251
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore@Blocked 2251
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7E853D72-626A-48EC-A868-BA8D5E23E045}\iexplore@Count 2250
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9030D464-4C02-4ABF-8ECC-5164760863C6}\iexplore@Count 2253
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9030D464-4C02-4ABF-8ECC-5164760863C6}\iexplore@Blocked 2252
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{92780B25-18CC-41C8-B9BE-3C9C571A8263}\iexplore@Count 1918
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{92780B25-18CC-41C8-B9BE-3C9C571A8263}\iexplore@Blocked 1918
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore@Count 1918
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E2E2DD38-D088-4134-82B7-F2BA38496583}\iexplore@Blocked 1918
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore@Count 1918
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB5F1910-F110-11D2-BB9E-00C04F795683}\iexplore@Blocked 1918

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\drivers\H8SRTblisenqvlw.sys 39936 bytes executable <– ROOTKIT !!!
File C:\WINDOWS\system32\H8SRTdwhxnrgrqo.dat 241 bytes
File C:\WINDOWS\system32\H8SRTilxwpkvsxp.dll 16896 bytes executable
File C:\WINDOWS\system32\h8srtkrl32mainweq.dll 1149 bytes
File C:\WINDOWS\system32\h8srtshsyst.dll 1048 bytes
File C:\WINDOWS\system32\H8SRTsnolhypuhb.dll 23040 bytes executable
File C:\WINDOWS\system32\H8SRTtnotcppylq.dll 40960 bytes executable
File C:\WINDOWS\system32\H8SRTwykmxduptn.dll 36864 bytes executable
File C:\WINDOWS\temp\H8SRT5bf6.tmp 241 bytes
File C:\Documents and Settings\Matt\Local Settings\Temp\H8SRT206b.tmp 343040 bytes executable
File C:\Documents and Settings\Matt\Local Settings\Temp\h8srtmainqt.dll 16368 bytes

—- EOF - GMER 1.0.15 —-

DDS


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 8:10:03.76 on Fri 01/15/2010
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3199.2504 [GMT -8:00]

AV: Malware Defense *On-access scanning enabled* (Outdated) {28e00e3b-806e-4533-925c-f4c3d79514b9}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\ALCMTR.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
svchost.exe
D:\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Matt\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src;={referrer:source?}
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [NVIDIA nTune] "c:\program files\nvidia corporation\ntune\nTuneCmd.exe" clear
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe"
mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [UpdReg] c:\windows\Updreg.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [Alcmtr] ALCMTR.EXE
mRun: [AGEIA PhysX SysTray] c:\program files\ageia technologies\TrayIcon.exe
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
StartupFolder: c:\docume~1\matt\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\msn toolbar suite\ds\02.05.0001.1119\en-us\bin\WindowsSearch.exe
uPolicies-explorer: =
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
Trusted Zone: line6.net
DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} - hxxp://simcity.ea.com/update/EARTPX.cab
DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} - hxxp://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
DPF: {CE74A05D-ED12-473A-97F8-85FB0E2F479F} - hxxp://www.livemetallica.com/nugster/dlControl.CAB
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-1 64160]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-6-27 213640]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\cyberlink\powerdvd\000.fcl [2006-11-2 13560]
S1 ntiomin;ntiomin; [x]
S3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);c:\windows\system32\drivers\e10kx2k.sys –> c:\windows\system32\drivers\e10kx2k.sys [?]
S3 L6PODX3LV;POD X3 Live Service;c:\windows\system32\drivers\L6PODX3LV.sys [2008-8-20 521472]
S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-1-18 79304]
S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-1-18 35272]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-1-18 34216]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-1-18 40552]
S3 rootrepeal;rootrepeal;\??\c:\windows\system32\drivers\rootrepeal.sys –> c:\windows\system32\drivers\rootrepeal.sys [?]

=============== Created Last 30 ================

2010-01-14 18:09 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-01 06:44 –d—– c:\documents and settings\matt\logitech
2010-01-01 06:44 –d—– c:\program files\common files\Remote Control Software Common
2010-01-01 06:43 –d—– c:\program files\common files\Remote Control USB Driver
2009-12-27 05:37 –d—– c:\docume~1\alluse~1\applic~1\espionServerData
2009-12-24 19:22 –d—– c:\program files\common files\Macrovision Shared
2009-12-21 19:00 –d—– c:\program files\HD Tune

==================== Find3M ====================

2008-12-13 22:10 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008121320081214\index.dat

============= FINISH: 8:18:09.96 ===============

Thanks in advance for your help

-Matthew
Post #2 last edited
Hello rock4ever and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instruction I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.This may cause a delay, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.
Post #3
matthew,

🖼Click to load external image (Posted Image) You are infected with a rootkit. While we may be able to remove it there are some very important things you should consider:

Rootkits and Backdoor Trojans are very dangerous because they use advanced techniques (backdoors) as a means of accessing a computer system that bypasses security mechanisms and steal sensitive information which they send back to the hacker. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Remote attackers use backdoor Trojans and rootkits as part of an exploit to gain unauthorized access to a computer and take control of it without your knowledge.

If your computer was used for online banking, has credit card information or other sensitive data on it, you should immediately disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromisedY. You should change each password by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connect again. Banking and credit card institutions should be notified of the possible security breach. Because your computer was compromised please read How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Include the following in your next post:
  • ComboFix log
  • The attach.txt log from DDS
  • Let me know how your computer is running
Post #4
Hello! Everything seems to be working great now! Thanks!

combofix log

ComboFix 10-01-15.01 - Matt 01/15/2010 14:10:05.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3199.2785 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\hocuspocus.exe
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Matt\Application Data\inst.exe
c:\documents and settings\Matt\My Documents\reg.reg
c:\windows\EventSystem.log
c:\windows\jestertb.dll
c:\windows\system32\Data
c:\windows\system32\drivers\H8SRTblisenqvlw.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\H8SRTdwhxnrgrqo.dat
c:\windows\system32\H8SRTilxwpkvsxp.dll
c:\windows\system32\h8srtkrl32mainweq.dll
c:\windows\system32\h8srtshsyst.dll
c:\windows\system32\H8SRTsnolhypuhb.dll
c:\windows\system32\H8SRTtnotcppylq.dll
c:\windows\system32\H8SRTwykmxduptn.dll
c:\windows\system32\open.ico
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_H8SRTd.sys
——-\Legacy_H8SRTd.sys


((((((((((((((((((((((((( Files Created from 2009-12-15 to 2010-01-15 )))))))))))))))))))))))))))))))
.

2010-01-15 02:09 . 2010-01-08 00:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-15 02:09 . 2010-01-15 02:35 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-15 02:09 . 2010-01-08 00:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-15 02:07 . 2010-01-15 02:07 ——– d—–w- c:\program files\ERUNT
2010-01-13 01:13 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-02 14:46 . 2010-01-11 00:58 162112 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-01 14:44 . 2010-01-01 14:47 ——– d—–w- c:\documents and settings\Matt\logitech
2010-01-01 14:44 . 2010-01-01 14:47 ——– d—–w- c:\program files\Common Files\Remote Control Software Common
2010-01-01 14:43 . 2010-01-01 14:43 ——– d—–w- c:\program files\Common Files\Remote Control USB Driver
2009-12-30 12:32 . 2009-12-30 12:32 ——– d—–w- c:\documents and settings\NetworkService\Application Data\DivX
2009-12-27 13:38 . 2009-12-27 13:38 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-12-27 13:37 . 2009-12-27 13:37 ——– d—–w- c:\documents and settings\All Users\Application Data\espionServerData
2009-12-25 03:23 . 2009-12-25 03:23 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-12-25 03:22 . 2009-12-25 03:22 ——– d—–w- c:\program files\Common Files\Macrovision Shared
2009-12-22 03:00 . 2009-12-22 03:00 ——– d—–w- c:\program files\HD Tune

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-15 16:55 . 2007-04-08 05:13 ——– d—–w- c:\documents and settings\All Users\Application Data\WinZip
2010-01-14 14:19 . 2007-12-31 03:45 ——– d—–w- c:\program files\Java
2010-01-14 05:46 . 2009-08-02 02:43 ——– d—–w- c:\program files\AVG
2010-01-14 05:46 . 2009-04-08 21:41 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-01-14 05:33 . 2007-04-08 14:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-14 05:27 . 2009-06-03 05:13 ——– d—–w- c:\program files\Linksys
2010-01-13 05:47 . 2007-05-01 23:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-13 05:19 . 2007-05-25 01:30 ——– d—–w- c:\documents and settings\Matt\Application Data\uTorrent
2010-01-01 14:44 . 2007-12-12 01:53 ——– d—–w- c:\program files\Logitech
2010-01-01 14:43 . 2005-08-27 13:55 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-27 13:36 . 2005-08-27 12:05 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-25 13:37 . 2005-09-14 12:58 69864 -c–a-w- c:\documents and settings\Matt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-25 13:37 . 2009-09-18 01:39 55620 —ha-w- c:\windows\system32\mlfcache.dat
2009-12-14 19:15 . 2009-12-14 19:15 2146304 —-a-w- c:\windows\system32\GPhotos.scr
2009-12-03 15:56 . 2007-07-26 01:34 ——– d—–w- c:\program files\Google
2009-11-28 01:54 . 2009-11-28 01:54 ——– d—–w- c:\documents and settings\Matt\Application Data\Canon
2009-11-28 01:37 . 2009-11-28 01:34 ——– d—–w- c:\program files\Canon
2009-11-28 01:36 . 2009-11-28 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-11-28 01:33 . 2009-11-28 01:33 ——– d—–w- c:\program files\Common Files\Canon
2009-11-22 14:44 . 2009-07-25 03:50 ——– d—–w- c:\program files\itunes
2009-11-22 14:43 . 2005-09-20 13:14 ——– d—–w- c:\program files\iPod
2009-11-22 14:43 . 2007-07-01 02:36 ——– d—–w- c:\program files\Common Files\Apple
2009-11-22 14:40 . 2009-11-22 14:39 ——– d—–w- c:\program files\QuickTime
2009-11-21 15:51 . 2004-08-04 12:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-13 22:57 . 2009-11-13 22:57 922112 ——w- c:\windows\system32\imapi2fs.dll
2009-11-13 22:57 . 2009-11-13 22:57 426496 ——w- c:\windows\system32\imapi2.dll
2009-10-29 07:46 . 2004-08-04 12:00 832512 —-a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2004-08-04 12:00 17408 —-a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2004-08-04 12:00 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 12:00 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 12:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 1687824]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-18 2094352]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-13 141600]
"RTHDCPL"="RTHDCPL.EXE" [2005-04-26 14370816]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 71216]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-28 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-28 13918208]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

c:\documents and settings\Matt\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 22:51 177440 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-02-07 23:21 54832 —-a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2007-01-19 19:54 5674352 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 07:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-01-14 04:46 1217808 —-a-w- c:\program files\Valve\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-27 02:27 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2006-10-24 04:15 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Valve\\Steam\\Steam.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\Sierra\\FEAR\\FEAR.exe"=
"d:\\Sierra\\FEAR\\FEARMP.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\utorrent\\utorrent.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"d:\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"d:\\Dragon Age\\bin_ship\\daorigins.exe"=
"d:\\Dragon Age\\DAOriginsLauncher.exe"=
"d:\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\itunes\\iTunes.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader
"6881:TCP"= 6881:TCP:WOW
"6999:TCP"= 6999:TCP:WOW
"67:UDP"= 67:UDP:DHCP Discovery Service

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/1/2009 5:10 PM 64160]
R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;d:\adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [9/6/2009 6:06 AM 169312]
S1 ntiomin;ntiomin; [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 6:49 AM 1028432]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\dragon age\bin_ship\daupdatersvc.service.exe [11/3/2009 6:31 PM 25832]
S3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);c:\windows\system32\drivers\e10kx2k.sys –> c:\windows\system32\drivers\e10kx2k.sys [?]
S3 L6PODX3LV;POD X3 Live Service;c:\windows\system32\drivers\L6PODX3LV.sys [8/20/2008 6:43 PM 521472]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a9556122-2479-11de-b39d-806d6172696f}]
\Shell\AutoRun\command - E:\discnav.exe
.
Contents of the 'Scheduled Tasks' folder

2010-01-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 05:05]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src;={referrer:source?}
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
Trusted Zone: line6.net
FF - ProfilePath - c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\7kalu2o1.default\
FF - plugin: c:\program files\Canon\ZoomBrowser EX\Program\NPCIG.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-NVIDIA nTune - c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe
HKLM-Run-UpdReg - c:\windows\Updreg.exe
HKLM-Run-nwiz - nwiz.exe
HKLM-Run-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
HKLM-Run-AGEIA PhysX SysTray - c:\program files\AGEIA Technologies\TrayIcon.exe
MSConfigStartUp-BDAgent - c:\program files\Softwin\BitDefender10\bdagent.exe
MSConfigStartUp-BDMCon - c:\program files\Softwin\BitDefender10\bdmcon.exe
MSConfigStartUp-EasyLinkAdvisor - c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe
MSConfigStartUp-Jet Detection - c:\program files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
MSConfigStartUp-mcagent_exe - c:\program files\McAfee.com\Agent\mcagent.exe
MSConfigStartUp-Taskbar - c:\program files\Creative\SBAudigy\Taskbar\CTLTask.exe
MSConfigStartUp-TaskTray - c:\program files\Creative\SBAudigy\Taskbar\CTLTray.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
AddRemove-NVIDIA nView Desktop Manager - c:\program files\NVIDIA Corporation\nView\nViewSetup.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 14:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
@DACL=(02 0000)
@="bootstrap.application.1"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1428)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
c:\program files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
c:\windows\system32\MsPMSPSv.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-01-15 14:29:52 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-15 22:29

Pre-Run: 6,571,429,888 bytes free
Post-Run: 7,966,375,936 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - E40FC72D947261FC893494A0320D6448


attach.txt log

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 8/27/2005 4:02:24 AM
System Uptime: 1/14/2010 6:44:10 PM (14 hours ago)

Motherboard: ASUSTeK Computer INC. | | P5LD2
Processor: Intel® Pentium® 4 CPU 3.20GHz | Socket 775 | 3211/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 98 GiB total, 6.384 GiB free.
D: is FIXED (NTFS) - 89 GiB total, 8.022 GiB free.
E: is CDROM (UDF)
F: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================


==== End Of File ===========================
Post #5
Matthew,

I'm glad to hear that your running better, but we still have some work to do. Hang in there with me:

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner Note: Depending on your computer this could take more than an hour to run. Please be patient.

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
🖼Click to load external image (Posted Image) Install an anti-virus program. I don't see any anti-virus software running on your computer. Choose one, (but no more) reputable AV program. If you need help chosing one, this site has good information. Avast, AVG, Avira and Microsoft all offer free AV products.

🖼Click to load external image (Posted Image) P2P - I see you have P2P software (uTorrent) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.
If you choose to keep these applications, please do not use them until our fixes at WTT are complete.

Please include the following in your next post:
  • MBAM log
  • Kaspersky log
Post #6
mbam log Malwarebytes' Anti-Malware 1.44 Database version: 3573 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.11 1/15/2010 7:17:51 PM mbam-log-2010-01-15 (19-17-51).txt Scan type: Quick Scan Objects scanned: 120510 Time elapsed: 3 minute(s), 45 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) kaspersky log KASPERSKY ONLINE SCANNER 7.0: scan report Saturday, January 16, 2010 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Saturday, January 16, 2010 03:43:44 Records in database: 3319121 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ Scan statistics: Objects scanned: 144165 Threats found: 7 Infected objects found: 14 Suspicious objects found: 0 Scan duration: 02:08:32 File name / Threat / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0D157974.dll Infected: Trojan.Win32.Puper.bp 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\19A223AB.dll Infected: Trojan.Win32.Puper.bp 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\19A54DA7.dll Infected: Trojan.Win32.Puper.bp 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1BDA7EFF.dll Infected: Trojan.Win32.Puper.bp 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52DE5773.dll Infected: Trojan.Win32.Puper.bp 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\594A6141.dll Infected: Trojan.Win32.Puper.bp 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5C775893.exe Infected: Trojan.Win32.Dialer.ay 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\60FB679A.exe Infected: Trojan-Downloader.Win32.Small.ayl 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\61080F8C.exe Infected: not-a-virus:FraudTool.Win32.SpySheriff.d 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\653920C1.dll Infected: Trojan.Win32.Puper.bp 1 C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\16\78fcee10-5e710ca1 Infected: Trojan-Downloader.Java.OpenConnection.at 1 C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\49\6b800f31-2161cffa Infected: Trojan-Downloader.Java.OpenConnection.at 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTilxwpkvsxp.dll.vir Infected: Trojan.Win32.Tdss.avig 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTsnolhypuhb.dll.vir Infected: Packed.Win32.TDSS.aa 1 Selected area has been scanned.
Post #7
Matthew,

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\16\78fcee10-5e710ca1
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\49\6b800f31-2161cffa

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with fresh logs from DDS.

Please include the following in your next post:
  • CombFix log
  • New DDS logs (DDS.txt and Attach.txt)
Post #8 last edited
I try to install free version of avg and get the following message Local machine: installation failed Installation: Error: Action failed for registry value HKLM\SOFTWARE\Classes\AvgDiagExFile\DefaultIcon:: creating registry value…. Access is denied. Also, I created the CFScript file and dragged it into combofix. It had to update 1st, then it started to run. Combofix self-aborted and posted some blue screen of death like message that I wasn't able to get down on paper. Please advise.
Post #9 last edited
Matthew,

I've seen traces of Norton, McAfee and AVG in your logs. It is fairly common for different antivirus products to conflict with each other. My advice at this point would be to completely remove them all with the vendors removal tools, then choose one to reinstall. Here are links to the removal tools:
Here are the links to the free AV programs if you need them again: Avast, AVG, Avira and Microsoft all offer free AV products.

How long did ComboFix run before it crashed? Did it generate a log? If it did, please post it. It would be: C:\combofix.txt

🖼Click to load external image (Posted Image) Click Start>Run and copy/paste the following bolded text into the Run box and click OK:

C:\Qoobox\ComboFix-quarantined-files.txt

A report should pop open for you. Please post the contents in your next reply.

🖼Click to load external image (Posted Image) Clear your Java cache:

  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
Please include the following in your next post:
  • Answer my questions about the ComboFix run that crashed
  • ComboFix log(s)
  • Fresh DDS logs (DDS.txt and Attach.txt)
  • How is your computer running?
Post #10
I ran combofix again, and it worked. On the previous run, it didn't take long to crash at all. I dont think it made it to the update stage 1. Also I did not use the 3 links for the various av programs yet. I did delete the files out of the applications data folder. I've no idea what version of norton I had so figuring out which link to use for removal was problematic. PC is displaying no symptoms of trouble right now. I am not experiencing any background ad audio, browser redirects or popup attempts, that I had before coming here. Anyway- the logs Combofix ComboFix 10-01-16.01 - Matt 01/16/2010 15:25:28.2.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3199.2756 [GMT -8:00] Running from: c:\documents and settings\[removed]\Desktop\hocuspocus.exe Command switches used :: c:\documents and settings\Matt\Desktop\CFScript.txt FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E} FILE :: "c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\16\78fcee10-5e710ca1" "c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\49\6b800f31-2161cffa" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\16\78fcee10-5e710ca1 c:\documents and settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\49\6b800f31-2161cffa . ((((((((((((((((((((((((( Files Created from 2009-12-16 to 2010-01-16 ))))))))))))))))))))))))))))))) . 2010-01-16 20:01 . 2010-01-16 20:01 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache 2010-01-16 19:52 . 2010-01-16 19:52 ——– d-sh–w- c:\documents and settings\Matt\IETldCache 2010-01-16 19:50 . 2009-10-29 07:45 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll 2010-01-16 19:50 . 2009-10-29 07:45 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll 2010-01-16 19:50 . 2010-01-16 19:50 ——– d—–w- c:\windows\ie8updates 2010-01-16 19:50 . 2009-10-02 04:44 92160 -c—-w- c:\windows\system32\dllcache\iecompat.dll 2010-01-16 19:49 . 2010-01-16 19:49 ——– dc-h–w- c:\windows\ie8 2010-01-16 03:20 . 2010-01-16 03:20 411368 —-a-w- c:\windows\system32\deploytk.dll 2010-01-16 03:20 . 2010-01-16 03:20 152576 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\jre1.6.0_17\lzma.dll 2010-01-16 03:19 . 2010-01-16 03:19 79488 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2010-01-15 02:09 . 2010-01-08 00:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-15 02:09 . 2010-01-15 02:35 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-01-15 02:09 . 2010-01-08 00:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-01-15 02:07 . 2010-01-15 02:07 ——– d—–w- c:\program files\ERUNT 2010-01-13 01:13 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll 2010-01-02 14:46 . 2010-01-11 00:58 162112 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2010-01-01 14:44 . 2010-01-01 14:47 ——– d—–w- c:\documents and settings\Matt\logitech 2010-01-01 14:44 . 2010-01-01 14:47 ——– d—–w- c:\program files\Common Files\Remote Control Software Common 2010-01-01 14:43 . 2010-01-01 14:43 ——– d—–w- c:\program files\Common Files\Remote Control USB Driver 2009-12-30 12:32 . 2009-12-30 12:32 ——– d—–w- c:\documents and settings\NetworkService\Application Data\DivX 2009-12-27 13:38 . 2009-12-27 13:38 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet 2009-12-27 13:37 . 2009-12-27 13:37 ——– d—–w- c:\documents and settings\All Users\Application Data\espionServerData 2009-12-25 03:23 . 2009-12-25 03:22 38208 —-a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2009-12-25 03:23 . 2009-12-25 03:23 ——– d—–w- c:\program files\Common Files\Adobe AIR 2009-12-25 03:22 . 2009-12-25 03:22 ——– d—–w- c:\program files\Common Files\Macrovision Shared 2009-12-22 03:00 . 2009-12-22 03:00 ——– d—–w- c:\program files\HD Tune . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-16 19:19 . 2009-04-08 21:41 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8 2010-01-16 03:20 . 2007-12-31 03:45 ——– d—–w- c:\program files\Java 2010-01-15 16:55 . 2007-04-08 05:13 ——– d—–w- c:\documents and settings\All Users\Application Data\WinZip 2010-01-14 05:33 . 2007-04-08 14:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-01-14 05:27 . 2009-06-03 05:13 ——– d—–w- c:\program files\Linksys 2010-01-13 05:47 . 2007-05-01 23:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-01-13 05:19 . 2007-05-25 01:30 ——– d—–w- c:\documents and settings\Matt\Application Data\uTorrent 2010-01-01 14:44 . 2007-12-12 01:53 ——– d—–w- c:\program files\Logitech 2010-01-01 14:43 . 2005-08-27 13:55 ——– d–h–w- c:\program files\InstallShield Installation Information 2009-12-27 13:36 . 2005-08-27 12:05 ——– d—–w- c:\program files\Common Files\Adobe 2009-12-25 13:37 . 2005-09-14 12:58 69864 -c–a-w- c:\documents and settings\Matt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-12-25 13:37 . 2009-09-18 01:39 55620 —ha-w- c:\windows\system32\mlfcache.dat 2009-12-23 17:45 . 2009-12-04 17:19 2066200 —-a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll 2009-12-14 19:15 . 2009-12-14 19:15 2146304 —-a-w- c:\windows\system32\GPhotos.scr 2009-12-03 15:56 . 2007-07-26 01:34 ——– d—–w- c:\program files\Google 2009-11-28 01:54 . 2009-11-28 01:54 ——– d—–w- c:\documents and settings\Matt\Application Data\Canon 2009-11-28 01:37 . 2009-11-28 01:34 ——– d—–w- c:\program files\Canon 2009-11-28 01:36 . 2009-11-28 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\ZoomBrowser 2009-11-28 01:33 . 2009-11-28 01:33 ——– d—–w- c:\program files\Common Files\Canon 2009-11-22 14:44 . 2009-07-25 03:50 ——– d—–w- c:\program files\itunes 2009-11-22 14:43 . 2005-09-20 13:14 ——– d—–w- c:\program files\iPod 2009-11-22 14:43 . 2007-07-01 02:36 ——– d—–w- c:\program files\Common Files\Apple 2009-11-22 14:40 . 2009-11-22 14:39 ——– d—–w- c:\program files\QuickTime 2009-11-22 14:36 . 2009-11-22 14:36 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe 2009-11-21 15:51 . 2004-08-04 12:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll 2009-11-13 22:57 . 2009-11-13 22:57 922112 ——w- c:\windows\system32\imapi2fs.dll 2009-11-13 22:57 . 2009-11-13 22:57 426496 ——w- c:\windows\system32\imapi2.dll 2009-10-29 07:45 . 2004-08-04 12:00 916480 —-a-w- c:\windows\system32\wininet.dll 2009-10-21 05:38 . 2004-08-04 12:00 75776 —-a-w- c:\windows\system32\strmfilt.dll 2009-10-21 05:38 . 2004-08-04 12:00 25088 —-a-w- c:\windows\system32\httpapi.dll 2009-10-20 16:20 . 2004-08-04 12:00 265728 —-a-w- c:\windows\system32\drivers\http.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 1687824] "Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-18 2094352] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-13 141600] "RTHDCPL"="RTHDCPL.EXE" [2005-04-26 14370816] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 71216] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-28 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-28 13918208] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-16 149280] c:\documents and settings\Matt\Start Menu\Programs\Startup\ ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2009-08-13 22:51 177440 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] 2007-02-07 23:21 54832 —-a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] 2007-01-19 19:54 5674352 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-11-11 07:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] 2010-01-14 04:46 1217808 —-a-w- c:\program files\Valve\Steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-07-27 02:27 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] 2006-10-24 04:15 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Valve\\Steam\\Steam.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"= "c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"= "c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"= "c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "d:\\Sierra\\FEAR\\FEAR.exe"= "d:\\Sierra\\FEAR\\FEARMP.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\utorrent\\utorrent.exe"= "c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"= "c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"= "d:\\World of Warcraft\\BackgroundDownloader.exe"= "c:\\Program Files\\Ventrilo\\Ventrilo.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "%windir%\\system32\\drivers\\svchost.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"= "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"= "d:\\Dragon Age\\bin_ship\\daorigins.exe"= "d:\\Dragon Age\\DAOriginsLauncher.exe"= "d:\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"= "c:\\Program Files\\itunes\\iTunes.exe"= "c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader "6112:TCP"= 6112:TCP:Blizzard Downloader "6881:TCP"= 6881:TCP:WOW "6999:TCP"= 6999:TCP:WOW "67:UDP"= 67:UDP:DHCP Discovery Service R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/1/2009 5:10 PM 64160] R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;d:\adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [9/6/2009 6:06 AM 169312] S1 ntiomin;ntiomin; [x] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 6:49 AM 1028432] S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\dragon age\bin_ship\daupdatersvc.service.exe [11/3/2009 6:31 PM 25832] S3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);c:\windows\system32\drivers\e10kx2k.sys –> c:\windows\system32\drivers\e10kx2k.sys [?] S3 L6PODX3LV;POD X3 Live Service;c:\windows\system32\drivers\L6PODX3LV.sys [8/20/2008 6:43 PM 521472] . Contents of the 'Scheduled Tasks' folder 2010-01-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 05:05] . . ——- Supplementary Scan ——- . uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src;={referrer:source?} uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200 Trusted Zone: line6.net FF - ProfilePath - c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\7kalu2o1.default\ FF - plugin: c:\program files\Canon\ZoomBrowser EX\Program\NPCIG.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap] @DACL=(02 0000) @="bootstrap.application.1" . Completion time: 2010-01-16 15:33:11 ComboFix-quarantined-files.txt 2010-01-16 23:33 ComboFix2.txt 2010-01-15 22:29 Pre-Run: 6,884,950,016 bytes free Post-Run: 7,384,842,240 bytes free - - End Of File - - 9945C40141FF75F49F8D440622417F89 dds log DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 15:20:15.17 on Sat 01/16/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3199.2709 [GMT -8:00] FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E} ============== Running Processes =============== C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe C:\WINDOWS\system32\ctfmon.exe svchost.exe D:\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Matt\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src;={referrer:source?} uInternet Settings,ProxyOverride = *.local BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe" mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe" mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k StartupFolder: c:\docume~1\matt\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\msn toolbar suite\ds\02.05.0001.1119\en-us\bin\WindowsSearch.exe uPolicies-explorer: = IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL Trusted Zone: line6.net DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} - hxxp://simcity.ea.com/update/EARTPX.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} - hxxp://simcity.ea.com/update/MaxisSimCity4PatcherX.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CE74A05D-ED12-473A-97F8-85FB0E2F479F} - hxxp://www.livemetallica.com/nugster/dlControl.CAB DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\matt\applic~1\mozilla\firefox\profiles\7kalu2o1.default\ FF - plugin: c:\program files\canon\zoombrowser ex\program\NPCIG.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-1 64160] R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-6-27 213640] R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\cyberlink\powerdvd\000.fcl [2006-11-2 13560] R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;d:\adobe\elements organizer 8.0\PhotoshopElementsFileAgent.exe [2009-9-6 169312] S1 ntiomin;ntiomin; [x] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432] S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\dragon age\bin_ship\daupdatersvc.service.exe [2009-11-3 25832] S3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);c:\windows\system32\drivers\e10kx2k.sys –> c:\windows\system32\drivers\e10kx2k.sys [?] S3 L6PODX3LV;POD X3 Live Service;c:\windows\system32\drivers\L6PODX3LV.sys [2008-8-20 521472] S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-1-18 79304] S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-1-18 35272] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-1-18 34216] S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-1-18 40552] =============== Created Last 30 ================ 2010-01-16 11:52 –dsh— c:\documents and settings\matt\IETldCache 2010-01-16 11:50 246,272 -c—— c:\windows\system32\dllcache\ieproxy.dll 2010-01-16 11:50 12,800 -c—— c:\windows\system32\dllcache\xpshims.dll 2010-01-16 11:50 –d—– c:\windows\ie8updates 2010-01-16 11:50 92,160 -c—— c:\windows\system32\dllcache\iecompat.dll 2010-01-16 11:49 -cd-h— c:\windows\ie8 2010-01-16 11:28 –ds—- C:\hocuspocus 2010-01-15 19:20 411,368 a——- c:\windows\system32\deploytk.dll 2010-01-15 19:20 73,728 a——- c:\windows\system32\javacpl.cpl 2010-01-15 14:00 a-dshr– C:\cmdcons 2010-01-15 13:57 261,632 a——- c:\windows\PEV.exe 2010-01-15 13:57 161,792 a——- c:\windows\SWREG.exe 2010-01-15 13:57 98,816 a——- c:\windows\sed.exe 2010-01-15 13:57 77,312 a——- c:\windows\MBR.exe 2010-01-14 18:09 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-14 18:09 19,160 a——- c:\windows\system32\drivers\mbam.sys 2010-01-14 18:09 –d—– c:\program files\Malwarebytes' Anti-Malware 2010-01-12 17:13 471,552 -c—— c:\windows\system32\dllcache\aclayers.dll 2010-01-01 06:44 –d—– c:\documents and settings\matt\logitech 2010-01-01 06:44 –d—– c:\program files\common files\Remote Control Software Common 2010-01-01 06:43 –d—– c:\program files\common files\Remote Control USB Driver 2009-12-27 05:37 –d—– c:\docume~1\alluse~1\applic~1\espionServerData 2009-12-24 19:22 –d—– c:\program files\common files\Macrovision Shared 2009-12-21 19:00 –d—– c:\program files\HD Tune ==================== Find3M ==================== 2009-12-25 05:37 55,620 a—h— c:\windows\system32\mlfcache.dat 2009-12-14 11:15 2,146,304 a——- c:\windows\system32\GPhotos.scr 2009-11-21 07:51 471,552 a——- c:\windows\apppatch\aclayers.dll 2009-11-13 14:57 922,112 ——– c:\windows\system32\imapi2fs.dll 2009-11-13 14:57 426,496 ——– c:\windows\system32\imapi2.dll 2009-10-28 23:45 916,480 a——- c:\windows\system32\wininet.dll 2009-10-20 21:38 75,776 a——- c:\windows\system32\strmfilt.dll 2009-10-20 21:38 25,088 a——- c:\windows\system32\httpapi.dll 2007-12-19 04:18 47,360 a——- c:\docume~1\matt\applic~1\pcouffin.sys 2008-12-13 22:10 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008121320081214\index.dat ============= FINISH: 15:20:46.71 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume1 Install Date: 8/27/2005 4:02:24 AM System Uptime: 1/16/2010 11:52:16 AM (4 hours ago) Motherboard: ASUSTeK Computer INC. | | P5LD2 Processor: Intel® Pentium® 4 CPU 3.20GHz | Socket 775 | 3211/200mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (NTFS) - 98 GiB total, 6.401 GiB free. D: is FIXED (NTFS) - 89 GiB total, 8.022 GiB free. E: is CDROM (UDF) F: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP1: 1/15/2010 4:39:01 PM - System Checkpoint RP2: 1/15/2010 7:20:12 PM - Installed Java™ 6 Update 17 RP3: 1/16/2010 3:00:18 AM - Software Distribution Service 3.0 RP4: 1/16/2010 11:16:13 AM - Installed AVG 9.0 RP5: 1/16/2010 11:20:59 AM - Installed AVG 9.0 RP6: 1/16/2010 11:46:52 AM - Software Distribution Service 3.0 RP7: 1/16/2010 11:57:25 AM - Software Distribution Service 3.0 ==== Installed Programs ====================== Ad-Aware Adobe Acrobat 5.0 Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Flash Player 9 ActiveX Adobe Photoshop Elements 8.0 Adobe Photoshop.com Inspiration Browser Adobe Reader 7.1.0 AhaView Apple Application Support Apple Mobile Device Support Apple Software Update ASUS nVIDIA Driver AsusUpdate AutoUpdate Avex DVD to iPod Converter (remove only) Bonjour Canon Camera Access Library Canon Camera Support Core Library CANON iMAGE GATEWAY Task for ZoomBrowser EX Canon Internet Library for ZoomBrowser EX Canon MOV Decoder Canon MOV Encoder Canon MovieEdit Task for ZoomBrowser EX Canon Utilities CameraWindow Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX Canon Utilities Digital Photo Professional 3.6 Canon Utilities EOS Utility Canon Utilities MyCamera Canon Utilities Original Data Security Tools Canon Utilities PhotoStitch Canon Utilities Picture Style Editor Canon Utilities RemoteCapture Task for ZoomBrowser EX Canon Utilities WFT-E1/E2/E3/E4 Utility Canon Utilities ZoomBrowser EX Canon ZoomBrowser EX Memory Card Utility Critical Update for Windows Media Player 11 (KB959772) dBpoweramp FLAC Codec dBpoweramp Music Converter DivX Converter DivX Player DivX Web Player Dragon Age: Origins DVD Decrypter (Remove Only) DVD Shrink 3.2 DVDFab Platinum 4.0.1.2 ERUNT 1.1j FEAR Fraps GameSpy Arcade Ghost Recon Advanced Warfighter Guitar Pro 5.2 Half-Life® 2 HD Tune 2.55 Hero Editor V0.96 High Definition Audio Driver Package - KB888111 HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Intel A/V Codecs V2.0 iPod for Windows 2006-01-10 iPod for Windows 2006-03-23 iTunes Java™ 6 Update 17 Line 6 Uninstaller Logitech GamePanel Software 2.00 Logitech Harmony Remote Software 7 Magic ISO Maker v5.4 (build 0239) Malwarebytes' Anti-Malware Marvell Miniport Driver Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Money 2007 Microsoft Money Shared Libraries Microsoft National Language Support Downlevel APIs Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable MobileMe Control Panel Mozilla Firefox (3.5.7) MSN Music Assistant MSXML 6.0 Parser (KB925673) MSXML4 Parser Neverwinter Nights 2 NVIDIA Drivers NVIDIA PhysX Oblivion oggcodecs 0.71.0946 Panda ActiveScan Picasa 3 Power Tab Editor 1.7 PowerDVD QuickTime RealPlayer Realtek High Definition Audio Driver Remote Control USB Driver Safari Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB973704) Security Update for CAPICOM (KB931906) Security Update for Microsoft Office Excel 2007 (KB973593) Security Update for Microsoft Office Outlook 2007 (KB972363) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Microsoft Office Publisher 2007 (KB969693) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB969613) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB969604) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Internet Explorer 7 (KB974455) Security Update for Windows Internet Explorer 7 (KB976325) Security Update for Windows Internet Explorer 8 (KB976325) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Sid Meier's Civilization 4 Sid Meier's Civilization 4 - Beyond the Sword Steam™ Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office InfoPath 2007 (KB976416) Update for Outlook 2007 Junk Email Filter (kb977839) Update for Windows Internet Explorer 7 (KB976749) Update for Windows Internet Explorer 8 (KB975364) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Variax Workbench (remove only) Ventrilo Client Virtual Cable Tester Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 Warcraft III: All Products WebEx Support Manager for Internet Explorer WebFldrs XP Winamp Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage v1.3.0254.0 Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Live Messenger Windows Live Sign-in Assistant Windows Media Format 11 runtime Windows Media Player 11 Windows Presentation Foundation Windows XP Service Pack 3 WinRAR archiver WinZip 14.0 World of Warcraft XML Paper Specification Shared Components Pack 1.0 ==== Event Viewer Messages From Past Week ======== 1/15/2010 8:10:50 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Lavasoft Ad-Aware Service service. 1/15/2010 2:18:56 PM, error: PlugPlayManager [11] - The device Root\LEGACY_ROOTREPEAL\0000 disappeared from the system without first being prepared for removal. 1/15/2010 1:58:34 PM, error: WMPNetworkSvc [14344] - A new media server was not initialized because WMCreateDeviceRegistration() encountered error '0xc00d2711'. The Windows Media DRM components on your computer might be corrupted. Verify that protected files play correctly in Windows Media Player, and then restart the WMPNetworkSvc service. 1/15/2010 1:58:04 PM, error: Service Control Manager [7031] - The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service. 1/14/2010 6:18:49 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found. 1/14/2010 6:11:04 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft XML Core Services 4.0 Service Pack 2 (KB954430). 1/14/2010 6:09:54 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect. 1/14/2010 6:09:54 AM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 1/14/2010 6:09:29 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ntiomin 1/14/2010 6:09:29 AM, error: Service Control Manager [7000] - The PfModNT service failed to start due to the following error: The system cannot find the file specified. 1/13/2010 10:29:28 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 1/13/2010 10:15:41 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 1/13/2010 10:14:51 PM, error: sfsync02 [12] - 1/13/2010 10:14:49 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec mfehidk MRxSmb NetBIOS NetBT ntiomin RasAcd Rdbss Tcpip 1/13/2010 10:14:49 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. 1/13/2010 10:14:49 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 1/13/2010 10:14:49 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 1/13/2010 10:14:49 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 1/13/2010 10:14:49 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 1/13/2010 10:14:49 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. ==== End Of File ===========================
Post #11
Matthew,

You still have bits and pieces of Norton and McAfee showing in your logs. I did some research on your log entry and it looks like you had Norton Internet Security 2006 onboard. I will remove what I can see with this script, but you should still run the removal tools I gave you links for.

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above KillAll::

KillAll::

Driver::
mfeavfk
mfebopk
mferkdk
mfesmfk

File::
c:\windows\system32\drivers\mfeavfk.sys
c:\windows\system32\drivers\mfebopk.sys
c:\windows\system32\drivers\mferkdk.sys
c:\windows\system32\drivers\mfesmfk.sys

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}"=-
"{C4069E3A-68F1-403E-B40E-20066696354B}"=-

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

As soon as this completes you should install one AV program. Refer back to my previous posts for links.

Please include the following in your next post:
  • ComboFix log
  • Let me know if your computer is still running OK
Post #12
everything seems a-ok

ComboFix 10-01-16.01 - Matt 01/16/2010 19:55:12.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3199.2664 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\hocuspocus.exe
Command switches used :: c:\documents and settings\Matt\Desktop\CFScript.txt
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

FILE ::
"c:\windows\system32\drivers\mfeavfk.sys"
"c:\windows\system32\drivers\mfebopk.sys"
"c:\windows\system32\drivers\mferkdk.sys"
"c:\windows\system32\drivers\mfesmfk.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\mfeavfk.sys
c:\windows\system32\drivers\mfebopk.sys
c:\windows\system32\drivers\mferkdk.sys
c:\windows\system32\drivers\mfesmfk.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MFEAVFK
——-\Legacy_MFEBOPK
——-\Legacy_MFERKDK
——-\Legacy_MFESMFK
——-\Service_mfeavfk
——-\Service_mfebopk
——-\Service_mferkdk
——-\Service_mfesmfk


((((((((((((((((((((((((( Files Created from 2009-12-17 to 2010-01-17 )))))))))))))))))))))))))))))))
.

2010-01-16 23:24 . 2010-01-16 23:33 ——– d—–w- C:\hocuspocus
2010-01-16 20:01 . 2010-01-16 20:01 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-01-16 19:52 . 2010-01-16 19:52 ——– d-sh–w- c:\documents and settings\Matt\IETldCache
2010-01-16 19:50 . 2009-10-29 07:45 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-01-16 19:50 . 2009-10-29 07:45 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-16 19:50 . 2010-01-16 19:50 ——– d—–w- c:\windows\ie8updates
2010-01-16 19:50 . 2009-10-02 04:44 92160 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2010-01-16 19:49 . 2010-01-16 19:49 ——– dc-h–w- c:\windows\ie8
2010-01-16 03:20 . 2010-01-16 03:20 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-15 02:09 . 2010-01-08 00:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-15 02:09 . 2010-01-15 02:35 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-15 02:09 . 2010-01-08 00:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-15 02:07 . 2010-01-15 02:07 ——– d—–w- c:\program files\ERUNT
2010-01-13 01:13 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-02 14:46 . 2010-01-11 00:58 162112 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-01 14:44 . 2010-01-01 14:47 ——– d—–w- c:\documents and settings\Matt\logitech
2010-01-01 14:44 . 2010-01-01 14:47 ——– d—–w- c:\program files\Common Files\Remote Control Software Common
2010-01-01 14:43 . 2010-01-01 14:43 ——– d—–w- c:\program files\Common Files\Remote Control USB Driver
2009-12-30 12:32 . 2009-12-30 12:32 ——– d—–w- c:\documents and settings\NetworkService\Application Data\DivX
2009-12-27 13:38 . 2009-12-27 13:38 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-12-27 13:37 . 2009-12-27 13:37 ——– d—–w- c:\documents and settings\All Users\Application Data\espionServerData
2009-12-25 03:23 . 2009-12-25 03:23 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-12-25 03:22 . 2009-12-25 03:22 ——– d—–w- c:\program files\Common Files\Macrovision Shared
2009-12-22 03:00 . 2009-12-22 03:00 ——– d—–w- c:\program files\HD Tune

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-16 19:19 . 2009-04-08 21:41 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-01-16 03:20 . 2007-12-31 03:45 ——– d—–w- c:\program files\Java
2010-01-16 03:20 . 2010-01-16 03:20 152576 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-16 03:19 . 2010-01-16 03:19 79488 —-a-w- c:\documents and settings\Matt\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-15 16:55 . 2007-04-08 05:13 ——– d—–w- c:\documents and settings\All Users\Application Data\WinZip
2010-01-14 05:33 . 2007-04-08 14:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-14 05:27 . 2009-06-03 05:13 ——– d—–w- c:\program files\Linksys
2010-01-13 05:47 . 2007-05-01 23:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-13 05:19 . 2007-05-25 01:30 ——– d—–w- c:\documents and settings\Matt\Application Data\uTorrent
2010-01-01 14:44 . 2007-12-12 01:53 ——– d—–w- c:\program files\Logitech
2010-01-01 14:43 . 2005-08-27 13:55 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-27 13:36 . 2005-08-27 12:05 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-25 13:37 . 2005-09-14 12:58 69864 -c–a-w- c:\documents and settings\Matt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-25 13:37 . 2009-09-18 01:39 55620 —ha-w- c:\windows\system32\mlfcache.dat
2009-12-25 03:22 . 2009-12-25 03:23 38208 —-a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-23 17:45 . 2009-12-04 17:19 2066200 —-a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-12-14 19:15 . 2009-12-14 19:15 2146304 —-a-w- c:\windows\system32\GPhotos.scr
2009-12-03 15:56 . 2007-07-26 01:34 ——– d—–w- c:\program files\Google
2009-11-28 01:54 . 2009-11-28 01:54 ——– d—–w- c:\documents and settings\Matt\Application Data\Canon
2009-11-28 01:37 . 2009-11-28 01:34 ——– d—–w- c:\program files\Canon
2009-11-28 01:36 . 2009-11-28 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-11-28 01:33 . 2009-11-28 01:33 ——– d—–w- c:\program files\Common Files\Canon
2009-11-22 14:44 . 2009-07-25 03:50 ——– d—–w- c:\program files\itunes
2009-11-22 14:43 . 2005-09-20 13:14 ——– d—–w- c:\program files\iPod
2009-11-22 14:43 . 2007-07-01 02:36 ——– d—–w- c:\program files\Common Files\Apple
2009-11-22 14:40 . 2009-11-22 14:39 ——– d—–w- c:\program files\QuickTime
2009-11-22 14:36 . 2009-11-22 14:36 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-21 15:51 . 2004-08-04 12:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-13 22:57 . 2009-11-13 22:57 922112 ——w- c:\windows\system32\imapi2fs.dll
2009-11-13 22:57 . 2009-11-13 22:57 426496 ——w- c:\windows\system32\imapi2.dll
2009-10-29 07:45 . 2004-08-04 12:00 916480 ——w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-04 12:00 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 12:00 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 12:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 1687824]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-18 2094352]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-13 141600]
"RTHDCPL"="RTHDCPL.EXE" [2005-04-26 14370816]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 71216]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-28 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-28 13918208]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-16 149280]

c:\documents and settings\Matt\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 22:51 177440 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-02-07 23:21 54832 —-a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2007-01-19 19:54 5674352 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 07:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-01-14 04:46 1217808 —-a-w- c:\program files\Valve\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-27 02:27 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2006-10-24 04:15 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Valve\\Steam\\Steam.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\Sierra\\FEAR\\FEAR.exe"=
"d:\\Sierra\\FEAR\\FEARMP.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\utorrent\\utorrent.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"d:\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"d:\\Dragon Age\\bin_ship\\daorigins.exe"=
"d:\\Dragon Age\\DAOriginsLauncher.exe"=
"d:\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\itunes\\iTunes.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader
"6881:TCP"= 6881:TCP:WOW
"6999:TCP"= 6999:TCP:WOW
"67:UDP"= 67:UDP:DHCP Discovery Service

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/1/2009 5:10 PM 64160]
R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;d:\adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [9/6/2009 6:06 AM 169312]
S1 ntiomin;ntiomin; [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 6:49 AM 1028432]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\dragon age\bin_ship\daupdatersvc.service.exe [11/3/2009 6:31 PM 25832]
S3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);c:\windows\system32\drivers\e10kx2k.sys –> c:\windows\system32\drivers\e10kx2k.sys [?]
S3 L6PODX3LV;POD X3 Live Service;c:\windows\system32\drivers\L6PODX3LV.sys [8/20/2008 6:43 PM 521472]
.
Contents of the 'Scheduled Tasks' folder

2010-01-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 05:05]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src;={referrer:source?}
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
Trusted Zone: line6.net
FF - ProfilePath - c:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\7kalu2o1.default\
FF - plugin: c:\program files\Canon\ZoomBrowser EX\Program\NPCIG.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-16 20:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
@DACL=(02 0000)
@="bootstrap.application.1"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(988)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
c:\program files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
c:\windows\system32\MsPMSPSv.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-01-16 20:11:21 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-17 04:11
ComboFix2.txt 2010-01-16 23:33
ComboFix3.txt 2010-01-15 22:29

Pre-Run: 7,364,210,688 bytes free
Post-Run: 7,328,305,152 bytes free

- - End Of File - - B7B93EF8B7A4FF2F94BAE18A514D6A41
Post #13
Matthew,

Good work, your logs look clean. If you didn't already, run those removal tools and install an AV. Now we have some important clean up and housekeeping to tend to:

🖼Click to load external image (Posted Image) Uninstall ComboFix
  • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens:
    Combofix /Uninstall
🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Now to remove most of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.
🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 18. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
        Applications and AppletsTrace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.
    Click to load external image (Posted Image) Your Adbobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

    Go HERE to scan for any other out of date and/or vulnerable applications on your computer and follow the instructions given for updating them.

    Click to load external image (Posted Image) Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
    • Restart any anti-malware programs that we disabled while we were cleaning your machine.
    • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
    • Avoid using P2P programs, cracks and keygens! Refer back to my earlier post for more information.
    • Consider running in a limited user account. See this post for more information.
    • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
    Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI