What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] BDS/Poison.auwd / CPU usage constantly at 100%

30 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Ok, I tried that but when I typed the copy instruction I got the reply "1 file(s) copied" which looked suspicious because I was expecting 2 files to copy, so I tried them individually: copy userinit.exe = worked fine, asked me if I wanted to overwrite so I said yes. copy wsaupdater.exe = "cannot find the file specified." I rebooted and tried to login anyway but it's still doing the same thing of kicking back out again so I guess we'll need to find a way to get wsaupdater.exe copied. I do have a Win XP bootable CD if that helps. I could try the same thing but use the Recovery Console on the disc instead of the one on my PC, maybe?
Post #32
fingerz,

🖼Click to load external image (Posted Image) Boot your system into the Recovery Console.

  • Type in the number of the Windows installation you want to repair (usually 1), then press ENTER.
  • Type in the Administrator password (leave blank if you are unsure what it is) and press ENTER.
  • At the command prompt type the following command and press enter:
    cd Windows\ERDNT\SUBS
    Your prompt should now look like this: c:\Windows\ERDNT\SUBS>
  • Now type the following command and press enter:
    batch erdnt.con
  • Now type the following command and press enter:
    exit
  • Reboot (hopefully into the normal mode)

If that goes OK, run DDS and post the log for me. If not, let me know.
Post #33
Ok, so…

The ERDNT batch worked and I can now login to my PC again but the network connection does not work. There seems to be a problem with TCP/IP.

When I click "Repair" on the network connection I get the following error:

Windows could not finish repairing the problem because the following action cannot be completed:
Failed to query TCP/IP settings of the connection. Cannot proceed.

For assistance please contact the person who manages your network.


I tried reinstalling TCP/IP from the nettcpip.inf file but it didn't work.
Post #34
fingerz,

Good! Lets try this now:

🖼Click to load external image (Posted Image) If your network icon appears on the Windows taskbar, then you can repair it by right-clicking on the icon and selecting Repair.

[external image: Posted Image]

If you have no task bar icon do this:

  • Click on the Start button.
  • Click on the Settings menu option.
  • Click on the Control Panel option.
  • When the Control Panel opens, double-click on the Network Connections icon. If your Control Panel is set to Category View, then double-click on Network and Internet Connections and then click on Network Connections at the bottom.
  • You will now see a list of available network connections. Locate the connection for your Wireless or Lan adapter and right-click on it.
  • click on the Repair menu option.

[external image: Posted Image]

Let the repair process perform its tasks and when it has finished, your Internet connection should be working again.

If that doesn't work - try the following:

  • Go to Start > Control Panel, and choose Network Connections.
  • Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
  • Click the Networking tab
  • Double-click on the Internet Protocol (TCP/IP) item.
  • Write down the settings in case you should need to change them back.
  • Select the radio button that says "Obtain DNS servers automatically".
  • Click OK twice to get out of the properties screen and restart your computer.
  • If not prompted to reboot go ahead and reboot manually.

In I.E.
  • Check internet options settings.
  • Tools > Internet Options > Connections
  • LAN settings
  • Choose "automatically detect settings"
  • uncheck both proxy settings boxes

In FireFox
  • Click on Advanced -> Network -> Setttings…
  • the No Proxy option should be selected
🖼Click to load external image (Posted Image) Please download RootRepeal to your desktop
  • Physically disconnect your machine from the internet as your system will be unprotected.
  • Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
  • Click the Report tab at the bottom and then the Scan button.
  • A box will pop up, check the boxes beside Drivers, Hidden Services, Files, Processes SSDT and click OK.
  • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  • The scan will take a little while to run, so let it go unhindered.
  • Once it is done, click the Save Report button, call it RepealScan and save the log to your desktop.
  • Reconnect to the internet.
  • Post the log here in your reply.
Please include the following in your next post:
  • A fresh DDS log
  • RootRepeal log
  • The status of your network connection
Post #35 last edited
I'm afraid the network is still broken.

It says it's connected when you look in Network Connections > Local Area Connection. The status is "Connected, Firewalled" but it's a lie because when I try to repair it still gives me the same message:

Windows could not finish repairing the problem because the following action cannot be completed:
Failed to query TCP/IP settings of the connection. Cannot proceed.

For assistance please contact the person who manages your network.


All of the other network settings you posted were already set like that but I double-checked them anyway.

Edit: I've done a little googling and found a couple of pieces of advice that might help us.

Post #10 on this page (link goes straight to it):
http://www.geekstogo.com/forum/failed-to-q…39#entry1050339

Post #2 on this page:
http://www.pcadvisor.co.uk/forums/index.cf…0&forumid=1
Post #36
Give this a shot:

🖼Click to load external image (Posted Image) Follow these steps to use the reset command to reset TCP/IP manually:
  • To open a command prompt, click Start and then click Run. Copy and paste (or type) the following command in the Open box and then press ENTER:
    cmd
  • At the command prompt, copy and paste (or type) the following command and then press ENTER:
    netsh int ip reset c:\resetlog.txt
  • Reboot the computer.
Post the contentents of c:\resetlog.txt for me.

If that works, please also run DDS and RootRepeal (instructions in previous post) and let me have those logs as well.
Post #37
Hey,

The netsh line seemed to work, my internet is back up again on the machine so I ran DDS and RootRepeal. Here are the logs, together with resetlog.txt:

Resetlog.txt:

reset SYSTEM\CurrentControlSet\Services\Dhcp\Parameters\Options\15\RegLocation
old REG_MULTI_SZ =
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\?\DhcpDomain
SYSTEM\CurrentControlSet\Services\TcpIp\Parameters\DhcpDomain

added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{8903296B-519A-48DA-B5C4-FB509581D167}\NetbiosOptions
added SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Interfaces\Tcpip_{9A6BD7FA-E7E8-4FB3-87E6-8B4A9BDA00E4}\NetbiosOptions
deleted SYSTEM\CurrentControlSet\Services\Netbt\Parameters\EnableLmhosts
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4B6524C0-5870-4D60-A600-01C412091875}\DisableDynamicUpdate
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4B6524C0-5870-4D60-A600-01C412091875}\IpAutoconfigurationAddress
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4B6524C0-5870-4D60-A600-01C412091875}\IpAutoconfigurationMask
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4B6524C0-5870-4D60-A600-01C412091875}\IpAutoconfigurationSeed
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4B6524C0-5870-4D60-A600-01C412091875}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4B6524C0-5870-4D60-A600-01C412091875}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4B6524C0-5870-4D60-A600-01C412091875}\UdpAllowedPorts
old REG_MULTI_SZ =
0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F393E35-0B53-4F8E-BD6A-71458C90D10A}\DisableDynamicUpdate
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F393E35-0B53-4F8E-BD6A-71458C90D10A}\IpAutoconfigurationAddress
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F393E35-0B53-4F8E-BD6A-71458C90D10A}\IpAutoconfigurationMask
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F393E35-0B53-4F8E-BD6A-71458C90D10A}\IpAutoconfigurationSeed
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F393E35-0B53-4F8E-BD6A-71458C90D10A}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F393E35-0B53-4F8E-BD6A-71458C90D10A}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5F393E35-0B53-4F8E-BD6A-71458C90D10A}\UdpAllowedPorts
old REG_MULTI_SZ =
0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{78F98A65-6EDF-42BF-84BB-8B78C180C171}\DisableDynamicUpdate
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{78F98A65-6EDF-42BF-84BB-8B78C180C171}\IpAutoconfigurationAddress
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{78F98A65-6EDF-42BF-84BB-8B78C180C171}\IpAutoconfigurationMask
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{78F98A65-6EDF-42BF-84BB-8B78C180C171}\IpAutoconfigurationSeed
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{78F98A65-6EDF-42BF-84BB-8B78C180C171}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{78F98A65-6EDF-42BF-84BB-8B78C180C171}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{78F98A65-6EDF-42BF-84BB-8B78C180C171}\UdpAllowedPorts
old REG_MULTI_SZ =
0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{875F9B68-DD29-4DD8-BD7D-43B65D7820EE}\AddressType
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{875F9B68-DD29-4DD8-BD7D-43B65D7820EE}\DisableDynamicUpdate
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{875F9B68-DD29-4DD8-BD7D-43B65D7820EE}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{875F9B68-DD29-4DD8-BD7D-43B65D7820EE}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{875F9B68-DD29-4DD8-BD7D-43B65D7820EE}\UdpAllowedPorts
old REG_MULTI_SZ =
0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8966D1B6-40CB-42BF-92C1-3DE832F324BD}\AddressType
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8966D1B6-40CB-42BF-92C1-3DE832F324BD}\DisableDynamicUpdate
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8966D1B6-40CB-42BF-92C1-3DE832F324BD}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8966D1B6-40CB-42BF-92C1-3DE832F324BD}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8966D1B6-40CB-42BF-92C1-3DE832F324BD}\UdpAllowedPorts
old REG_MULTI_SZ =
0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98D2B5F6-B7F7-4784-BFCC-00838C70ECC1}\DisableDynamicUpdate
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98D2B5F6-B7F7-4784-BFCC-00838C70ECC1}\IpAutoconfigurationAddress
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98D2B5F6-B7F7-4784-BFCC-00838C70ECC1}\IpAutoconfigurationMask
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98D2B5F6-B7F7-4784-BFCC-00838C70ECC1}\IpAutoconfigurationSeed
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98D2B5F6-B7F7-4784-BFCC-00838C70ECC1}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98D2B5F6-B7F7-4784-BFCC-00838C70ECC1}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{98D2B5F6-B7F7-4784-BFCC-00838C70ECC1}\UdpAllowedPorts
old REG_MULTI_SZ =
0

added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C746D88E-6695-4627-8A60-A34489D2AC8A}\AddressType
added SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C746D88E-6695-4627-8A60-A34489D2AC8A}\DisableDynamicUpdate
reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C746D88E-6695-4627-8A60-A34489D2AC8A}\RawIpAllowedProtocols
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C746D88E-6695-4627-8A60-A34489D2AC8A}\TcpAllowedPorts
old REG_MULTI_SZ =
0

reset SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C746D88E-6695-4627-8A60-A34489D2AC8A}\UdpAllowedPorts
old REG_MULTI_SZ =
0

deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DontAddDefaultGatewayDefault
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableIcmpRedirect
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableSecurityFilters
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\SearchList
deleted SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\UseDomainNameDevolution
reset Linkage\UpperBind for PCI\VEN_1106&DEV_3119&SUBSYS_086C100D&REV_11\3&13C0B0C5&0&70. bad value was:
REG_MULTI_SZ =
afw

reset Linkage\UpperBind for SE27CR\{C31AEF8A-BA86-47D3-BD7D-3477741919E0}\3517070189218790_08. bad value was:
REG_MULTI_SZ =
afw

reset Linkage\UpperBind for USB\VID_050D&PID_6051\5&18EE060D&0&2. bad value was:
REG_MULTI_SZ =
afw

reset Linkage\UpperBind for PCI\VEN_1106&DEV_3119&SUBSYS_1415147B&REV_11\3&13C0B0C5&0&70. bad value was:
REG_MULTI_SZ =
afw

reset Linkage\UpperBind for ROOT\MS_NDISWANIP\0000. bad value was:
REG_MULTI_SZ =
afw




DDS Log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 21:38:02.39 on 03/02/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2640 [GMT 0:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jamey\Desktop\Forums - Whatthetech\02\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\msqjgu32.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [OutpostMonitor] c:\progra~1\agnitum\outpos~1\op_mon.exe /tray /noservice
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [combofix] c:\combofix\cf1361.cfxxe /c c:\combofix\Combobatch.bat
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jamey\applic~1\mozilla\firefox\profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2007-12-13 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [2009-12-18 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-1 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2007-5-26 77312]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2001-12-19 8576]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-27 56816]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2007-12-13 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-10-16 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2005-3-27 14416]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2008-4-17 44032]
S0 vkquwexg;vkquwexg;c:\windows\system32\drivers\combo-fix.sys –> c:\windows\system32\drivers\Combo-Fix.sys [?]
S1 avgio;avgio;\??\c:\program files\avira\antivir desktop\avgio.sys –> c:\program files\avira\antivir desktop\avgio.sys [?]
S1 SandBox;SandBox;\??\c:\windows\system32\drivers\sandbox.sys –> c:\windows\system32\drivers\SandBox.sys [?]
S2 acssrv;Agnitum Client Security Service;c:\progra~1\agnitum\outpos~1\acs.exe –> c:\progra~1\agnitum\outpos~1\acs.exe [?]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\avira\antivir desktop\sched.exe" –> c:\program files\avira\antivir desktop\sched.exe [?]
S2 AntiVirService;Avira AntiVir Guard;"c:\program files\avira\antivir desktop\avguard.exe" –> c:\program files\avira\antivir desktop\avguard.exe [?]
S3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys –> c:\windows\system32\drivers\afw.sys [?]
S3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys –> c:\windows\system32\drivers\afwcore.sys [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [2007-5-26 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [2005-3-27 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2009-3-21 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [2007-5-26 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-01-31 22:43 11,732 a——- C:\backup.reg
2010-01-31 22:43 135,168 a——- C:\zip.exe
2010-01-31 22:43 19,286 a——- C:\cleanup.exe
2010-01-31 22:43 574 a——- C:\cleanup.bat
2010-01-31 00:28 –d—– c:\windows\system32\wbem\Repository
2010-01-27 22:22 –d—– C:\Rooter$
2010-01-26 23:16 261,632 a——- c:\windows\PEV.exe
2010-01-26 23:16 161,792 a——- c:\windows\SWREG.exe
2010-01-26 23:16 98,816 a——- c:\windows\sed.exe
2010-01-26 23:16 77,312 a——- c:\windows\MBR.exe
2010-01-26 21:28 –d—– C:\_OTM
2010-01-18 11:40 411,368 a——- c:\windows\system32\deploytk.dll
2010-01-18 11:40 73,728 a——- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2010-02-03 21:35 1,892,218 a——- c:\windows\cscmondump.bin
2010-01-07 16:07 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-04 12:59 134,173 a——- c:\windows\cscmon.bin
2010-01-03 19:19 77,312 a——- c:\windows\system32\drivers\viasraid.sys
2010-01-03 19:18 77,312 a——- c:\windows\system32\drivers\viasraid.tsk
2009-12-28 13:40 56,816 a——- c:\windows\system32\drivers\avgntflt.sys
2009-12-24 13:53 1,474,832 a——- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 1,984 a——- c:\windows\system32\d3d9caps.dat
2009-12-02 13:19 15,880 a——- c:\windows\system32\lsdelete.exe
2009-11-08 18:55 22,328 a——- c:\docume~1\jamey\applic~1\PnkBstrK.sys
2009-11-08 18:51 107,832 a——- c:\docume~1\jamey\applic~1\PnkBstrB.exe
2009-11-08 18:51 107,832 a——- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 2,337,865 a——- c:\windows\system32\pbsvc.exe
2009-11-08 18:51 66,872 a——- c:\windows\system32\PnkBstrA.exe

============= FINISH: 21:38:19.42 ===============


RootRepeal Log:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2010/02/03 21:40
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================

Drivers
——————-
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA6E14000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
——————-
Path: C:\WINDOWS\temp\Perflib_Perfdata_ec0.dat
Status: Invisible to the Windows API!

SSDT
——————-
#: 041 Function Name: NtCreateKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9c3e6

#: 063 Function Name: NtDeleteKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9d0f2

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9cb06

#: 119 Function Name: NtOpenKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9c684

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9c90a

#: 247 Function Name: NtSetValueKey
Status: Hooked by "cfrmd.sys" at address 0xb9e9ce82

==EOF==
Post #38
fingerz,

I have two sets of instructions for you:

🖼Click to load external image (Posted Image) Run ComboFix again. If if wants to update, please allow it.

🖼Click to load external image (Posted Image) Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :reg
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon /s

:file
c:\windows\system32\msqjgu32.exe
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Please include the following in your next post:
  • ComboFix log
  • SystemLook log
_________________________________

Once you've done that, run these two scans for me:

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • MBAM log
  • Kaspersky log
Post #39
Hi,

The Kaspersky online scanner is still unavailable while they work on a new version for release. Is there any other online scanner you'd like me to use instead?

Other three logs below:

ComboFix Log:

ComboFix 10-01-29.09 - Jamey 04/02/2010 21:01:03.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2701 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\cleanup.exe

.
((((((((((((((((((((((((( Files Created from 2010-01-04 to 2010-02-04 )))))))))))))))))))))))))))))))
.

2010-01-31 22:43 . 2010-01-31 22:43 11732 —-a-w- C:\backup.reg
2010-01-31 22:43 . 2010-01-31 22:43 574 —-a-w- C:\cleanup.bat
2010-01-31 22:43 . 2010-01-31 22:43 135168 —-a-w- C:\zip.exe
2010-01-31 00:28 . 2010-01-31 00:28 ——– d—–w- c:\windows\system32\wbem\Repository
2010-01-27 22:22 . 2010-01-27 22:23 ——– d—–w- C:\Rooter$
2010-01-26 21:28 . 2010-01-26 21:28 ——– d—–w- C:\_OTM
2010-01-24 00:24 . 2010-01-24 00:24 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-sse.dll
2010-01-24 00:24 . 2010-01-24 00:24 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcp71.dll
2010-01-24 00:24 . 2010-01-24 00:24 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\jmc.dll
2010-01-24 00:24 . 2010-01-24 00:24 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3dbb2d00-n\msvcr71.dll
2010-01-24 00:24 . 2010-01-24 00:24 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7ce768f4-n\decora-d3d.dll
2010-01-21 18:27 . 2010-01-21 18:27 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Temp
2010-01-13 22:04 . 2010-01-13 22:04 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-03 23:19 . 2009-12-18 13:10 1920466 —-a-w- c:\windows\cscmondump.bin
2010-02-03 23:06 . 2007-08-24 18:50 ——– d—–w- c:\documents and settings\Jamey\Application Data\uTorrent
2010-01-21 18:42 . 2007-05-26 21:49 ——– d—–w- c:\program files\Browzar
2010-01-18 11:40 . 2010-01-18 11:40 ——– d—–w- c:\program files\Common Files\Java
2010-01-18 11:40 . 2010-01-18 11:40 61440 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-sse.dll
2010-01-18 11:40 . 2010-01-18 11:40 503808 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcp71.dll
2010-01-18 11:40 . 2010-01-18 11:40 499712 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\jmc.dll
2010-01-18 11:40 . 2010-01-18 11:40 348160 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\msvcr71.dll
2010-01-18 11:40 . 2010-01-18 11:40 12800 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\759e98ee-7abcb068-n\decora-d3d.dll
2010-01-18 11:40 . 2010-01-18 11:40 315392 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_awt.dll
2010-01-18 11:40 . 2010-01-18 11:40 20480 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\4f710eed-5d8d696e-n\gluegen-rt.dll
2010-01-18 11:40 . 2010-01-18 11:40 114688 —-a-w- c:\documents and settings\Jamey\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-3e619192-n\jogl_cg.dll
2010-01-18 11:39 . 2010-01-18 11:40 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-18 11:39 . 2007-06-11 18:55 ——– d—–w- c:\program files\Java
2010-01-13 22:05 . 2010-01-02 19:18 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-07 16:07 . 2010-01-02 19:18 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 . 2010-01-02 19:18 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 14:37 . 2007-05-26 00:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-04 12:59 . 2009-12-18 12:59 134173 —-a-w- c:\windows\cscmon.bin
2010-01-03 19:19 . 2007-05-26 00:08 77312 —-a-w- c:\windows\system32\drivers\viasraid.sys
2010-01-03 19:18 . 2010-01-03 19:18 77312 —-a-w- c:\windows\system32\drivers\viasraid.tsk
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\Jamey\Application Data\Malwarebytes
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-02 19:16 . 2010-01-02 19:15 ——– d—–w- c:\program files\ERUNT
2010-01-01 03:24 . 2010-01-01 03:24 ——– d—–w- c:\program files\Trend Micro
2010-01-01 03:22 . 2010-01-01 03:22 8 —-a-w- c:\windows\crpf.bin
2010-01-01 03:22 . 2010-01-01 03:22 4 —-a-w- c:\windows\crpf_sdum.bin
2010-01-01 02:24 . 2010-01-01 02:24 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2009-12-02 13:19 . 2010-01-01 02:25 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-12-02 13:19 . 2010-01-01 02:49 15880 —-a-w- c:\windows\system32\lsdelete.exe
2009-11-29 13:59 . 2009-11-29 13:59 485 —-a-w- c:\windows\PowerReg.dat
2009-11-27 19:53 . 2009-11-27 19:53 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:47 107832 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:46 66872 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-11-08 18:51 . 2008-04-17 19:46 2337865 —-a-w- c:\windows\system32\pbsvc.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-01-26_23.25.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-04 20:53 . 2010-02-04 20:53 16384 c:\windows\temp\Perflib_Perfdata_5b4.dat
+ 2002-08-29 03:41 . 2004-08-03 23:56 24576 c:\windows\system32\wsaupsater.exe
- 2010-01-26 21:29 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-01-28 22:07 . 2010-01-31 16:16 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-31 16:16 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-31 16:16 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-05-25 23:55 . 2010-01-26 21:41 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Network Monitor Utility (USB).lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Network Monitor Utility (USB).lnk
backup=c:\windows\pss\Belkin Wireless Network Monitor Utility (USB).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-06-26 04:38 1044480 ——w- c:\program files\ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack]
c:\program files\Agnitum\Outpost Firewall\feedback.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostMonitor]
c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-08-17 17:39 90112 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-25 16:00 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 15:21 246504 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"TomTomHOMEService"=2 (0x2)
"PnkBstrA"=2 (0x2)
"cmdAgent"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GreedyTorrent\\GTor.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"d:\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"d:\\CoD4 MW\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Game.exe"=
"d:\\Rainbow Six Vegas 1\\Binaries\\R6Vegas_Launcher.exe"=
"d:\\Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [13/12/2007 19:51 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [18/12/2009 12:58 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/01/2010 02:25 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [26/05/2007 00:08 77312]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [19/12/2001 10:45 8576]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [13/12/2007 19:51 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [16/10/2009 19:26 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [27/03/2005 05:01 14416]
S1 SandBox;SandBox;\??\c:\windows\system32\drivers\SandBox.sys –> c:\windows\system32\drivers\SandBox.sys [?]
S2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe –> c:\progra~1\Agnitum\OUTPOS~1\acs.exe [?]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\Avira\AntiVir Desktop\sched.exe" –> c:\program files\Avira\AntiVir Desktop\sched.exe [?]
S3 afw;Agnitum firewall driver;c:\windows\system32\DRIVERS\afw.sys –> c:\windows\system32\DRIVERS\afw.sys [?]
S3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys –> c:\windows\system32\drivers\afwcore.sys [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [26/05/2007 00:19 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [27/03/2005 05:06 44344]
S3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [17/04/2008 22:32 44032]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [02/12/2009 13:19 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [21/03/2009 21:13 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [26/05/2007 00:19 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jamey\Application Data\Mozilla\Firefox\Profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-OutpostMonitor - c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe
HKLM-Run-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe
AddRemove-Agnitum Outpost Firewall_is1 - c:\program files\Agnitum\Outpost Firewall\unins000.exe
AddRemove-Avira AntiVir Desktop - c:\program files\Avira\AntiVir Desktop\setup.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-04 21:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-343818398-1078145449-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:25,33,e1,18,54,11,18,36,02,3d,d2,8f,e9,a6,5f,54,44,1c,17,2c,a4,02,a7,
4e,4d,38,60,1d,1c,c3,68,af,e6,de,14,ab,b6,f7,cb,81,27,07,67,af,07,f2,c1,a4,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(532)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-02-04 21:08:14
ComboFix-quarantined-files.txt 2010-02-04 21:07
ComboFix2.txt 2010-01-31 12:38
ComboFix3.txt 2010-01-31 00:32
ComboFix4.txt 2010-01-30 19:29
ComboFix5.txt 2010-02-04 21:00

Pre-Run: 49,770,246,144 bytes free
Post-Run: 49,732,931,584 bytes free

- - End Of File - - 1CE042AAE4FC82527F29F0160153D015


SystemLook Log:

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 21:19 on 04/02/2010 by Jamey (Administrator - Elevation successful)

========== reg ==========

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"allocatecdroms"="1"
"allocatedasd"="0"
"allocatefloppies"="0"
"AllowMultipleTSSessions"= 0x0000000001 (1)
"AltDefaultDomainName"="JAMEYS-PC"
"AltDefaultUserName"="Jamey"
"AutoRestartShell"= 0x0000000001 (1)
"Background"="0 0 0"
"cachedlogonscount"="10"
"DebugServerCommand"="no"
"DefaultDomainName"="JAMEYS-PC"
"DefaultUserName"="Jamey"
"forceunlocklogon"= 0000000000 (0)
"HibernationPreviouslyEnabled"= 0x0000000001 (1)
"LegalNoticeCaption"=""
"LegalNoticeText"=""
"LogonType"= 0x0000000001 (1)
"passwordexpirywarning"= 0x000000000e (14)
"PowerdownAfterShutdown"="0"
"ReportBootOk"="1"
"scremoveoption"="0"
"SFCDisable"= 0000000000 (0)
"SfcQuota"= 0x00ffffffff (-1)
"Shell"="Explorer.exe"
"ShowLogonOptions"= 0000000000 (0)
"ShutdownWithoutLogon"="0"
"System"=""
"UIHost"="logonui.exe"
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL "sysdm.cpl""
"WinStationsDisabled"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Credentials]
(Unable to open key)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions]
(No values found)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}]
"DllName"="gptext.dll"
"NoGPOListChanges"= 0x0000000001 (1)
"NoUserPolicy"= 0x0000000001 (1)
"ProcessGroupPolicy"="ProcessWIRELESSPolicy"
@="Wireless"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
"DllName"="fdeploy.dll"
"EventSources"="(Folder Redirection,Application)"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"NoBackgroundPolicy"= 0000000000 (0)
"NoGPOListChanges"= 0000000000 (0)
"NoMachinePolicy"= 0x0000000001 (1)
"NoSlowLink"= 0x0000000001 (1)
"PerUserLocalSettings"= 0x0000000001 (1)
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
@="Folder Redirection"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
"DllName"="dskquota.dll"
"EnableAsynchronousProcessing"= 0000000000 (0)
"NoBackgroundPolicy"= 0x0000000001 (1)
"NoGPOListChanges"= 0x0000000001 (1)
"NoMachinePolicy"= 0000000000 (0)
"NoSlowLink"= 0x0000000001 (1)
"NoUserPolicy"= 0x0000000001 (1)
"PerUserLocalSettings"= 0000000000 (0)
"ProcessGroupPolicy"="ProcessGroupPolicy"
"RequiresSuccessfulRegistry"= 0x0000000001 (1)
@="Microsoft Disk Quota"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
"DllName"="gptext.dll"
"NoGPOListChanges"= 0x0000000001 (1)
"NoUserPolicy"= 0x0000000001 (1)
"ProcessGroupPolicy"="ProcessPSCHEDPolicy"
@="QoS Packet Scheduler"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}]
"DllName"="gptext.dll"
"GenerateGroupPolicy"="GenerateScriptsGroupPolicy"
"NoGPOListChanges"= 0x0000000001 (1)
"NoSlowLink"= 0x0000000001 (1)
"NotifyLinkTransition"= 0x0000000001 (1)
"ProcessGroupPolicy"="ProcessScriptsGroupPolicy"
"ProcessGroupPolicyEx"="ProcessScriptsGroupPolicyEx"
@="Scripts"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
"DisplayName"="@iedkcs32.dll,-3051"
"DllName"="iedkcs32.dll"
"NoGPOListChanges"= 0x0000000001 (1)
"ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap"
"RequiresSucessfulRegistry"= 0x0000000001 (1)
@="Internet Explorer Zonemapping"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"="scecli.dll"
"EnableAsynchronousProcessing"= 0x0000000001 (1)
"ExtensionDebugLevel"= 0x0000000001 (1)
"ExtensionRsopPlanningDebugLevel"= 0x0000000001 (1)
"GenerateGroupPolicy"="SceGenerateGroupPolicy"
"MaxNoGPOListChangesInterval"= 0x00000003c0 (960)
"NoGPOListChanges"= 0x0000000001 (1)
"NoUserPolicy"= 0x0000000001 (1)
"ProcessGroupPolicy"="SceProcessSecurityPolicyGPO"
"ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx"
@="Security"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
"DisplayName"="@iedkcs32.dll,-3014"
"DllName"="iedkcs32.dll"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"NoBackgroundPolicy"= 0000000000 (0)
"NoGPOListChanges"= 0x0000000001 (1)
"NoMachinePolicy"= 0x0000000001 (1)
"NoSlowLink"= 0x0000000001 (1)
"ProcessGroupPolicy"="ProcessGroupPolicy"
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
@="Internet Explorer Branding"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"="scecli.dll"
"NoGPOListChanges"= 0x0000000001 (1)
"NoUserPolicy"= 0x0000000001 (1)
"ProcessGroupPolicy"="SceProcessEFSRecoveryGPO"
"RequiresSuccessfulRegistry"= 0x0000000001 (1)
@="EFS recovery"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
"DllName"="appmgmts.dll"
"EventSources"="(Application Management,Application) (MsiInstaller,Application)"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"NoBackgroundPolicy"= 0000000000 (0)
"NoSlowLink"= 0x0000000001 (1)
"PerUserLocalSettings"= 0x0000000001 (1)
"ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx"
"RequiresSucessfulRegistry"= 0000000000 (0)
@="Software Installation"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
"DllName"="gptext.dll"
"NoGPOListChanges"= 0x0000000001 (1)
"NoUserPolicy"= 0x0000000001 (1)
"ProcessGroupPolicy"="ProcessIPSECPolicy"
@="IP Security"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify]
(No values found)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\AtiExtEvent]
"Asynchronous"= 0000000000 (0)
"Disconnect"="AtiDisConnectEvent"
"DLLName"="Ati2evxx.dll"
"Impersonate"= 0x0000000001 (1)
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"= 0000000000 (0)
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\crypt32chain]
"Asynchronous"= 0000000000 (0)
"DllName"="crypt32.dll"
"Impersonate"= 0000000000 (0)
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\cryptnet]
"Asynchronous"= 0000000000 (0)
"DllName"="cryptnet.dll"
"Impersonate"= 0000000000 (0)
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\cscdll]
"Asynchronous"= 0x0000000001 (1)
"DLLName"="cscdll.dll"
"Impersonate"= 0000000000 (0)
"Logoff"="WinlogonLogoffEvent"
"Logon"="WinlogonLogonEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Startup"="WinlogonStartupEvent"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\ScCertProp]
"Asynchronous"= 0x0000000001 (1)
"DLLName"="wlnotify.dll"
"Enabled"= 0x0000000001 (1)
"Impersonate"= 0x0000000001 (1)
"Lock"="SCardSuspendCertProp"
"Logoff"="SCardStopCertProp"
"Logon"="SCardStartCertProp"
"Unlock"="SCardResumeCertProp"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\Schedule]
"Asynchronous"= 0000000000 (0)
"DllName"="wlnotify.dll"
"Impersonate"= 0000000000 (0)
"Logoff"="SchedEventLogOff"
"StartShell"="SchedStartShell"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\sclgntfy]
"Asynchronous"= 0x0000000001 (1)
"DllName"="sclgntfy.dll"
"Impersonate"= 0000000000 (0)
"Logoff"="WLEventLogoff"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\SensLogn]
"Asynchronous"= 0x0000000001 (1)
"Disconnect"="SensDisconnectEvent"
"DLLName"="WlNotify.dll"
"Impersonate"= 0x0000000001 (1)
"Lock"="SensLockEvent"
"Logoff"="SensLogoffEvent"
"Logon"="SensLogonEvent"
"MaxWait"= 0x0000000258 (600)
"PostShell"="SensPostShellEvent"
"Reconnect"="SensReconnectEvent"
"Safe"= 0x0000000001 (1)
"Shutdown"="SensShutdownEvent"
"StartScreenSaver"="SensStartScreenSaverEvent"
"StartShell"="SensStartShellEvent"
"Startup"="SensStartupEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Unlock"="SensUnlockEvent"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\termsrv]
"Asynchronous"= 0000000000 (0)
"Disconnect"="TSEventDisconnect"
"DllName"="wlnotify.dll"
"Impersonate"= 0000000000 (0)
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"MaxWait"= 0x0000000258 (600)
"PostShell"="TSEventPostShell"
"Reconnect"="TSEventReconnect"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\Notify\wlballoon]
"Asynchronous"= 0x0000000001 (1)
"DLLName"="wlnotify.dll"
"Impersonate"= 0x0000000001 (1)
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Logon"="RegisterTicketExpiredNotificationEvent"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\SCLogon]
(No values found)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\SpecialAccounts]
(No values found)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\SpecialAccounts\UserList]
"HelpAssistant"= 0000000000 (0)
"IUSR_"= 0x0000010000 (65536)
"IWAM_"= 0x0000010000 (65536)
"NetShowServices"= 0000000000 (0)
"SQLAgentCmdExec"= 0000000000 (0)
"TsInternetUser"= 0000000000 (0)
"VUSR_"= 0x0000010000 (65536)


========== file ==========

c:\windows\system32\msqjgu32.exe - Unable to find/read file.

-=End Of File=-

MBAM Log:

Malwarebytes' Anti-Malware 1.44
Database version: 3690
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

04/02/2010 22:01:24
mbam-log-2010-02-04 (22-01-24).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 265492
Time elapsed: 40 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\cleanup.exe.vir (Trojan.Banker) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AF40F866-9500-4581-8825-33476F29E69C}\RP34\A0008216.exe (Trojan.Banker) -> Quarantined and deleted successfully.
Post #40
fingerz,

Good news! Those logs all look clean. We still have work to do though, so stick with me:

Are you using the link I gave you for the Kaspersky scanner? It works for me. ESET would be fine also:

🖼Click to load external image (Posted Image) Please run Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Once that scan in complete, please reinstall your AV and FW.

Please include the following in your next post:
  • Kapsersky (or ESET) log
  • How is your computer running?
Post #41
Hmmm… Bit of a problem… I just re-installed the AV (Avira) and Firewall (Outpost) and I've restarted my computer but neither of them are running. The Outpost icon in the tray is grey and when I hover the mouse over it says "Outpost service not available" and there is no Avira logo at all. In MSconfig I can see all the Avira service entries ticked but nothing for Outpost. Not sure what's going on there, any ideas? I did the Eset online scan, log as follows: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=7.00.5730.13 (longhorn(wmbla).070711-1130) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=78601d7a84950d468c5a21999d0d62e8 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-02-06 03:17:49 # local_time=2010-02-06 03:17:49 (+0000, GMT Standard Time) # country="United Kingdom" # lang=1033 # osver=5.1.2600 NT Service Pack 2 # compatibility_mode=512 16777215 100 0 3154417 3154417 0 0 # compatibility_mode=1280 16777215 100 0 0 0 0 0 # compatibility_mode=1792 16777215 100 0 0 0 0 0 # compatibility_mode=6912 16777215 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 3685 3685 0 0 # scanned=135858 # found=30 # cleaned=0 # scan_time=2401 C:\System Volume Information\_restore{AF40F866-9500-4581-8825-33476F29E69C}\RP34\A0008221.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\WINDOWS\system32\msewrz32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\WINDOWS\system32\mspbqp32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\WINDOWS\system32\mspivq32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\WINDOWS\system32\msukhv32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\WINDOWS\system32\msuxnz32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\WINDOWS\system32\msvrwy32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\WINDOWS\system32\msytrj32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msbnib32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msbuzu32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msddky32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msgeor32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msgike32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msjdwi32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\mslqql32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msmbef32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msnktt32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msosll32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\mspaez32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\mspavm32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msqxjd32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\mssrwh32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\mstjqg32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msuslo32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msuwhl32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msvxlf32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msxbqg32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msyjqc32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\mszjlv32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I C:\_OTM\MovedFiles\01262010_212815\c_windows\system32\msztca32.exe Win32/Spy.Zbot.JF trojan 00000000000000000000000000000000 I
Post #42
fingerz,

I don't have any ideas at the moment about your AV & FW. Let's get rid of the malware first:

🖼Click to load external image (Posted Image) Open OTM
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Files
C:\WINDOWS\system32\msewrz32.exe 
C:\WINDOWS\system32\mspbqp32.exe 
C:\WINDOWS\system32\mspivq32.exe 
C:\WINDOWS\system32\msukhv32.exe 
C:\WINDOWS\system32\msuxnz32.exe 
C:\WINDOWS\system32\msvrwy32.exe 
C:\WINDOWS\system32\msytrj32.exe
:Commands
[emptytemp]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM and reboot your PC.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Please include the following in your next post:
  • OTM log
  • Fresh DDS log
  • How is your computer running?
Post #43 last edited
OTM Log:

All processes killed
========== FILES ==========
C:\WINDOWS\system32\msewrz32.exe moved successfully.
C:\WINDOWS\system32\mspbqp32.exe moved successfully.
C:\WINDOWS\system32\mspivq32.exe moved successfully.
C:\WINDOWS\system32\msukhv32.exe moved successfully.
C:\WINDOWS\system32\msuxnz32.exe moved successfully.
C:\WINDOWS\system32\msvrwy32.exe moved successfully.
C:\WINDOWS\system32\msytrj32.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: Administrator.JAMEYS-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jamey
->Temp folder emptied: 14627332 bytes
->Temporary Internet Files folder emptied: 108108598 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 61677739 bytes
->Google Chrome cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 176.00 mb


OTM by OldTimer - Version 3.1.6.0 log created on 02072010_002138

Files moved on Reboot…

Registry entries deleted on Reboot…

DDS Log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 0:25:30.95 on 07/02/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2623 [GMT 0:00]

FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Agnitum\Outpost Firewall\op_mon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jamey\Desktop\Forums - Whatthetech\02\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [OutpostMonitor] c:\program files\agnitum\outpost firewall\op_mon.exe /tray /noservice
mRun: [OutpostFeedBack] "c:\program files\agnitum\outpost firewall\feedback.exe" /dump:os_startup
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jamey\applic~1\mozilla\firefox\profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2007-12-13 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [2009-12-18 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-1 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2007-5-26 77312]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2001-12-19 8576]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-27 56816]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2007-12-13 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-10-16 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2005-3-27 14416]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2008-4-17 44032]
S0 vkquwexg;vkquwexg;c:\windows\system32\drivers\combo-fix.sys –> c:\windows\system32\drivers\Combo-Fix.sys [?]
S1 avgio;avgio;\??\c:\program files\avira\antivir desktop\avgio.sys –> c:\program files\avira\antivir desktop\avgio.sys [?]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\avira\antivir desktop\sched.exe" –> c:\program files\avira\antivir desktop\sched.exe [?]
S2 AntiVirService;Avira AntiVir Guard;"c:\program files\avira\antivir desktop\avguard.exe" –> c:\program files\avira\antivir desktop\avguard.exe [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [2007-5-26 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [2005-3-27 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2009-3-21 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [2007-5-26 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-02-06 15:45 –d—– c:\program files\iPod
2010-02-06 15:44 –d—– c:\program files\iTunes
2010-02-06 15:32 704,384 a——- c:\windows\system32\drivers\SandBox.sys
2010-02-06 15:32 257,432 a——- c:\windows\system32\drivers\afwcore.sys
2010-02-06 15:30 49 a——- c:\windows\transp.gif
2010-02-06 15:30 –d—– c:\program files\Agnitum
2010-02-06 15:30 –d—– c:\docume~1\alluse~1\applic~1\Agnitum
2010-01-31 22:43 11,732 a——- C:\backup.reg
2010-01-31 22:43 135,168 a——- C:\zip.exe
2010-01-31 22:43 574 a——- C:\cleanup.bat
2010-01-31 00:28 –d—– c:\windows\system32\wbem\Repository
2010-01-27 22:22 –d—– C:\Rooter$
2010-01-26 23:16 261,632 a——- c:\windows\PEV.exe
2010-01-26 23:16 161,792 a——- c:\windows\SWREG.exe
2010-01-26 23:16 98,816 a——- c:\windows\sed.exe
2010-01-26 23:16 77,312 a——- c:\windows\MBR.exe
2010-01-26 21:28 –d—– C:\_OTM
2010-01-18 11:40 411,368 a——- c:\windows\system32\deploytk.dll
2010-01-18 11:40 73,728 a——- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2010-02-07 00:21 1,860,322 a——- c:\windows\cscmondump.bin
2010-01-07 16:07 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-04 12:59 134,173 a——- c:\windows\cscmon.bin
2010-01-03 19:19 77,312 a——- c:\windows\system32\drivers\viasraid.sys
2010-01-03 19:18 77,312 a——- c:\windows\system32\drivers\viasraid.tsk
2009-12-28 13:40 56,816 a——- c:\windows\system32\drivers\avgntflt.sys
2009-12-24 13:53 1,474,832 a——- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 1,984 a——- c:\windows\system32\d3d9caps.dat
2009-12-02 13:19 15,880 a——- c:\windows\system32\lsdelete.exe
2009-11-08 18:55 22,328 a——- c:\docume~1\jamey\applic~1\PnkBstrK.sys
2009-11-08 18:51 107,832 a——- c:\docume~1\jamey\applic~1\PnkBstrB.exe

============= FINISH: 0:25:48.06 ===============
Post #44 last edited
fingerz,

At this point, I don't see any malware in your logs, but there are bits and pieces of Comodo, Outpost and Avira hanging around in there. Try running the Comodo removal tool again then check these two links for uninstall / reinstall instructions for Avira and Outpost:

Outpost
Avira

Let me know how that goes.

Please include the following in your next post:
  • AV & FW status
  • How is your computer running?
Post #45
Ok, I've managed to get Avira working again but Outpost still has one problem.

Upon bootup I get the following message:

[external image: Posted Image]

I've Googled the message and looked on Agnitum's forum but it just points back to the same instructions you posted basically.

Not sure how important that driver is, though. Outpost still seems to be working.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI