What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Suspicious.vundo.2/Rootkit Help!?

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Combofix Log

ComboFix 10-01-20.06 - Administrator 01/21/2010 18:12:39.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.735.431 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\jgh.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::
"c:\documents and settings\All Users\Application Data\h8srtkrl32mainweq.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\h8srtkrl32mainweq.dll

.
((((((((((((((((((((((((( Files Created from 2009-12-21 to 2010-01-21 )))))))))))))))))))))))))))))))
.

2010-01-21 16:23 . 2010-01-21 16:25 ——– d—–w- C:\32788R22FWJFW.6.tmp
2010-01-21 16:22 . 2010-01-21 16:23 ——– d—–w- C:\32788R22FWJFW.5.tmp
2010-01-21 02:55 . 2010-01-21 02:57 ——– d—–w- C:\32788R22FWJFW.4.tmp
2010-01-21 02:52 . 2010-01-21 02:52 ——– d—–w- C:\32788R22FWJFW.3.tmp
2010-01-21 02:49 . 2010-01-21 02:52 ——– d—–w- C:\32788R22FWJFW.2.tmp
2010-01-21 02:49 . 2010-01-21 02:49 ——– d—–w- C:\32788R22FWJFW.1.tmp
2010-01-20 18:47 . 2010-01-20 18:47 ——– d—–w- C:\_OTL
2010-01-19 17:15 . 2010-01-19 17:15 552 —-a-w- c:\windows\system32\d3d8caps.dat
2010-01-19 17:15 . 2010-01-19 17:15 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-29 04:06 . 2009-12-29 04:06 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-21 23:11 . 2008-12-15 22:08 ——– d—–w- c:\program files\Symantec AntiVirus
2010-01-21 02:59 . 2009-03-07 06:45 ——– d—–w- c:\program files\Norton Security Scan
2009-12-31 16:55 . 2010-01-18 00:38 170960 —-a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-12-20 15:50 . 2009-11-27 18:36 ——– d—–w- c:\documents and settings\Administrator\Application Data\Apple Computer
2009-12-18 22:57 . 2009-11-27 18:55 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2009-12-18 22:57 . 2009-11-27 18:55 ——– d—–w- c:\program files\DVDVideoSoft
2009-11-29 03:05 . 2009-11-29 03:05 ——– d—–w- c:\documents and settings\Administrator\Application Data\Rock Your Phone
2009-11-27 19:25 . 2009-11-27 19:25 50596 —ha-w- c:\windows\system32\mlfcache.dat
2009-11-27 18:56 . 2009-11-27 18:56 ——– d—–w- c:\program files\Ask.com
2009-11-27 18:36 . 2009-11-27 18:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2009-11-27 18:35 . 2009-11-27 18:34 ——– d—–w- c:\program files\iTunes
2009-11-27 18:35 . 2009-11-27 18:34 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-27 18:34 . 2009-11-27 18:34 ——– d—–w- c:\program files\iPod
2009-11-27 18:34 . 2009-11-27 18:32 ——– d—–w- c:\program files\Common Files\Apple
2009-11-27 18:34 . 2009-11-27 18:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-11-27 18:34 . 2009-11-27 18:34 ——– d—–w- c:\program files\Bonjour
2009-11-27 18:34 . 2009-11-27 18:33 ——– d—–w- c:\program files\QuickTime
2009-11-27 18:33 . 2009-11-27 18:33 ——– d—–w- c:\program files\Apple Software Update
2009-11-21 15:51 . 2004-08-04 04:56 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-15 05:49 . 2009-11-15 05:49 691696 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-11-12 22:07 . 2009-11-12 22:07 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-29 07:46 . 2004-08-04 04:56 832512 ——w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 04:56 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2004-08-04 04:56 17408 —-a-w- c:\windows\system32\corpol.dll
2009-06-04 12:16 . 2009-06-20 00:38 372736 —-a-w- c:\program files\mozilla firefox\plugins\Plugin.dll
2006-05-03 09:06 . 2009-10-11 15:32 163328 –sh–r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-10-11 15:32 31232 –sh–r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-10-11 15:32 216064 –sh–r- c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-06-16 22:22 1144712 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-16 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-06-16 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-08-03 67184]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-08-18 120640]
"ErrorSmart"="c:\program files\ErrorSmart\ErrorSmart.exe" [2008-12-16 16089088]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2006-01-13 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Administrator\\Desktop\\jgh.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26859:TCP"= 26859:TCP:BitComet 26859 TCP
"26859:UDP"= 26859:UDP:BitComet 26859 UDP

S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [8/18/2005 12:50 PM 153416]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/15/2009 12:49 AM 691696]
.
Contents of the 'Scheduled Tasks' folder

2010-01-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-01-21 c:\windows\Tasks\ErrorSmart Scheduled Scan.job
- c:\program files\ErrorSmart\ErrorSmart.exe [2008-12-16 19:34]

2010-01-20 c:\windows\Tasks\Norton Security Scan for Administrator.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 09:18]

2010-01-21 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-06-16 22:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZCfox000
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=DVSV5&o=15016&locale=en_US&q=
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-21 18:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-01-21 18:18:57
ComboFix-quarantined-files.txt 2010-01-21 23:18
ComboFix2.txt 2010-01-21 16:53

Pre-Run: 15,504,728,064 bytes free
Post-Run: 15,473,111,040 bytes free

- - End Of File - - 950DA7F9F1EC20BDC90D99FE1B98A455
Post #32
Malwarebyte Log Malwarebytes' Anti-Malware 1.44 Database version: 3611 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 1/21/2010 8:27:40 PM mbam-log-2010-01-21 (20-27-40).txt Scan type: Quick Scan Objects scanned: 114136 Time elapsed: 7 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 21 Registry Values Infected: 2 Registry Data Items Infected: 1 Folders Infected: 6 Files Infected: 23 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f02fabcb-92dd-475a-98af-14217bd50746} (Adware.Gamevance) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\473d1b29f95b96241830b6a6ade19368 (Rogue.RegistryBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5a144bd76064d1645b6e74c0734ee406 (Rogue.RegistryBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\965dcc82bc551df439b28676f8ab79e0 (Rogue.RegistryBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5520bd9c-4798-4094-a1d9-3e8573d42b55} (Rogue.ErrorSmart) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\errorsmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\Administrator\Application Data\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\ErrorSmart\Log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\danielw\Application Data\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\danielw\Application Data\ErrorSmart\Log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\Administrator\Application Data\ErrorSmart\Log\2010 Jan 21 - 01_53_40 PM_078.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\ErrorSmart\Log\2010 Jan 21 - 04_56_02 PM_859.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\ErrorSmart\Log\2010 Jan 21 - 07_55_01 PM_364.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\ErrorSmart\Log\2010 Jan 21 - 11_05_51 AM_201.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\ErrorSmart\Log\2010 Jan 21 - 11_21_01 AM_203.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\ErrorSmart\Log\2010 Jan 21 - 11_48_21 AM_156.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\danielw\Application Data\ErrorSmart\Log\2009 Jan 01 - 07_45_13 PM_500.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\danielw\Application Data\ErrorSmart\Log\2009 Jan 01 - 08_17_14 PM_468.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\danielw\Application Data\ErrorSmart\Log\2009 Jan 01 - 08_21_55 PM_953.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\danielw\Application Data\ErrorSmart\Log\2009 Jan 01 - 09_03_23 PM_828.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\danielw\Application Data\ErrorSmart\Log\2009 Jan 01 - 09_08_42 PM_671.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\danielw\Application Data\ErrorSmart\Log\2009 Jan 01 - 09_11_03 PM_453.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\ErrorSmart\DataBase.ref (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\ErrorSmart\ErrorSmart.exe (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\ErrorSmart\ErrorSmart.url (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\ErrorSmart\RegCleaner.dll (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\ErrorSmart\TCL.dll (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\ErrorSmart\zlib.dll (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\ErrorSmart\ErrorSmart on the Web.lnk (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\ErrorSmart\ErrorSmart.lnk (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Defense.lnk (Rogue.MalwareDefense) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Desktop\ErrorSmart.lnk (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job (Rogue.ErrorSmart) -> Quarantined and deleted successfully.
Post #33
Hi Lunaris,

Your java is out of date. Click your start button, open Control panel.
  • Locate the Java icon (it looks like a coffee cup)
  • double click it to open it
  • click the Update tab
  • Click update now

After the java is updated, reboot your computer if not prompted to.

Next, clear the java cache

To clear the Java Plug-in cache:
  • Click Start > Control Panel.
  • Double-click the Java icon in the control panel.
  • On the General tab, Click Settings under Temporary Internet Files.
  • On the Temporary Files Settings screen, Click Delete Files.
  • check all boxes
  • Click OK

One more scan.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Please go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions.
  • You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
    • Spyware, Adware, Dialers, and other potentially dangerous programs
    • Archives
    • Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Change the Files of type to Text file (.txt)
  • Set the Save In to Desktop
  • click the Save button.
  • Please post this log in your next reply.

After the Kaspersky scan has completed and you have saved the results, please open OTL and do a scan with these settings.

  • Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • UNcheck the boxes beside LOP Check and Purity Check.
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window. OTL.Txt . There will only be the OTL.txt this time.

Please post back with
  • Kaspersky log
  • OTL log
Everything OK?

Thanks
Post #36
——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Friday, January 22, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, January 22, 2010 11:36:22 Records in database: 3357646 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ Scan statistics: Objects scanned: 42212 Threats found: 3 Infected objects found: 8 Suspicious objects found: 0 Scan duration: 02:24:13 File name / Threat / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E680000.VBN Infected: Exploit.JS.Pdfka.asd 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTruppsxthxl.dll.vir Infected: Packed.Win32.TDSS.aa 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTrwpuykbdte.dll.vir Infected: Packed.Win32.TDSS.aa 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTulkriqpeex.dll.vir Infected: Packed.Win32.TDSS.aa 1 C:\System Volume Information\_restore{78BEE7F8-DB38-483E-AD10-1A84BFC05793}\RP0\A0000004.dll Infected: Packed.Win32.TDSS.aa 1 C:\System Volume Information\_restore{78BEE7F8-DB38-483E-AD10-1A84BFC05793}\RP0\A0000005.dll Infected: Packed.Win32.TDSS.aa 1 C:\System Volume Information\_restore{78BEE7F8-DB38-483E-AD10-1A84BFC05793}\RP0\A0000006.dll Infected: Packed.Win32.TDSS.aa 1 C:\_OTL\MovedFiles\01202010_134701\C_Documents and Settings\Administrator\Local Settings\Application Data\wferrt\iyaksysguard.exe Infected: Trojan.Win32.FraudPack.akfh 1 Selected area has been scanned.
Post #37
OTL log


OTL logfile created on: 1/22/2010 11:14:46 AM - Run 4
OTL by OldTimer - Version 3.1.25.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

735.00 Mb Total Physical Memory | 426.00 Mb Available Physical Memory | 58.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 58.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 14.15 Gb Free Space | 37.97% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DANIEL-PC
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Local Settings\temp\jkos-Administrator\binaries\ScanningProcess.exe (Kaspersky Lab.)
PRC - C:\Documents and Settings\Administrator\Desktop\OTL(2).exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre6\bin\java.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL(2).exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (SavRoam) – C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (Symantec AntiVirus) – C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) – C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (SNDSrvc) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccPwdSvc) – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Creative Service for CDROM Access) – C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.msn.com/sphome.aspx
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-sunm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-sunm"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.5.1
FF - prefs.js..keyword.URL: "http://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=DVSV5&o=15016&locale=en_US&q="


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/16 16:15:02 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/15 12:36:06 | 00,000,000 | —D | M]

[2009/03/04 20:09:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/01/21 14:20:09 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\extensions
[2010/01/18 08:13:26 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\extensions\[removed]
[2009/11/15 00:49:41 | 00,002,059 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\searchplugins\daemon-search.xml
[2009/07/22 10:12:25 | 00,009,941 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\searchplugins\mywebsearch.xml
[2010/01/21 14:20:09 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/07/17 03:40:12 | 00,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009/02/02 21:15:28 | 03,771,296 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll
[2009/06/04 07:16:30 | 00,372,736 | —- | M] (Adobe Systems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\Plugin.dll

O1 HOSTS File: ([2010/01/21 11:48:13 | 00,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ITC2-DOMAIN.COM
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/12/15 16:45:06 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/01/21 20:42:26 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2010/01/21 20:16:55 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2010/01/21 20:16:50 | 00,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/21 20:16:48 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/01/21 20:16:47 | 00,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/21 20:16:47 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/21 11:34:58 | 00,000,000 | RHSD | C] – C:\cmdcons
[2010/01/21 11:33:01 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/01/21 11:33:01 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/01/21 11:33:01 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/01/21 11:33:01 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/01/21 11:23:46 | 00,000,000 | —D | C] – C:\32788R22FWJFW.6.tmp
[2010/01/21 11:22:40 | 00,000,000 | —D | C] – C:\32788R22FWJFW.5.tmp
[2010/01/20 22:06:46 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/01/20 22:05:56 | 00,000,000 | —D | C] – C:\Qoobox
[2010/01/20 21:55:32 | 00,000,000 | —D | C] – C:\32788R22FWJFW.4.tmp
[2010/01/20 21:52:08 | 00,000,000 | —D | C] – C:\32788R22FWJFW.3.tmp
[2010/01/20 21:49:34 | 00,000,000 | —D | C] – C:\32788R22FWJFW.2.tmp
[2010/01/20 21:49:07 | 00,000,000 | —D | C] – C:\32788R22FWJFW.1.tmp
[2010/01/20 16:03:52 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\New Folder
[2010/01/20 13:47:01 | 00,000,000 | —D | C] – C:\_OTL
[2010/01/20 12:52:07 | 00,547,328 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL(2).exe
[2010/01/17 19:54:17 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2009/12/28 23:06:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/05/29 15:21:04 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/12/15 16:49:03 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2008/12/15 16:44:57 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/12/15 16:44:57 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[6 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/01/22 11:01:01 | 00,000,250 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/01/22 08:26:32 | 00,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/22 08:22:44 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/22 08:22:39 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/22 08:22:36 | 77,128,4992 | -HS- | M] () – C:\hiberfil.sys
[2010/01/22 08:21:13 | 04,980,736 | -H– | M] () – C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/01/22 08:21:13 | 00,000,278 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/01/22 08:20:42 | 04,831,882 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/01/21 20:16:52 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/21 18:17:21 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/21 11:48:13 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/01/21 11:35:04 | 00,000,281 | RHS- | M] () – C:\boot.ini
[2010/01/21 11:11:57 | 03,831,942 | R— | M] () – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2010/01/20 21:59:29 | 00,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton Security Scan.lnk
[2010/01/20 18:00:01 | 00,000,424 | —- | M] () – C:\WINDOWS\tasks\Norton Security Scan for Administrator.job
[2010/01/20 13:56:53 | 00,293,376 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\fb9fgijy.exe
[2010/01/20 13:52:52 | 00,000,020 | —- | M] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/01/20 13:52:11 | 00,050,621 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Defogger.exe
[2010/01/20 12:52:10 | 00,547,328 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL(2).exe
[2010/01/19 22:28:13 | 00,001,917 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/19 12:19:19 | 00,000,603 | —- | M] () – C:\WINDOWS\win.ini
[2010/01/19 12:19:19 | 00,000,211 | —- | M] () – C:\Boot.bak
[2010/01/19 12:15:48 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/19 12:15:48 | 00,000,552 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/01/19 11:58:43 | 00,001,908 | —- | M] () – C:\WINDOWS\diagwrn.xml
[2010/01/19 11:58:43 | 00,001,908 | —- | M] () – C:\WINDOWS\diagerr.xml
[2010/01/18 07:43:33 | 00,000,611 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Shortcut to sims 2+power iso 3.1.lnk
[2010/01/17 19:20:12 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/17 19:09:58 | 00,000,000 | -H– | M] () – C:\Documents and Settings\Administrator\My Documents\Default.rdp
[2010/01/11 23:25:58 | 00,019,968 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\The cold musty air gracefully spiraed around.doc
[2010/01/11 23:06:05 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/09 22:19:07 | 00,024,064 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Doc2.doc
[2010/01/09 11:08:15 | 00,006,144 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[6 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/21 20:16:52 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/21 11:35:03 | 00,000,211 | —- | C] () – C:\Boot.bak
[2010/01/21 11:34:59 | 00,260,272 | —- | C] () – C:\cmldr
[2010/01/21 11:33:01 | 00,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/01/21 11:33:01 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/01/21 11:33:01 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/01/21 11:33:01 | 00,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/01/21 11:33:01 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/01/21 11:11:28 | 03,831,942 | R— | C] () – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2010/01/20 13:56:52 | 00,293,376 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\fb9fgijy.exe
[2010/01/20 13:52:45 | 00,000,020 | —- | C] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/01/20 13:52:11 | 00,050,621 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Defogger.exe
[2010/01/19 12:20:10 | 77,128,4992 | -HS- | C] () – C:\hiberfil.sys
[2010/01/19 12:15:48 | 00,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/01/19 12:15:35 | 00,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/17 19:20:12 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/17 19:09:58 | 00,000,000 | -H– | C] () – C:\Documents and Settings\Administrator\My Documents\Default.rdp
[2010/01/09 22:19:06 | 00,024,064 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\Doc2.doc
[2009/08/19 20:12:21 | 00,006,144 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/05 11:26:29 | 00,027,648 | —- | C] () – C:\WINDOWS\System32\AVSredirect.dll
[2009/04/15 14:42:21 | 00,000,035 | —- | C] () – C:\WINDOWS\GetGoDM.INI
[2009/03/07 16:16:43 | 00,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2009/01/02 21:31:26 | 00,000,034 | —- | C] () – C:\WINDOWS\hpfsched.ini
[2008/12/15 18:09:53 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/12/15 17:01:06 | 00,002,573 | —- | C] () – C:\WINDOWS\WAVEMIX.INI
[2008/12/15 17:01:06 | 00,000,247 | —- | C] () – C:\WINDOWS\QNETP7.INI
[2004/09/17 17:37:42 | 00,061,440 | —- | C] () – C:\WINDOWS\System32\vuins32.dll
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
< End of report >
Post #38
Hi Lunaris,

Looks good.

One of detections are in Symantec quarantined files, you can empty the quarantined folder. The others are files we have quarantined or are old System Restore points. These will be removed when we remove the tools.

If no other problems, we can clean up our tools. Keep Defogger, we will use it shortly.

From your desktop, please delete, if present
  • any notepads/logs that we created
  • GMER.zip
  • GMER.exe
  • fb9fgijy.exe

Next

Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /uninstall



Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep MBAM updated and use it regularly.


To re-enable your Emulation drivers, double click DeFogger to run the tool.
  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.


Updates and upgrades

Your logs indicate you have Java™ 6 Update 15 installed which is out of date.

Open Add/Remove programs and check to see which version of Java is currently installed. If it's less than Java™ 6 Update 18, please uninstall it.

To get the newest version follow these instructions:

  • Go to http://java.sun.com/javase/downloads/index.jsp
  • Scroll down to "Java Runtime Environment (JRE) 6 Update 18
  • Click the download button on the right.
If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.
  • Select the platform (Windows, in your case), mutli language.
  • Accept the license agreement, click continue.
You do not have to install the Java Web Start ActiveX Control
  • Scroll down and click on Windows Offline Installation,
  • Save the file jre-6u18-windows-i586-p.exe to your desktop;
Do not select Run . Do not install it yet.

When the download is complete, close your browser.

  • Double-click on the saved file ( jre-6u18-windows-i586-p.exe) to install the update.
  • Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall.

For resident antispyware I suggest either

Windows Defender
OR
Winpatrol

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware,IMO)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".


Take care :adios:
Post #41
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI