What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] can't update security ............

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Firstly, Avg stopped working.Downloaded new version but had trouble installing. Downloaded Avast which installed but would update. On running Avast it found a 8 Win32 Malware Gen files(4 involume information) and 2 Java : Binny. These were moved to vault. I then downloaded and ran Malwarebytes and it detected infected registry keys and values and other folders mainly involving Mywebsearch and FunWebProducts. Also TROJAN AGENT HILOTI found and deleted These were deleted. But still the problems of updating Avast and Adware etc remain. Also still cannot connect to internet or Outlook Express without disabling Avast. I have Commodo,Spyguard, Spywareblaster and Winpatrol running. Nothing found in last Malwarebytes scan GMER and Malwarebytes logs are below as attachments Pete Manchester UK . .DO[attachment removed]

Attachments:

Post #2
Hi pid100, welcome to the forum.


To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.


Given your discription of the issues with avast, I would say Comodo is blocking avast from accessing the internet.


In Comodo make sure these 3 processes have internet access
  • avast.setup
  • ashMaisv.exe
  • ashWebsv.exe
The first is the updater, the second your mail and the third is internet.


You didn't include the DDS log in your post. Please run DDS and post just the DDS.txt.

Let us know how you make out.

Thanks
Post #3
hi Went on Commodo and managed to activate proceesses as instructed above. Avast immediately updated itself and can now get on internet and receive emails. I think that Commodo had updated itself at sometime and i had needed to activate the updated configurations. ? dds. text log - DDS (Ver_09-06-26.01) - FAT32x86 Run by [removed] at 19:14:07.96 on 10/02/2010 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_05 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.212 [GMT 0:00] AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch SVCHOST.EXE C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup SVCHOST.EXE SVCHOST.EXE C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\system32\spoolsv.exe SVCHOST.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\sistray.EXE C:\Program Files\Multimedia Keyboard\PS2USBKbdDrv.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\COMODO\COMODO Internet Security\cfp.exe C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Documents and Settings\pete\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearch Page = uDefault_Search_URL = uStart Page = hxxp://www.google.co.uk/ uDefault_Page_URL = mDefault_Search_URL = hxxp://www.google.com/ie mSearch Page = hxxp://www.google.com mStart Page = Ze2 mSearch Bar = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = 127.0.0.1 uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/keyword/%s mSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: ST: {9394ede7-c8b5-483e-8773-474bf36af6e4} - c:\program files\msn apps\st\01.03.0000.1005\en-xu\stmain.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: MSNToolBandBHO: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\msn toolbar\01.02.5000.1021\en-us\msntb.dll BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll TB: MSN: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\msn toolbar\01.02.5000.1021\en-us\msntb.dll TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [EPSON Stylus Photo R265 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatibne.exe /fu "c:\windows\temp\E_S222.tmp" /EF "HKCU" mRun: [SiSUSBRG] c:\windows\SiSUSBrg.exe mRun: [SiS Tray] c:\windows\system32\sistray.EXE mRun: [SiS Windows KeyHook] c:\windows\system32\keyhook.exe mRun: [WireLessKeyboard] c:\program files\multimedia keyboard\PS2USBKbdDrv.exe mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [D-Link D-Link Wireless N DWA-140] c:\program files\d-link\d-link wireless n dwa-140\AirNCFG.exe mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\pete\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe IE: &Search IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll Trusted Zone: moove.com DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {00000161-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/msaudio.cab DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} - hxxp://musicmix.messenger.msn.com/Medialogic.CAB DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab AppInit_DLLs: c:\windows\system32\guard32.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll LSA: Notification Packages = scecli lsanp ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\pete\applic~1\mozilla\firefox\profiles\7be4294a.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/ FF - prefs.js: network.proxy.type - 4 FF - component: c:\documents and settings\pete\application data\mozilla\firefox\profiles\7be4294a.default\extensions\[removed]\components\coolirisstub.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess"); c:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess"); c:\program files\mozilla firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess"); ============= SERVICES / DRIVERS =============== R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-2-5 163280] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-8-24 134344] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-8-24 25160] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-2-5 19024] R2 GenPort;GenPort;c:\windows\system32\drivers\genport.sys [2005-4-20 4832] R2 MapMem;MapMem;c:\windows\system32\drivers\MAPMEM.SYS [2005-4-20 6816] R2 NTRemap;NTRemap;c:\windows\system32\drivers\NTREMAP.SYS [2005-4-20 6336] S0 bdhabijg;bdhabijg;c:\windows\system32\drivers\bdhabijg.sys –> c:\windows\system32\drivers\bdhabijg.sys [?] S0 gjhbcdid;gjhbcdid;c:\windows\system32\drivers\gjhbcdid.sys –> c:\windows\system32\drivers\gjhbcdid.sys [?] S0 hebedgbg;hebedgbg; [x] S1 SiSEsc;SISLIB_ESC;c:\windows\system32\sisesc.sys [2005-4-4 28416] S2 https;https;\??\c:\windows\system32\drivers\https.sys –> c:\windows\system32\drivers\https.sys [?] S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-12-21 13224] S3 iMSPQMn;iMSPQMn;\??\c:\docume~1\pete\locals~1\temp\imspqmn.sys –> c:\docume~1\pete\locals~1\temp\iMSPQMn.sys [?] S3 MadgeTRN;Madge Token-Ring Adapter NDIS5 Driver;c:\windows\system32\drivers\mdgndis5.sys [2006-9-11 164586] S3 PAC207;SoC PC-Camer@;c:\windows\system32\drivers\pfc027.sys –> c:\windows\system32\drivers\pfc027.sys [?] S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2007-3-9 25773] S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2010-1-24 476416] S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;c:\windows\system32\drivers\usbscan.sys [2005-5-5 15104] S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [2009-8-11 81832] S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [2009-8-11 13864] S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [2009-8-11 107304] S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s816mgmt.sys [2009-8-11 99112] S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\drivers\s816nd5.sys [2009-8-11 21928] S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [2009-8-11 97320] S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\drivers\s816unic.sys [2009-8-11 97704] S3 usb2vcom;USB Data Cable;c:\windows\system32\drivers\usb2vcom.sys [2006-8-2 29152] =============== Created Last 30 ================ 2010-02-09 14:30 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-09 14:30 19,160 a——- c:\windows\system32\drivers\mbam.sys 2010-02-09 14:30 –d—– c:\program files\Malwarebytes' Anti-Malware 2010-02-09 11:18 –dsh— C:\FOUND.070 2010-02-08 17:10 –d—– c:\program files\YouTube Downloader 2010-02-07 21:21 –d—– c:\docume~1\pete\applic~1\Malwarebytes 2010-02-07 21:18 –d—– c:\docume~1\alluse~1.win\applic~1\Malwarebytes 2010-02-05 20:11 –d—– c:\docume~1\alluse~1.win\applic~1\Alwil Software 2010-01-26 18:39 3,284 a——- c:\windows\system32\ANIWZCS{962B5B47-5E88-4350-A0CB-F717AC6E0D10} 2010-01-25 12:52 –dsh— C:\FOUND.069 2010-01-24 19:47 5 a——- c:\windows\system32\ANIWZCSUSERNAME{962B5B47-5E88-4350-A0CB-F717AC6E0D10} 2010-01-24 19:47 1,327,189 a——- c:\windows\system32\odSupp_M.dll 2010-01-24 19:47 249,856 a——- c:\windows\system32\wnicapi.dll 2010-01-24 19:47 225,280 a——- c:\windows\system32\WlanApp.dll 2010-01-24 19:47 204,800 a——- c:\windows\system32\aIPH.dll 2010-01-24 19:47 49,152 a——- c:\windows\system32\JJAKEn.dll 2010-01-24 19:47 667,648 a——- c:\windows\system32\ANIWZCS2.dll 2010-01-24 19:47 49,152 a——- c:\windows\system32\AQCKGen.dll 2010-01-24 19:47 45,115 a——- c:\windows\system32\ANICtl.dll 2010-01-24 19:46 48,128 a——- c:\windows\system32\ANIO64.sys 2010-01-24 19:46 36,864 a——- c:\windows\system32\ANIOApi.dll 2010-01-24 19:46 28,195 a——- c:\windows\system32\ANIO.sys 2010-01-24 19:46 16,997 a——- c:\windows\system32\ANIO.VXD 2010-01-24 19:46 11,904 a——- c:\windows\system32\anio4.sys 2010-01-24 19:46 –d—– c:\program files\ANI 2010-01-24 19:45 –d—– c:\program files\D-Link 2010-01-24 19:43 476,416 a——- c:\windows\system32\drivers\rt2870.sys 2010-01-23 12:20 –dsh— C:\FOUND.068 2010-01-12 19:11 470,528 ——– c:\windows\system32\dllcache\aclayers.dll ==================== Find3M ==================== 2010-02-02 15:51 171,552 a——- c:\windows\system32\guard32.dll 2010-02-02 15:51 134,344 a——- c:\windows\system32\drivers\cmdguard.sys 2010-01-31 21:11 25,160 a——- c:\windows\system32\drivers\cmdhlp.sys 2009-12-21 22:01 0 a—h— c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf 2009-12-21 22:01 0 a—h— c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-12-21 21:55 1,112,288 a——- c:\windows\system32\WdfCoInstaller01007.dll 2009-12-21 21:55 25,512 a——- c:\windows\system32\drivers\ggsemc.sys 2009-12-21 21:55 13,224 a——- c:\windows\system32\drivers\ggflt.sys 2009-12-16 12:57 18,432 ——– c:\windows\system32\dllcache\iedw.exe 2009-12-08 09:13 474,112 ——– c:\windows\system32\dllcache\shlwapi.dll 2009-11-21 16:36 470,528 a——- c:\windows\apppatch\AcLayers.dll 2007-02-25 11:58 132 a——- c:\program files\2.ini 2006-07-06 19:15 365 a——- c:\program files\Shortcut to iTunes.lnk 2005-04-01 13:11 266 —sh— c:\program files\desktop.ini 2005-04-01 13:11 11,079 —-h— c:\program files\folder.htt 2004-09-03 10:32 3,488 a——- c:\windows\inf\other\cmiainfo.sys 2006-08-25 16:05 10,856 a–sh— c:\windows\system32\KGyGaAvL.sys ============= FINISH: 19:14:59.51 ===============
Post #4 last edited
Hi pid100,

I think that Commodo had updated itself at sometime and i had needed to activate the updated configurations. ?

Is that a message from Comodo?



You have something going on in this commputer. Let's have a look.

Go HERE to get a new copy of GMER . Scroll down to the Download section and click Download EXE. Save it to your desktop.

Before scanning with GMER, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

  • Double click on the file you downloaded. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER will not run in normal windows, please boot to safe mode and run it from there.

Please post back with
  • GMER log
Post #5
" I think that Commodo had updated itself at sometime and i had needed to activate the updated configurations. ? " no, just my own interpretation.
Post #6
okay, here is the Gmer log………………………….


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-11 21:48:33
Windows 5.1.2600 Service Pack 2
Running: 7xy0cvkl.exe; Driver: C:\DOCUME~1\pete\LOCALS~1\Temp\uwlyqpog.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0xF6C67BDA]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xF6A64C78]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwConnectPort [0xF6C671B8]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateFile [0xF6C67840]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xF6A64B34]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreatePort [0xF6C6709A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSection [0xF6C6906A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0xF6C69302]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThread [0xF6C66C60]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xF6A650E8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xF6A65012]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xF6A6470A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwLoadDriver [0xF6C68CEC]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwMakeTemporaryObject [0xF6C6743C]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenFile [0xF6C67A1C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xF6A64C0E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xF6A6464A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenSection [0xF6C676CC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xF6A646AE]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xF6A64D2E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xF6A651B6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0xF6C69648]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xF6A64CEE]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSecureConnectPort [0xF6C68A88]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSecurityObject [0xF6C67DC0]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSystemInformation [0xF6C68E9A]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xF6A64E6E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwShutdownSystem [0xF6C673D6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSystemDebugControl [0xF6C675C0]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateProcess [0xF6C66F64]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateThread [0xF6C66E32]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Fastfat \FatCdrom aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \FileSystem\Fastfat \Fat aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Fastfat \Fat sisidex.sys (SISIDEX Driver/Windows ® 2000 DDK provider)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

—- Registry - GMER 1.0.15 —-

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0BA455AE-9518-0821-0F5B-9073B48517BA}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0BA455AE-9518-0821-0F5B-9073B48517BA}@iabnffplobebhdcpje 0x6B 0x61 0x6C 0x65 …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0BA455AE-9518-0821-0F5B-9073B48517BA}@hahmlooiffbeldka 0x6B 0x61 0x6C 0x65 …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{30F72C79-D30B-4DEA-0A7F-31336951D0E9}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{30F72C79-D30B-4DEA-0A7F-31336951D0E9}@iahnhnljmnedhoehpm 0x6B 0x61 0x6D 0x6B …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{30F72C79-D30B-4DEA-0A7F-31336951D0E9}@hajnbmidllbnhjoe 0x6B 0x61 0x6C 0x6B …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F15AC8E5-391A-00C9-1D75-66D955CD3428}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F15AC8E5-391A-00C9-1D75-66D955CD3428}@oaenkfflgjligbgdjahoboigkhhmfm 0x64 0x61 0x65 0x64 …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F15AC8E5-391A-00C9-1D75-66D955CD3428}@oaaakmmgjkfpfeipgifcofnfmmgmop 0x6B 0x61 0x62 0x64 …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F15AC8E5-391A-00C9-1D75-66D955CD3428}@nagpihkmbcchaglnehdaahnimini 0x69 0x61 0x6E 0x66 …

—- EOF - GMER 1.0.15 —-
Post #7
Hi pid100,

Please read through these instructions to familarize yourself with what to expect when this tool runs


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with he combofix log.

How is the computer?

Thanks
Post #8
hi
Computer seems ok as regards to internet connections , e mail downloads and program updates.

Here is ComboFix log -



ComboFix 10-02-11.04 - pete 12/02/2010 12:07:42.1.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.236 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\_NIM4711.TMP
c:\documents and settings\gillian\My Documents\ZbThumbnail.info
c:\documents and settings\kate\Local Settings\Application Data\Baidu
c:\documents and settings\kate\My Documents\ZbThumbnail.info
c:\documents and settings\lucy\My Documents\ZbThumbnail.info
c:\documents and settings\pete\My Documents\26.6.06.reg
c:\documents and settings\pete\My Documents\ZbThumbnail.info
C:\LOG569.tmp
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\program files\temp
C:\test.txt
c:\windows\inf\68000.pnf
c:\windows\system32\dumphive.exe
c:\windows\system32\Process.exe
c:\windows\system32\skinboxer43.dll
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\Vbshell.tlb
c:\windows\system32\wbem\mof\good\esery.mof

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_I82440BX


((((((((((((((((((((((((( Files Created from 2010-01-12 to 2010-02-12 )))))))))))))))))))))))))))))))
.

2010-02-11 19:14 . 2010-02-11 19:14 ——– d—–w- C:\FOUND.071
2010-02-09 14:30 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-09 14:30 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-09 14:30 . 2010-02-09 14:30 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-09 14:28 . 2010-02-09 14:28 ——– d—–w- c:\program files\ERUNT
2010-02-09 11:18 . 2010-02-09 11:18 ——– d—–w- C:\FOUND.070
2010-02-08 17:10 . 2010-02-08 17:10 ——– d—–w- c:\program files\YouTube Downloader
2010-02-07 21:21 . 2010-02-07 21:21 ——– d—–w- c:\documents and settings\pete\Application Data\Malwarebytes
2010-02-07 21:18 . 2010-02-07 21:18 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-02-05 20:14 . 2010-02-11 18:38 19024 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-05 20:14 . 2010-02-11 18:42 162512 —-a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-05 20:14 . 2010-02-11 18:39 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-05 20:13 . 2010-02-11 18:42 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-05 20:13 . 2010-02-11 18:38 100432 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-05 20:13 . 2010-02-11 18:38 94800 —-a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-05 20:13 . 2010-02-11 18:38 28880 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-05 20:12 . 2010-02-11 18:53 38848 —-a-w- c:\windows\system32\avastSS.scr
2010-02-05 20:12 . 2010-02-11 18:53 153184 —-a-w- c:\windows\system32\aswBoot.exe
2010-02-05 20:11 . 2010-02-05 20:11 ——– d—–w- c:\program files\Alwil Software
2010-02-05 20:11 . 2010-02-05 20:11 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Alwil Software
2010-01-25 12:52 . 2010-01-25 12:52 ——– d—–w- C:\FOUND.069
2010-01-24 19:47 . 2007-03-15 10:13 249856 —-a-w- c:\windows\system32\wnicapi.dll
2010-01-24 19:47 . 2007-03-09 14:00 225280 —-a-w- c:\windows\system32\WlanApp.dll
2010-01-24 19:47 . 2007-02-08 13:55 204800 —-a-w- c:\windows\system32\aIPH.dll
2010-01-24 19:47 . 2005-10-27 08:55 49152 —-a-w- c:\windows\system32\JJAKEn.dll
2010-01-24 19:47 . 2005-10-19 18:19 1327189 —-a-w- c:\windows\system32\odSupp_M.dll
2010-01-24 19:47 . 2007-03-13 15:22 667648 —-a-w- c:\windows\system32\ANIWZCS2.dll
2010-01-24 19:47 . 2006-09-26 13:49 45115 —-a-w- c:\windows\system32\ANICtl.dll
2010-01-24 19:47 . 2005-10-19 18:19 49152 —-a-w- c:\windows\system32\AQCKGen.dll
2010-01-24 19:46 . 2005-12-13 10:38 48128 —-a-w- c:\windows\system32\ANIO64.sys
2010-01-24 19:46 . 2005-12-11 11:55 28195 —-a-w- c:\windows\system32\ANIO.sys
2010-01-24 19:46 . 2005-10-21 15:56 36864 —-a-w- c:\windows\system32\ANIOApi.dll
2010-01-24 19:46 . 2004-10-14 10:29 11904 —-a-w- c:\windows\system32\anio4.sys
2010-01-24 19:46 . 2010-01-24 19:46 ——– d—–w- c:\program files\ANI
2010-01-24 19:45 . 2010-01-24 19:45 ——– d—–w- c:\program files\D-Link
2010-01-24 19:43 . 2007-03-13 12:35 476416 —-a-w- c:\windows\system32\drivers\rt2870.sys
2010-01-23 12:20 . 2010-01-23 12:20 ——– d—–w- C:\FOUND.068

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-10 22:11 . 2010-02-10 22:11 8406648 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\gtb_us\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-02-10 22:11 . 2010-02-10 22:10 10309448 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\chr\ChromeInstaller.exe
2010-02-10 22:10 . 2010-02-10 22:10 64000 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\RUP\inst_config\gcapi_dll.dll
2010-02-10 22:10 . 2010-02-10 22:10 52288 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\RUP\inst_config\gtapi.dll
2010-02-10 22:10 . 2010-02-10 22:10 50688 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\RUP\inst_config\fftbapi.dll
2010-02-10 22:10 . 2010-02-10 22:10 114688 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\RUP\inst_config\compat.dll
2010-02-02 15:51 . 2009-08-24 22:29 171552 —-a-w- c:\windows\system32\guard32.dll
2010-02-02 15:51 . 2009-08-24 22:29 134344 —-a-w- c:\windows\system32\drivers\cmdguard.sys
2010-01-31 21:11 . 2009-08-24 22:29 87104 —-a-w- c:\windows\system32\drivers\inspect.sys
2010-01-31 21:11 . 2009-08-24 22:29 25160 —-a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-01-04 12:40 . 2010-02-02 15:50 2066200 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgcorex.dll
2009-12-31 16:14 . 2001-08-23 12:00 352640 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:42 . 2002-08-29 03:41 662016 —-a-w- c:\windows\system32\wininet.dll
2009-12-22 05:42 . 2005-04-04 12:25 81920 ——w- c:\windows\system32\ieencode.dll
2009-12-21 22:01 . 2009-12-21 22:01 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2009-12-21 22:01 . 2009-12-21 22:01 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-12-21 21:55 . 2009-12-21 21:55 25512 —-a-w- c:\windows\system32\drivers\ggsemc.sys
2009-12-21 21:55 . 2009-12-21 21:55 13224 —-a-w- c:\windows\system32\drivers\ggflt.sys
2009-12-21 21:55 . 2009-12-21 21:55 1112288 —-a-w- c:\windows\system32\WdfCoInstaller01007.dll
2009-12-16 12:58 . 2006-06-20 12:28 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-08 18:53 . 2002-08-29 01:04 2136064 —-a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:19 . 2002-08-29 01:04 2015744 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 14:41 . 2002-08-29 01:59 453760 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:33 . 2002-08-29 03:41 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:33 . 2001-08-17 22:36 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:37 . 2002-08-29 03:41 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:37 . 2002-08-29 03:40 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:37 . 2001-08-23 12:00 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:37 . 2001-08-17 22:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:37 . 2001-08-17 22:36 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-22 16:44 . 2009-11-22 16:44 17245680 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\rp\RealPlayerSPGold.exe
2009-11-21 16:36 . 2002-08-29 03:40 470528 —-a-w- c:\windows\AppPatch\AcLayers.dll
2007-02-25 11:58 . 2007-02-25 11:57 132 —-a-w- c:\program files\2.ini
2006-07-06 19:15 . 2006-07-06 19:15 365 —-a-w- c:\program files\Shortcut to iTunes.lnk
2005-04-01 13:11 . 2005-04-01 13:11 11079 —h–w- c:\program files\folder.htt
2006-08-25 16:05 . 2006-08-25 16:05 10856 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"SiS Tray"="c:\windows\System32\sistray.EXE" [2003-08-19 667648]
"SiS Windows KeyHook"="c:\windows\System32\keyhook.exe" [2003-08-19 241664]
"WireLessKeyboard"="c:\program files\Multimedia Keyboard\PS2USBKbdDrv.exe" [2005-05-12 233472]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2007-10-26 292152]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"D-Link D-Link Wireless N DWA-140"="c:\program files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe" [2007-03-14 1388544]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-01-31 1800464]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-17 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\lucy\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2006-2-16 81920]

c:\documents and settings\pete\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^RealDownload.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\RealDownload.lnk
backup=c:\windows\pss\RealDownload.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^pete^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
backup=c:\windows\pss\Microsoft Find Fast.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^pete^Start Menu^Programs^Startup^Office Startup.lnk]
backup=c:\windows\pss\Office Startup.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
2003-01-27 17:16 376912 —-a-w- c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-11-20 13:20 290088 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 11:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2006-11-06 08:27 200704 —-a-w- c:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-11-04 10:30 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
2005-04-26 04:22 589824 —-a-r- c:\program files\VIA\RAID\raid_tool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2008-04-17 19:46 214560 —-a-w- c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-12-15 03:23 75520 —-a-w- c:\program files\Java\jre1.5.0_11\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-04-17 19:46 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
2005-03-11 10:33 147456 —-a-r- c:\windows\system32\VTTrayp.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\PETE\\My Documents\\my programs\\utorrent.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [05/02/2010 20:14 162512]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [24/08/2009 22:29 134344]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [24/08/2009 22:29 25160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [05/02/2010 20:14 19024]
R2 GenPort;GenPort;c:\windows\system32\drivers\genport.sys [20/04/2005 21:41 4832]
R2 MapMem;MapMem;c:\windows\system32\drivers\MAPMEM.SYS [20/04/2005 21:41 6816]
R2 NTRemap;NTRemap;c:\windows\system32\drivers\NTREMAP.SYS [20/04/2005 21:41 6336]
S0 bdhabijg;bdhabijg;c:\windows\system32\drivers\bdhabijg.sys –> c:\windows\system32\drivers\bdhabijg.sys [?]
S0 gjhbcdid;gjhbcdid;c:\windows\system32\drivers\gjhbcdid.sys –> c:\windows\system32\drivers\gjhbcdid.sys [?]
S0 hebedgbg;hebedgbg; [x]
S1 SiSEsc;SISLIB_ESC;c:\windows\system32\sisesc.sys [04/04/2005 12:09 28416]
S2 https;https;\??\c:\windows\system32\drivers\https.sys –> c:\windows\system32\drivers\https.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [21/12/2009 21:55 13224]
S3 iMSPQMn;iMSPQMn;\??\c:\docume~1\pete\LOCALS~1\Temp\iMSPQMn.sys –> c:\docume~1\pete\LOCALS~1\Temp\iMSPQMn.sys [?]
S3 MadgeTRN;Madge Token-Ring Adapter NDIS5 Driver;c:\windows\system32\drivers\mdgndis5.sys [11/09/2006 16:52 164586]
S3 PAC207;SoC PC-Camer@;c:\windows\system32\DRIVERS\pfc027.sys –> c:\windows\system32\DRIVERS\pfc027.sys [?]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [09/03/2007 19:32 25773]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [24/01/2010 19:43 476416]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;c:\windows\system32\drivers\usbscan.sys [05/05/2005 09:10 15104]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [11/08/2009 17:58 81832]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [11/08/2009 18:37 13864]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [11/08/2009 18:37 107304]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s816mgmt.sys [11/08/2009 18:37 99112]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\drivers\s816nd5.sys [11/08/2009 18:37 21928]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [11/08/2009 18:37 97320]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\drivers\s816unic.sys [11/08/2009 18:37 97704]
S3 usb2vcom;USB Data Cable;c:\windows\system32\drivers\usb2vcom.sys [02/08/2006 09:30 29152]
.
Contents of the 'Scheduled Tasks' folder

2010-02-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL =
uStart Page = hxxp://www.google.co.uk/
mStart Page = Ze2
mSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Search
Trusted Zone: moove.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\pete\Application Data\Mozilla\Firefox\Profiles\7be4294a.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\pete\Application Data\Mozilla\Firefox\Profiles\7be4294a.default\extensions\[removed]\components\coolirisstub.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Cmaudio - cmicnfg.cpl
MSConfigStartUp-!AVG Anti-Spyware - c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
MSConfigStartUp-RealJukeboxSystray - c:\program files\Real\RealJukebox\tsystray.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
MSConfigStartUp-Tau Monitor - c:\program files\Agnitum\Tauscan 1.7\Taumon.exe
MSConfigStartUp-workflow - d:\installs\workflow.exe
MSConfigStartUp-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-12 12:28
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1614895754-1993962763-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0BA455AE-9518-0821-0F5B-9073B48517BA}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iabnffplobebhdcpje"=hex:6b,61,6c,65,6e,6b,6b,6d,69,68,6b,68,63,67,62,64,6d,61,
62,6a,6a,69,00,00
"hahmlooiffbeldka"=hex:6b,61,6c,65,6f,6b,68,6d,62,68,6e,67,69,68,69,6e,6b,6b,
70,66,6f,6e,00,00

[HKEY_USERS\S-1-5-21-1614895754-1993962763-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{30F72C79-D30B-4DEA-0A7F-31336951D0E9}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iahnhnljmnedhoehpm"=hex:6b,61,6d,6b,6b,63,6e,6d,69,6c,64,6c,6b,63,6f,6d,70,68,
67,6e,68,64,00,00
"hajnbmidllbnhjoe"=hex:6b,61,6c,6b,64,63,65,6d,63,6d,63,6f,6b,67,63,64,62,68,
67,6b,61,6d,00,00

[HKEY_USERS\S-1-5-21-1614895754-1993962763-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F15AC8E5-391A-00C9-1D75-66D955CD3428}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oaenkfflgjligbgdjahoboigkhhmfm"=hex:64,61,65,64,6b,6c,64,63,00,80
"oaaakmmgjkfpfeipgifcofnfmmgmop"=hex:6b,61,62,64,65,6d,63,67,61,6b,6d,69,6d,66,
70,68,69,68,67,65,69,6f,00,00
"nagpihkmbcchaglnehdaahnimini"=hex:69,61,6e,66,64,6e,6a,66,70,66,66,6b,68,63,
6b,62,68,70,00,00
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3780)
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\System32\PAStiSvc.exe
c:\program files\SpywareGuard\sgbhp.exe
.
**************************************************************************
.
Completion time: 2010-02-12 12:35:17 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-12 12:35
ComboFix2.txt 2007-03-13 14:23

Pre-Run: 17,412,128,768 bytes free
Post-Run: 20,180,631,552 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 36BA2A8E745F54630EC1B040DE6121F3
Post #9
Hi pid100,

LimeWire
You have LimeWire, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall LimeWire, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\windows\system32\drivers\bdhabijg.sys 
c:\windows\system32\drivers\gjhbcdid.sys 

Driver::
bdhabijg
gjhbcdid
hebedgbg

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]




You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with
  • combofix log
  • MBAM log
Thanks
Post #10
hi again
Why did we run ComboFix again?
There was an error when i tried to update Malwarebytes
Nothing malicious was found by MBAM

Here is the Combofix and MBAM logs -




ComboFix 10-02-11.04 - pete 12/02/2010 21:11:31.2.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.264 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\pete\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

FILE ::
"c:\windows\system32\drivers\bdhabijg.sys"
"c:\windows\system32\drivers\gjhbcdid.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_bdhabijg
——-\Service_gjhbcdid
——-\Service_hebedgbg


((((((((((((((((((((((((( Files Created from 2010-01-12 to 2010-02-12 )))))))))))))))))))))))))))))))
.

2010-02-11 19:14 . 2010-02-11 19:14 ——– d—–w- C:\FOUND.071
2010-02-10 22:11 . 2010-02-10 22:11 8406648 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\gtb_us\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-02-10 22:10 . 2010-02-10 22:11 10309448 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\chr\ChromeInstaller.exe
2010-02-10 22:10 . 2010-02-10 22:10 64000 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\RUP\inst_config\gcapi_dll.dll
2010-02-10 22:10 . 2010-02-10 22:10 52288 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\RUP\inst_config\gtapi.dll
2010-02-10 22:10 . 2010-02-10 22:10 50688 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\RUP\inst_config\fftbapi.dll
2010-02-10 22:10 . 2010-02-10 22:10 114688 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\RUP\inst_config\compat.dll
2010-02-09 14:30 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-09 14:30 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-09 14:30 . 2010-02-09 14:30 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-09 14:28 . 2010-02-09 14:28 ——– d—–w- c:\program files\ERUNT
2010-02-09 11:18 . 2010-02-09 11:18 ——– d—–w- C:\FOUND.070
2010-02-08 17:10 . 2010-02-08 17:10 ——– d—–w- c:\program files\YouTube Downloader
2010-02-07 21:21 . 2010-02-07 21:21 ——– d—–w- c:\documents and settings\pete\Application Data\Malwarebytes
2010-02-07 21:18 . 2010-02-07 21:18 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2010-02-05 20:14 . 2010-02-11 18:38 19024 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-05 20:14 . 2010-02-11 18:42 162512 —-a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-05 20:14 . 2010-02-11 18:39 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-05 20:13 . 2010-02-11 18:42 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-05 20:13 . 2010-02-11 18:38 100432 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-05 20:13 . 2010-02-11 18:38 94800 —-a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-05 20:13 . 2010-02-11 18:38 28880 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-05 20:12 . 2010-02-11 18:53 38848 —-a-w- c:\windows\system32\avastSS.scr
2010-02-05 20:12 . 2010-02-11 18:53 153184 —-a-w- c:\windows\system32\aswBoot.exe
2010-02-05 20:11 . 2010-02-05 20:11 ——– d—–w- c:\program files\Alwil Software
2010-02-05 20:11 . 2010-02-05 20:11 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Alwil Software
2010-01-25 12:52 . 2010-01-25 12:52 ——– d—–w- C:\FOUND.069
2010-01-24 19:47 . 2007-03-15 10:13 249856 —-a-w- c:\windows\system32\wnicapi.dll
2010-01-24 19:47 . 2007-03-09 14:00 225280 —-a-w- c:\windows\system32\WlanApp.dll
2010-01-24 19:47 . 2007-02-08 13:55 204800 —-a-w- c:\windows\system32\aIPH.dll
2010-01-24 19:47 . 2005-10-27 08:55 49152 —-a-w- c:\windows\system32\JJAKEn.dll
2010-01-24 19:47 . 2005-10-19 18:19 1327189 —-a-w- c:\windows\system32\odSupp_M.dll
2010-01-24 19:47 . 2007-03-13 15:22 667648 —-a-w- c:\windows\system32\ANIWZCS2.dll
2010-01-24 19:47 . 2006-09-26 13:49 45115 —-a-w- c:\windows\system32\ANICtl.dll
2010-01-24 19:47 . 2005-10-19 18:19 49152 —-a-w- c:\windows\system32\AQCKGen.dll
2010-01-24 19:46 . 2005-12-13 10:38 48128 —-a-w- c:\windows\system32\ANIO64.sys
2010-01-24 19:46 . 2005-12-11 11:55 28195 —-a-w- c:\windows\system32\ANIO.sys
2010-01-24 19:46 . 2005-10-21 15:56 36864 —-a-w- c:\windows\system32\ANIOApi.dll
2010-01-24 19:46 . 2004-10-14 10:29 11904 —-a-w- c:\windows\system32\anio4.sys
2010-01-24 19:46 . 2010-01-24 19:46 ——– d—–w- c:\program files\ANI
2010-01-24 19:45 . 2010-01-24 19:45 ——– d—–w- c:\program files\D-Link
2010-01-24 19:43 . 2007-03-13 12:35 476416 —-a-w- c:\windows\system32\drivers\rt2870.sys
2010-01-23 12:20 . 2010-01-23 12:20 ——– d—–w- C:\FOUND.068

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-02 15:51 . 2009-08-24 22:29 171552 —-a-w- c:\windows\system32\guard32.dll
2010-02-02 15:51 . 2009-08-24 22:29 134344 —-a-w- c:\windows\system32\drivers\cmdguard.sys
2010-01-31 21:11 . 2009-08-24 22:29 87104 —-a-w- c:\windows\system32\drivers\inspect.sys
2010-01-31 21:11 . 2009-08-24 22:29 25160 —-a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-12-31 16:14 . 2001-08-23 12:00 352640 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:42 . 2002-08-29 03:41 662016 ——w- c:\windows\system32\wininet.dll
2009-12-22 05:42 . 2005-04-04 12:25 81920 ——w- c:\windows\system32\ieencode.dll
2009-12-21 22:01 . 2009-12-21 22:01 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2009-12-21 22:01 . 2009-12-21 22:01 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-12-21 21:55 . 2009-12-21 21:55 25512 —-a-w- c:\windows\system32\drivers\ggsemc.sys
2009-12-21 21:55 . 2009-12-21 21:55 13224 —-a-w- c:\windows\system32\drivers\ggflt.sys
2009-12-21 21:55 . 2009-12-21 21:55 1112288 —-a-w- c:\windows\system32\WdfCoInstaller01007.dll
2009-12-16 12:58 . 2006-06-20 12:28 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-08 18:53 . 2002-08-29 01:04 2136064 ——w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:19 . 2002-08-29 01:04 2015744 ——w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 14:41 . 2002-08-29 01:59 453760 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:33 . 2002-08-29 03:41 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:33 . 2001-08-17 22:36 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:37 . 2002-08-29 03:41 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:37 . 2002-08-29 03:40 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:37 . 2001-08-23 12:00 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:37 . 2001-08-17 22:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:37 . 2001-08-17 22:36 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-22 16:44 . 2009-11-22 16:44 17245680 —-a-w- c:\documents and settings\pete\Application Data\Real\Update\setup\rp\RealPlayerSPGold.exe
2009-11-21 16:36 . 2002-08-29 03:40 470528 —-a-w- c:\windows\AppPatch\AcLayers.dll
2007-02-25 11:58 . 2007-02-25 11:57 132 —-a-w- c:\program files\2.ini
2006-07-06 19:15 . 2006-07-06 19:15 365 —-a-w- c:\program files\Shortcut to iTunes.lnk
2005-04-01 13:11 . 2005-04-01 13:11 11079 —h–w- c:\program files\folder.htt
2006-08-25 16:05 . 2006-08-25 16:05 10856 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"SiS Tray"="c:\windows\System32\sistray.EXE" [2003-08-19 667648]
"SiS Windows KeyHook"="c:\windows\System32\keyhook.exe" [2003-08-19 241664]
"WireLessKeyboard"="c:\program files\Multimedia Keyboard\PS2USBKbdDrv.exe" [2005-05-12 233472]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2007-10-26 292152]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"D-Link D-Link Wireless N DWA-140"="c:\program files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe" [2007-03-14 1388544]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-01-31 1800464]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-02-11 2756488]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-17 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\lucy\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2006-2-16 81920]

c:\documents and settings\pete\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^RealDownload.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\RealDownload.lnk
backup=c:\windows\pss\RealDownload.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^pete^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
backup=c:\windows\pss\Microsoft Find Fast.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^pete^Start Menu^Programs^Startup^Office Startup.lnk]
backup=c:\windows\pss\Office Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
2003-01-27 17:16 376912 —-a-w- c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-11-20 13:20 290088 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 11:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2006-11-06 08:27 200704 —-a-w- c:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-11-04 10:30 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
2005-04-26 04:22 589824 —-a-r- c:\program files\VIA\RAID\raid_tool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2008-04-17 19:46 214560 —-a-w- c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2006-12-15 03:23 75520 —-a-w- c:\program files\Java\jre1.5.0_11\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-04-17 19:46 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
2005-03-11 10:33 147456 —-a-r- c:\windows\system32\VTTrayp.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\PETE\\My Documents\\my programs\\utorrent.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [05/02/2010 20:14 162512]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [24/08/2009 22:29 134344]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [24/08/2009 22:29 25160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [05/02/2010 20:14 19024]
R2 GenPort;GenPort;c:\windows\system32\drivers\genport.sys [20/04/2005 21:41 4832]
R2 MapMem;MapMem;c:\windows\system32\drivers\MAPMEM.SYS [20/04/2005 21:41 6816]
R2 NTRemap;NTRemap;c:\windows\system32\drivers\NTREMAP.SYS [20/04/2005 21:41 6336]
S1 SiSEsc;SISLIB_ESC;c:\windows\system32\sisesc.sys [04/04/2005 12:09 28416]
S2 https;https;\??\c:\windows\system32\drivers\https.sys –> c:\windows\system32\drivers\https.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [21/12/2009 21:55 13224]
S3 iMSPQMn;iMSPQMn;\??\c:\docume~1\pete\LOCALS~1\Temp\iMSPQMn.sys –> c:\docume~1\pete\LOCALS~1\Temp\iMSPQMn.sys [?]
S3 MadgeTRN;Madge Token-Ring Adapter NDIS5 Driver;c:\windows\system32\drivers\mdgndis5.sys [11/09/2006 16:52 164586]
S3 PAC207;SoC PC-Camer@;c:\windows\system32\DRIVERS\pfc027.sys –> c:\windows\system32\DRIVERS\pfc027.sys [?]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [09/03/2007 19:32 25773]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [24/01/2010 19:43 476416]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;c:\windows\system32\drivers\usbscan.sys [05/05/2005 09:10 15104]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [11/08/2009 17:58 81832]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [11/08/2009 18:37 13864]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [11/08/2009 18:37 107304]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s816mgmt.sys [11/08/2009 18:37 99112]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\drivers\s816nd5.sys [11/08/2009 18:37 21928]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [11/08/2009 18:37 97320]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\drivers\s816unic.sys [11/08/2009 18:37 97704]
S3 usb2vcom;USB Data Cable;c:\windows\system32\drivers\usb2vcom.sys [02/08/2006 09:30 29152]
.
Contents of the 'Scheduled Tasks' folder

2010-02-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL =
uStart Page = hxxp://www.google.co.uk/
mStart Page = Ze2
mSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Search
Trusted Zone: moove.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\pete\Application Data\Mozilla\Firefox\Profiles\7be4294a.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\pete\Application Data\Mozilla\Firefox\Profiles\7be4294a.default\extensions\[removed]\components\coolirisstub.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-12 21:29
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1614895754-1993962763-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0BA455AE-9518-0821-0F5B-9073B48517BA}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iabnffplobebhdcpje"=hex:6b,61,6c,65,6e,6b,6b,6d,69,68,6b,68,63,67,62,64,6d,61,
62,6a,6a,69,00,00
"hahmlooiffbeldka"=hex:6b,61,6c,65,6f,6b,68,6d,62,68,6e,67,69,68,69,6e,6b,6b,
70,66,6f,6e,00,00

[HKEY_USERS\S-1-5-21-1614895754-1993962763-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{30F72C79-D30B-4DEA-0A7F-31336951D0E9}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iahnhnljmnedhoehpm"=hex:6b,61,6d,6b,6b,63,6e,6d,69,6c,64,6c,6b,63,6f,6d,70,68,
67,6e,68,64,00,00
"hajnbmidllbnhjoe"=hex:6b,61,6c,6b,64,63,65,6d,63,6d,63,6f,6b,67,63,64,62,68,
67,6b,61,6d,00,00

[HKEY_USERS\S-1-5-21-1614895754-1993962763-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F15AC8E5-391A-00C9-1D75-66D955CD3428}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oaenkfflgjligbgdjahoboigkhhmfm"=hex:64,61,65,64,6b,6c,64,63,00,80
"oaaakmmgjkfpfeipgifcofnfmmgmop"=hex:6b,61,62,64,65,6d,63,67,61,6b,6d,69,6d,66,
70,68,69,68,67,65,69,6f,00,00
"nagpihkmbcchaglnehdaahnimini"=hex:69,61,6e,66,64,6e,6a,66,70,66,66,6b,68,63,
6b,62,68,70,00,00
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3632)
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-02-12 21:34:48 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-12 21:34
ComboFix2.txt 2010-02-12 12:35
ComboFix3.txt 2007-03-13 14:23

Pre-Run: 20,123,549,696 bytes free
Post-Run: 20,124,499,968 bytes free

- - End Of File - - C1FD4D876CC900B7A19F58234F0F1A1D


MBAM
Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

12/02/2010 21:46:15
mbam-log-2010-02-12 (21-46-15).txt

Scan type: Quick Scan
Objects scanned: 143379
Time elapsed: 5 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Post #11 last edited
Hi pjd100,

Why did we run ComboFix again?

To remove some malware services.

There was an error when i tried to update Malwarebytes

The database you are using is about 250 updates behind. What was the error? Does MBAM have intenet access?

The file that need access is mbam.exe

Please check in Comodo to ensure it isn't blocked. If you are able to update MBAM, please run a scan.


Next
  • Go to http://java.sun.com/javase/downloads/index.jsp
  • Scroll down to "Java Runtime Environment (JRE) 6 Update 18
  • Click the download button on the right.
If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.
  • Select the platform (Windows, in your case), mutli language.
  • Accept the license agreement, click continue.
You do not have to install the Java Web Start ActiveX Control
  • Scroll down and click on Windows Offline Installation,
  • Save the file jre-6u18-windows-i586-p.exe to your desktop;
Do not select Run . Do not install it yet.


When the download is complete, close your browser.

Open Control Panel > Add/Remove Programs and uninstall

J2SE Runtime Environment 5.0 Update 11
Java™ 6 Update 5



Do not uninstall Java TM 6 Update 18 if found! :yeah:

Reboot your computer.

  • Double-click on the saved file ( jre-6u18-windows-i586-p.exe) to install the update.
  • Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.



One more scan to do.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Please go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions.
  • You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
    • Spyware, Adware, Dialers, and other potentially dangerous programs
    • Archives
    • Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Change the Files of type to Text file (.txt)
  • Set the Save In to Desktop
  • click the Save button.
  • Please post this log in your next reply.


Please post back with
  • MBAM log, if you managed to get it updated
  • Kaspersky log
  • new DDS log taken after all other steps, just th DDS.txt this time please
Post #14
Updated MBAM ,log is below. 7 objects found and removed Kaspersky online scanner unavailable at the moment , awaiting new version. Shall i run Avast? Can't remember where i got DDS logs from? :unsure: Malwarebytes' Anti-Malware 1.44 Database version: 3741 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 15/02/2010 20:19:44 mbam-log-2010-02-15 (20-19-44).txt Scan type: Quick Scan Objects scanned: 152175 Time elapsed: 5 minute(s), 44 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 3 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{fd501041-8ebe-11ce-8183-00aa00577da1} (Malware.Packer.Gen) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8b498502-1218-11cf-adc4-00a0d100041b} (Malware.Packer.Gen) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{d877b48a-8972-4653-91e2-445cd4e12fc2} (Malware.Packer.Gen) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\t5rdv.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\WINDOWS\system32\cpwiuy.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ecesq.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\WINDOWS\system32\WinSys.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI