SweetTech
Yes, please allow it to update.
Spyware / Malware / Virus Removal
[Resolved] Virus updates blocked
31 min read
lancesandra
good evening, finally here are the logs: Thanks
ComboFix 10-03-08.01 - Lancesandra 03/08/2010 18:44:45.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.560 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Lancesandra\Desktop\CFscript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((( Files Created from 2010-02-09 to 2010-03-09 )))))))))))))))))))))))))))))))
.
2010-03-08 00:32 . 2010-03-08 00:32 77312 —-a-w- C:\mbr.exe
2010-03-08 00:13 . 2010-03-08 00:17 ——– d—–w- C:\_OTL
2010-03-07 17:25 . 2010-03-07 17:25 ——– d—–w- c:\program files\ERUNT
2010-03-07 16:58 . 2010-03-07 16:58 ——– d—–w- c:\program files\Trend Micro
2010-03-07 16:28 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-07 16:28 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-07 16:28 . 2010-03-07 16:28 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-07 15:41 . 2010-02-23 20:04 1664256 —-a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2010-03-06 23:38 . 2010-03-06 23:38 ——– d—–w- C:\$AVG
2010-03-06 23:12 . 2010-03-06 23:12 242696 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-03-06 23:12 . 2010-03-06 23:12 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-03-06 23:12 . 2010-03-06 23:12 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-06 23:12 . 2010-03-06 23:12 29512 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-06 23:12 . 2010-03-08 17:29 ——– d—–w- c:\windows\system32\drivers\Avg
2010-03-06 23:12 . 2010-03-07 15:50 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-03-06 23:11 . 2010-03-06 23:11 ——– d—–w- c:\program files\AVG
2010-03-06 23:11 . 2010-03-06 23:11 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-03-06 13:28 . 2009-07-28 21:33 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-03-03 23:53 . 2010-03-03 23:53 ——– d—–w- c:\documents and settings\Lancesandra\Application Data\Windows Search
2010-03-01 02:37 . 2010-03-03 23:59 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-03-01 02:37 . 2010-03-01 02:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-01 02:05 . 2010-03-01 02:05 ——– d—–w- c:\documents and settings\Lancesandra\Application Data\Malwarebytes
2010-03-01 02:05 . 2010-03-01 02:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-26 13:01 . 2010-02-26 13:02 ——– d—–w- c:\program files\CCleaner
2010-02-26 02:27 . 2010-02-26 02:27 0 —-a-w- c:\windows\nsreg.dat
2010-02-26 02:26 . 2010-02-26 02:26 ——– d—–w- c:\documents and settings\Lancesandra\Local Settings\Application Data\Mozilla
2010-02-22 05:27 . 2010-02-22 05:27 197760 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-21 22:17 . 2007-10-23 15:27 110592 —-a-w- c:\documents and settings\Lancesandra\Application Data\U3\temp\cleanup.exe
2010-02-21 22:10 . 2007-10-23 15:22 3350528 —ha-w- c:\documents and settings\Lancesandra\Application Data\U3\temp\Launchpad Removal.exe
2010-02-21 22:09 . 2010-02-21 22:17 ——– d—–w- c:\documents and settings\Lancesandra\Application Data\U3
2010-02-21 21:43 . 2010-02-21 21:43 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\IsolatedStorage
2010-02-21 21:43 . 2010-02-21 21:43 ——– d—–w- c:\documents and settings\Lancesandra\Local Settings\Application Data\Intuit
2010-02-21 21:37 . 2010-02-21 21:37 ——– d—–w- c:\documents and settings\Lancesandra\Application Data\Intuit
2010-02-21 21:37 . 2010-02-21 21:37 ——– d—–w- c:\program files\Common Files\AnswerWorks 5.0
2010-02-21 21:31 . 2010-02-21 21:31 ——– d—–w- c:\documents and settings\Lancesandra\Local Settings\Application Data\IsolatedStorage
2010-02-21 21:31 . 2010-02-21 21:36 ——– d—–w- c:\program files\Common Files\Intuit
2010-02-21 21:30 . 2010-02-21 21:30 ——– d—–w- c:\program files\TurboTax
2010-02-21 21:29 . 2010-02-21 21:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Intuit
2010-02-11 01:25 . 2010-02-11 01:25 ——– d—–w- c:\program files\Common Files\Remote Control USB Driver
2010-02-09 00:09 . 2010-02-09 00:09 ——– d—–w- c:\documents and settings\Lancesandra\Local Settings\Application Data\assembly
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-06 13:25 . 2009-10-31 00:08 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-02-26 21:46 . 2010-02-26 21:46 ——– d—–w- c:\documents and settings\Administrator\Application Data\Windows Search
2010-02-21 21:43 . 2009-10-31 04:58 94888 —-a-w- c:\documents and settings\Lancesandra\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-11 01:25 . 2009-05-05 16:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-10 09:02 . 2009-05-05 16:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-05 22:41 . 2010-02-05 22:41 ——– d—–w- c:\program files\Common Files\Research In Motion
2010-02-05 22:41 . 2010-02-05 22:41 ——– d—–w- c:\program files\AT&T
2010-02-05 22:33 . 2009-11-18 17:34 ——– d—–w- c:\program files\Sierra Wireless Inc
2010-02-03 23:52 . 2010-02-03 23:52 ——– d—–w- c:\documents and settings\All Users\Application Data\AT&T
2010-01-02 23:37 . 2010-01-02 23:37 0 —-a-w- c:\documents and settings\Lancesandra\Application Data\wklnhst.dat
2009-12-31 16:50 . 2009-04-28 04:51 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2009-04-28 04:51 916480 ——w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2009-04-28 05:01 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2009-04-28 04:51 33280 —-a-w- c:\windows\system32\csrsrv.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-03-07_22.21.08 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-04-28 04:51 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
+ 2009-04-28 04:51 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
+ 2009-07-12 06:02 . 2009-07-12 06:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2009-04-28 04:51 . 2009-12-09 05:53 726528 c:\windows\system32\jscript.dll
- 2009-04-28 04:51 . 2009-06-22 06:44 726528 c:\windows\system32\jscript.dll
- 2009-04-28 04:51 . 2009-06-22 06:44 726528 c:\windows\system32\dllcache\jscript.dll
+ 2009-04-28 04:51 . 2009-12-09 05:53 726528 c:\windows\system32\dllcache\jscript.dll
+ 2010-03-08 02:50 . 2010-03-08 02:50 195584 c:\windows\Installer\57ddfa.msi
+ 2010-03-08 02:50 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB976662-IE8\spuninst\updspapi.dll
+ 2010-03-08 02:50 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB976662-IE8\spuninst\spuninst.exe
+ 2010-03-08 02:50 . 2009-06-22 06:44 726528 c:\windows\ie8updates\KB976662-IE8\jscript.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-02-23 20:04 1664256 —-a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA3D342F-FF20-4E31-9E82-22334155730C}]
2009-06-02 14:51 2695168 —-a-w- c:\program files\Antbar\Ant.com Toolbar\tbcore3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6CD56C02-CB4D-41B5-A0FE-B479061CCB41}"= "c:\program files\Antbar\Ant.com Toolbar\tbcore3.dll" [2009-06-02 2695168]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]
[HKEY_CLASSES_ROOT\clsid\{6cd56c02-cb4d-41b5-a0fe-b479061ccb41}]
[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{6CD56C02-CB4D-41B5-A0FE-B479061CCB41}"= "c:\program files\Antbar\Ant.com Toolbar\tbcore3.dll" [2009-06-02 2695168]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]
[HKEY_CLASSES_ROOT\clsid\{6cd56c02-cb4d-41b5-a0fe-b479061ccb41}]
[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2009-04-16 630784]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2009-03-13 98304]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2009-04-16 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-06 1434920]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-03-06 79144]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2009-5-5 376832]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-06 23:12 12464 —-a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 07:04 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AT&T Communication Manager]
2009-10-09 23:58 883272 —-a-w- c:\program files\AT&T\Communication Manager\ATTCM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-14 12:00 208952 —-a-w- c:\windows\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-02-06 22:51 3885408 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2008-04-14 12:00 59392 —-a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-14 12:00 455168 —-a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-14 12:00 455168 —-a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-04-27 21:08 17881088 —-a-w- c:\windows\RTHDCPL.EXE
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\AT&T\\Communication Manager\\SwiApiMux.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [3/6/2010 5:12 PM 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [3/6/2010 5:12 PM 242696]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [3/6/2010 5:11 PM 308064]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [5/5/2009 10:39 AM 55152]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [4/27/2009 7:59 PM 38912]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [5/5/2009 10:00 AM 1684736]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [10/9/2009 5:59 PM 121416]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [3/6/2010 5:12 PM 369920]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 4:08 PM 533360]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [5/5/2009 11:16 AM 232872]
S3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\drivers\swnc8ua3.sys [3/31/2009 2:45 PM 190080]
S3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\drivers\swumxa3.sys [5/4/2009 3:57 PM 148096]
S3 uvclf;uvclf;c:\windows\system32\drivers\uvclf.sys [3/16/2009 3:27 PM 39040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: bmnet.dll
Trusted Zone: intuit.com\ttlc
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\Lancesandra\Application Data\Mozilla\Firefox\Profiles\we7cl42s.default\
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-08 18:51
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'lsass.exe'(784)
c:\windows\system32\bmnet.dll
- - - - - - - > 'explorer.exe'(3528)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
.
**************************************************************************
.
Completion time: 2010-03-08 18:54:49 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-09 00:54
ComboFix2.txt 2010-03-08 21:27
ComboFix3.txt 2010-03-07 22:23
Pre-Run: 61,536,198,656 bytes free
Post-Run: 61,503,803,392 bytes free
- - End Of File - - 5E0040C51350BAF9CB9D59681126CF31
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, March 8, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, March 08, 2010 18:01:31
Records in database: 3740411
——————————————————————————–
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
D:\
Scan statistics:
Objects scanned: 45683
Threats found: 0
Infected objects found: 0
Suspicious objects found: 0
Scan duration: 02:13:04
No threats found. Scanned area is clean.
Selected area has been scanned.
ComboFix 10-03-08.01 - Lancesandra 03/08/2010 18:44:45.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.560 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Lancesandra\Desktop\CFscript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((( Files Created from 2010-02-09 to 2010-03-09 )))))))))))))))))))))))))))))))
.
2010-03-08 00:32 . 2010-03-08 00:32 77312 —-a-w- C:\mbr.exe
2010-03-08 00:13 . 2010-03-08 00:17 ——– d—–w- C:\_OTL
2010-03-07 17:25 . 2010-03-07 17:25 ——– d—–w- c:\program files\ERUNT
2010-03-07 16:58 . 2010-03-07 16:58 ——– d—–w- c:\program files\Trend Micro
2010-03-07 16:28 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-07 16:28 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-07 16:28 . 2010-03-07 16:28 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-07 15:41 . 2010-02-23 20:04 1664256 —-a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2010-03-06 23:38 . 2010-03-06 23:38 ——– d—–w- C:\$AVG
2010-03-06 23:12 . 2010-03-06 23:12 242696 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-03-06 23:12 . 2010-03-06 23:12 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-03-06 23:12 . 2010-03-06 23:12 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-06 23:12 . 2010-03-06 23:12 29512 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-06 23:12 . 2010-03-08 17:29 ——– d—–w- c:\windows\system32\drivers\Avg
2010-03-06 23:12 . 2010-03-07 15:50 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-03-06 23:11 . 2010-03-06 23:11 ——– d—–w- c:\program files\AVG
2010-03-06 23:11 . 2010-03-06 23:11 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-03-06 13:28 . 2009-07-28 21:33 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-03-03 23:53 . 2010-03-03 23:53 ——– d—–w- c:\documents and settings\Lancesandra\Application Data\Windows Search
2010-03-01 02:37 . 2010-03-03 23:59 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-03-01 02:37 . 2010-03-01 02:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-01 02:05 . 2010-03-01 02:05 ——– d—–w- c:\documents and settings\Lancesandra\Application Data\Malwarebytes
2010-03-01 02:05 . 2010-03-01 02:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-26 13:01 . 2010-02-26 13:02 ——– d—–w- c:\program files\CCleaner
2010-02-26 02:27 . 2010-02-26 02:27 0 —-a-w- c:\windows\nsreg.dat
2010-02-26 02:26 . 2010-02-26 02:26 ——– d—–w- c:\documents and settings\Lancesandra\Local Settings\Application Data\Mozilla
2010-02-22 05:27 . 2010-02-22 05:27 197760 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-02-21 22:17 . 2007-10-23 15:27 110592 —-a-w- c:\documents and settings\Lancesandra\Application Data\U3\temp\cleanup.exe
2010-02-21 22:10 . 2007-10-23 15:22 3350528 —ha-w- c:\documents and settings\Lancesandra\Application Data\U3\temp\Launchpad Removal.exe
2010-02-21 22:09 . 2010-02-21 22:17 ——– d—–w- c:\documents and settings\Lancesandra\Application Data\U3
2010-02-21 21:43 . 2010-02-21 21:43 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\IsolatedStorage
2010-02-21 21:43 . 2010-02-21 21:43 ——– d—–w- c:\documents and settings\Lancesandra\Local Settings\Application Data\Intuit
2010-02-21 21:37 . 2010-02-21 21:37 ——– d—–w- c:\documents and settings\Lancesandra\Application Data\Intuit
2010-02-21 21:37 . 2010-02-21 21:37 ——– d—–w- c:\program files\Common Files\AnswerWorks 5.0
2010-02-21 21:31 . 2010-02-21 21:31 ——– d—–w- c:\documents and settings\Lancesandra\Local Settings\Application Data\IsolatedStorage
2010-02-21 21:31 . 2010-02-21 21:36 ——– d—–w- c:\program files\Common Files\Intuit
2010-02-21 21:30 . 2010-02-21 21:30 ——– d—–w- c:\program files\TurboTax
2010-02-21 21:29 . 2010-02-21 21:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Intuit
2010-02-11 01:25 . 2010-02-11 01:25 ——– d—–w- c:\program files\Common Files\Remote Control USB Driver
2010-02-09 00:09 . 2010-02-09 00:09 ——– d—–w- c:\documents and settings\Lancesandra\Local Settings\Application Data\assembly
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-06 13:25 . 2009-10-31 00:08 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-02-26 21:46 . 2010-02-26 21:46 ——– d—–w- c:\documents and settings\Administrator\Application Data\Windows Search
2010-02-21 21:43 . 2009-10-31 04:58 94888 —-a-w- c:\documents and settings\Lancesandra\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-11 01:25 . 2009-05-05 16:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-10 09:02 . 2009-05-05 16:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-05 22:41 . 2010-02-05 22:41 ——– d—–w- c:\program files\Common Files\Research In Motion
2010-02-05 22:41 . 2010-02-05 22:41 ——– d—–w- c:\program files\AT&T
2010-02-05 22:33 . 2009-11-18 17:34 ——– d—–w- c:\program files\Sierra Wireless Inc
2010-02-03 23:52 . 2010-02-03 23:52 ——– d—–w- c:\documents and settings\All Users\Application Data\AT&T
2010-01-02 23:37 . 2010-01-02 23:37 0 —-a-w- c:\documents and settings\Lancesandra\Application Data\wklnhst.dat
2009-12-31 16:50 . 2009-04-28 04:51 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2009-04-28 04:51 916480 ——w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2009-04-28 05:01 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2009-04-28 04:51 33280 —-a-w- c:\windows\system32\csrsrv.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-03-07_22.21.08 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-04-28 04:51 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
+ 2009-04-28 04:51 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
+ 2009-07-12 06:02 . 2009-07-12 06:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2009-04-28 04:51 . 2009-12-09 05:53 726528 c:\windows\system32\jscript.dll
- 2009-04-28 04:51 . 2009-06-22 06:44 726528 c:\windows\system32\jscript.dll
- 2009-04-28 04:51 . 2009-06-22 06:44 726528 c:\windows\system32\dllcache\jscript.dll
+ 2009-04-28 04:51 . 2009-12-09 05:53 726528 c:\windows\system32\dllcache\jscript.dll
+ 2010-03-08 02:50 . 2010-03-08 02:50 195584 c:\windows\Installer\57ddfa.msi
+ 2010-03-08 02:50 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB976662-IE8\spuninst\updspapi.dll
+ 2010-03-08 02:50 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB976662-IE8\spuninst\spuninst.exe
+ 2010-03-08 02:50 . 2009-06-22 06:44 726528 c:\windows\ie8updates\KB976662-IE8\jscript.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-02-23 20:04 1664256 —-a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA3D342F-FF20-4E31-9E82-22334155730C}]
2009-06-02 14:51 2695168 —-a-w- c:\program files\Antbar\Ant.com Toolbar\tbcore3.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6CD56C02-CB4D-41B5-A0FE-B479061CCB41}"= "c:\program files\Antbar\Ant.com Toolbar\tbcore3.dll" [2009-06-02 2695168]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]
[HKEY_CLASSES_ROOT\clsid\{6cd56c02-cb4d-41b5-a0fe-b479061ccb41}]
[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{6CD56C02-CB4D-41B5-A0FE-B479061CCB41}"= "c:\program files\Antbar\Ant.com Toolbar\tbcore3.dll" [2009-06-02 2695168]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]
[HKEY_CLASSES_ROOT\clsid\{6cd56c02-cb4d-41b5-a0fe-b479061ccb41}]
[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2009-04-16 630784]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2009-03-13 98304]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2009-04-16 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-06 1434920]
"SynAsusAcpi"="c:\program files\Synaptics\SynTP\SynAsusAcpi.exe" [2009-03-06 79144]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2009-5-5 376832]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-06 23:12 12464 —-a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 07:04 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AT&T Communication Manager]
2009-10-09 23:58 883272 —-a-w- c:\program files\AT&T\Communication Manager\ATTCM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-14 12:00 208952 —-a-w- c:\windows\ime\imjp8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-02-06 22:51 3885408 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2008-04-14 12:00 59392 —-a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-14 12:00 455168 —-a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-14 12:00 455168 —-a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-04-27 21:08 17881088 —-a-w- c:\windows\RTHDCPL.EXE
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\AT&T\\Communication Manager\\SwiApiMux.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [3/6/2010 5:12 PM 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [3/6/2010 5:12 PM 242696]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [3/6/2010 5:11 PM 308064]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [5/5/2009 10:39 AM 55152]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [4/27/2009 7:59 PM 38912]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [5/5/2009 10:00 AM 1684736]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [10/9/2009 5:59 PM 121416]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [3/6/2010 5:12 PM 369920]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 4:08 PM 533360]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [5/5/2009 11:16 AM 232872]
S3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\drivers\swnc8ua3.sys [3/31/2009 2:45 PM 190080]
S3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\drivers\swumxa3.sys [5/4/2009 3:57 PM 148096]
S3 uvclf;uvclf;c:\windows\system32\drivers\uvclf.sys [3/16/2009 3:27 PM 39040]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: bmnet.dll
Trusted Zone: intuit.com\ttlc
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\Lancesandra\Application Data\Mozilla\Firefox\Profiles\we7cl42s.default\
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-08 18:51
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'lsass.exe'(784)
c:\windows\system32\bmnet.dll
- - - - - - - > 'explorer.exe'(3528)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
.
**************************************************************************
.
Completion time: 2010-03-08 18:54:49 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-09 00:54
ComboFix2.txt 2010-03-08 21:27
ComboFix3.txt 2010-03-07 22:23
Pre-Run: 61,536,198,656 bytes free
Post-Run: 61,503,803,392 bytes free
- - End Of File - - 5E0040C51350BAF9CB9D59681126CF31
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, March 8, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, March 08, 2010 18:01:31
Records in database: 3740411
——————————————————————————–
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
D:\
Scan statistics:
Objects scanned: 45683
Threats found: 0
Infected objects found: 0
Suspicious objects found: 0
Scan duration: 02:13:04
No threats found. Scanned area is clean.
Selected area has been scanned.
SweetTech
Good Morning!
How is your computer running?
lancesandra
Hello, it is running good and I can access update sites.
Is there a link to recomended practice or software I should be useing to prevent this in the future? I had MaAfee running since day one, but it still got messed up.
I started up the netbook and it is doing a series of MS updates right now.
Thanks, Lance
SweetTech
Hello lancesandra,
In this post we will be updating your Adobe, cleaning up our tools, and then you will find my recommendations for remaining safe and malware free.
Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
NEXT:
OTL Clean-Up
Clean up with OTL:
NEXT:
Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:
[external image: Posted Image]
Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.
NEXT:
All Clean Speech
Thank you for your patience, and performing all of the procedures requested.
Please respond one last time so we can consider the thread resolved and close it, thank-you.
In this post we will be updating your Adobe, cleaning up our tools, and then you will find my recommendations for remaining safe and malware free.
Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
- Go to Start > Control Panel > Add/Remove Programs
- Remove ALL instances of Adobe Reader
- Re-boot your computer as required.
- Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader
NEXT:
OTL Clean-Up
Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
NEXT:
Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:
[external image: Posted Image]
Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.
NEXT:
All Clean Speech
===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===
Below I have included a number of recommendations for how to protect your computer against malware infections.- It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them then consider a password keeper, to keep all your passwords safe.
- Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
- SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
- SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
- Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
- ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
- MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
- WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
- Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here
- If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
- NoScript - for blocking ads and other potential website attacks
- If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
- Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
- ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
- In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.
Thank you for your patience, and performing all of the procedures requested.
Please respond one last time so we can consider the thread resolved and close it, thank-you.
lancesandra
Thanks and I am working through these now.
Useing foxfit instead of adobe and useing firfox works for me.
Is there a virus protection program you recomend? I have download McAfee, Avira and AVG.
Thanks for all your help, does whatthethech take donantions or is there a way to say thanks?
Lance
SweetTech
lancesandra,
Answer to Security Program Questions:
In response to your virus protection program question it all really depends. If your subscription to McAfee is current then you might want to consider utilizing it. Some users report that McAfee effects the speed of their computer meaning it slows their computer down. Both Avira and AVG are both good anti-virus programs if you decide to stick with using AVG or want to use Avira then you will need to install a 3rd party firewall program on your computer. I can include some recommendations for some free firewalls for you to download.
I also suggest that you keep MalwareBytes' Anti-Malware on your computer and run a scan with it at least once a month.
It's never recommended to run more than 1 Anti-Virus program and 1 Firewall program.
No Firewall Present
I seemed to overlook the fact that you have no firewall on your computer. When we first started you mentioned the fact that you were unable to update with McAfee and I think that maybe the reason why I overlooked this tidbit of information. I apologize for missing that.
Looking over your log it seems you don't have any evidence of a third party FIREWALL. As the term conveys a firewall is an extra layer of security installed onto computers which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders.
If you are using the built-in Windows XP firewall it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to phone home for more instructions. Simply put Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
I would recommend to install install a free firewall for personal use from one of these excellent vendors. Choice is yours:
Answer to Donation Question:
WhatTheTech does accept donations and if you are interested in doing so you can take a look at this page for additional details.
Answer to Security Program Questions:
In response to your virus protection program question it all really depends. If your subscription to McAfee is current then you might want to consider utilizing it. Some users report that McAfee effects the speed of their computer meaning it slows their computer down. Both Avira and AVG are both good anti-virus programs if you decide to stick with using AVG or want to use Avira then you will need to install a 3rd party firewall program on your computer. I can include some recommendations for some free firewalls for you to download.
I also suggest that you keep MalwareBytes' Anti-Malware on your computer and run a scan with it at least once a month.
It's never recommended to run more than 1 Anti-Virus program and 1 Firewall program.
No Firewall Present
I seemed to overlook the fact that you have no firewall on your computer. When we first started you mentioned the fact that you were unable to update with McAfee and I think that maybe the reason why I overlooked this tidbit of information. I apologize for missing that.
Looking over your log it seems you don't have any evidence of a third party FIREWALL. As the term conveys a firewall is an extra layer of security installed onto computers which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders.
If you are using the built-in Windows XP firewall it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to phone home for more instructions. Simply put Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
I would recommend to install install a free firewall for personal use from one of these excellent vendors. Choice is yours:
- Online-Armor Free
- Agnitum
- Sunbelt/Kerio (Free version after 30 days)
- Comodo (Uncheck during installation Install Comodo SafeSurf.., Make Comodo my default search provider and Make Comodo Search my homepage and install firewall ONLY!)
Answer to Donation Question:
WhatTheTech does accept donations and if you are interested in doing so you can take a look at this page for additional details.
lancesandra
Hello and THANKS,
I made a donation.
If McAfee is ok to use from a security standpoint then I will stick with it as I have it on two other computers and I do have a current subscription. I also like that it includes a firewall, but witht hat said if the protection is better with AVG or Avira and another firewall then I will change ASAP.
Thanks, Lance
SweetTech
If you feel like McAfee works better for you then you can stick with it. However, if you decide to do this you will want to make sure that you uninstall AVG using Add/Remove Programs and then run the uninstaller tool (link below) to make sure that it gets all of the leftovers from AVG.
You will want to download this program to your computer and run it after uninstalling AVG using Add/Remove Programs.
AVG Removal Tool (x86)
You will want to download this program to your computer and run it after uninstalling AVG using Add/Remove Programs.
AVG Removal Tool (x86)
lancesandra
OK, THANKS you have been a great help!
Lance
SweetTech
Your very welcome! I assume that this issue is now resolved and that I can go ahead and close this thread and mark it as such. Do you have any additional questions for me before I close this thread up?
lancesandra
Thanks again and yes you can close it.
Lance
SweetTech
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI