What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Definitely infected, please help

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I've had this problem for a while now. It started with the "google redirect". At the time all I had was Spybot, Malwarebytes, and Norton. I ran them all and none got rid of it. For a while I had been unhappy with Norton, and Spybot made my computer slow, so I uninstalled them. I installed Ad-Aware, SUPERAntiSpyware, and Cloud Panda… ran them all and they all found stuff which I erased, but it still didn't get rid of the problem. I found something called UnHackMe, ran it and also found a bunch of stuff, (including srd64.exe), but it made my pc screwey so I uninstalled it along with Cloud Panda. The PC is working fine now, no "major" flaws, but still have the redirect, and another one that says Im the 1000th visitor and won a prize.

So now I'm trying to follow the steps from this page, but GMER keeps getting stuck. the initial scan works fine, but when I actually hit scan that's when it gets stuck. I got the log from the initial scan, but like I said, when I hit scan, it gets stuck on something called
C:\WINDOWS\system32\drivers\atapi.sys
Please, any help is really appreciated, here are the logs I managed to get.

********************************************************************************
**************************************************************
Malwarebytes' Anti-Malware 1.44
Database version: 3792
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

3/12/2010 12:04:52 AM
mbam-log-2010-03-12 (00-04-52).txt

Scan type: Quick Scan
Objects scanned: 124885
Time elapsed: 9 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
********************************************************************************
****************************************************************

********************************************************************************
****************************************************************
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 01:54 on 12/03/2010 (Owner)

Checking for autostart values…
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers…


-=E.O.F=-
********************************************************************************
****************************************************************

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-03-12 08:47:07
Windows 5.1.2600 Service Pack 3
Running: 2dgd5vmp.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\uftcifoc.sys


—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device -> \Driver\atapi \Device\Harddisk0\DR0 81E48A9A

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

—- EOF - GMER 1.0.15 —-

********************************************************************************
****************************************************************



Thanks.
Post #2
Hello Kilmez and :welcome:

My name is JonTom.

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 5 days your thread will be closed.

  • Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
  • This may cause a delay in response time, but I will do my best to keep it as short as possible.
  • I will reply back shortly with instructions.
Post #3
Hello Kilmez

  • TDSS Killer

    • Please download TDSS Killer by clicking here and save the file (called tdsskiller.zip) to your desktop.
    • Extract the executable file from the zipped folder and run it.
    • Once TDSS Killer has finished, it will create a log in your C:\ drive called TDSSKiller_* (where "*" denotes version and date).
    • Please copy and paste the contents of this log into your next reply.

  • Please perform the following scan


    • Please download DDS from here or here and save it to your desktop.
    • Disable any script blocking protection (How to Disable your Security Programs)
    • Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
    • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.

    Please post the TDSSKiller log and the DDS logs in your next reply.

    Also, please tell me how your computer is behaving now.
Post #4
Hi JonTom… thanks for your help, here are the logs. ******************************************************************************** *********** ******************************************************************************** *********** 16:05:32:060 3092 TDSS rootkit removing tool 2.2.8 Mar 10 2010 15:53:20 16:05:32:060 3092 ================================================================================ 16:05:32:060 3092 SystemInfo: 16:05:32:060 3092 OS Version: 5.1.2600 ServicePack: 3.0 16:05:32:060 3092 Product type: Workstation 16:05:32:060 3092 ComputerName: OWNER-XUKSZMPNK 16:05:32:070 3092 UserName: Owner 16:05:32:070 3092 Windows directory: C:\WINDOWS 16:05:32:070 3092 Processor architecture: Intel x86 16:05:32:070 3092 Number of processors: 1 16:05:32:070 3092 Page size: 0x1000 16:05:35:435 3092 Boot type: Normal boot 16:05:35:435 3092 ================================================================================ 16:05:35:655 3092 UnloadDriverW: NtUnloadDriver error 2 16:05:35:655 3092 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2 16:05:36:106 3092 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system 16:05:36:106 3092 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 16:05:36:106 3092 wfopen_ex: Trying to KLMD file open 16:05:36:106 3092 wfopen_ex: File opened ok (Flags 2) 16:05:36:106 3092 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software 16:05:36:106 3092 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 16:05:36:106 3092 wfopen_ex: Trying to KLMD file open 16:05:36:106 3092 wfopen_ex: File opened ok (Flags 2) 16:05:36:106 3092 Initialize success 16:05:36:106 3092 16:05:36:106 3092 Scanning Services … 16:05:37:808 3092 GetAdvancedServicesInfo: Raw services enum returned 330 services 16:05:37:808 3092 16:05:37:808 3092 Scanning Kernel memory … 16:05:37:808 3092 Devices to scan: 2 16:05:37:808 3092 16:05:37:808 3092 Driver Name: Disk 16:05:37:808 3092 IRP_MJ_CREATE : F9EF2BB0 16:05:37:808 3092 IRP_MJ_CREATE_NAMED_PIPE : 804FA88E 16:05:37:808 3092 IRP_MJ_CLOSE : F9EF2BB0 16:05:37:808 3092 IRP_MJ_READ : F9EECD1F 16:05:37:808 3092 IRP_MJ_WRITE : F9EECD1F 16:05:37:808 3092 IRP_MJ_QUERY_INFORMATION : 804FA88E 16:05:37:808 3092 IRP_MJ_SET_INFORMATION : 804FA88E 16:05:37:808 3092 IRP_MJ_QUERY_EA : 804FA88E 16:05:37:808 3092 IRP_MJ_SET_EA : 804FA88E 16:05:37:808 3092 IRP_MJ_FLUSH_BUFFERS : F9EED2E2 16:05:37:808 3092 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA88E 16:05:37:808 3092 IRP_MJ_SET_VOLUME_INFORMATION : 804FA88E 16:05:37:808 3092 IRP_MJ_DIRECTORY_CONTROL : 804FA88E 16:05:37:808 3092 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA88E 16:05:37:808 3092 IRP_MJ_DEVICE_CONTROL : F9EED3BB 16:05:37:808 3092 IRP_MJ_INTERNAL_DEVICE_CONTROL : F9EF0F28 16:05:37:808 3092 IRP_MJ_SHUTDOWN : F9EED2E2 16:05:37:808 3092 IRP_MJ_LOCK_CONTROL : 804FA88E 16:05:37:808 3092 IRP_MJ_CLEANUP : 804FA88E 16:05:37:808 3092 IRP_MJ_CREATE_MAILSLOT : 804FA88E 16:05:37:808 3092 IRP_MJ_QUERY_SECURITY : 804FA88E 16:05:37:808 3092 IRP_MJ_SET_SECURITY : 804FA88E 16:05:37:808 3092 IRP_MJ_POWER : F9EEEC82 16:05:37:808 3092 IRP_MJ_SYSTEM_CONTROL : F9EF399E 16:05:37:808 3092 IRP_MJ_DEVICE_CHANGE : 804FA88E 16:05:37:808 3092 IRP_MJ_QUERY_QUOTA : 804FA88E 16:05:37:808 3092 IRP_MJ_SET_QUOTA : 804FA88E 16:05:37:958 3092 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 16:05:37:958 3092 16:05:37:958 3092 Driver Name: atapi 16:05:37:958 3092 IRP_MJ_CREATE : 81E61A9A 16:05:37:958 3092 IRP_MJ_CREATE_NAMED_PIPE : 81E61A9A 16:05:37:958 3092 IRP_MJ_CLOSE : 81E61A9A 16:05:37:958 3092 IRP_MJ_READ : 81E61A9A 16:05:37:958 3092 IRP_MJ_WRITE : 81E61A9A 16:05:37:958 3092 IRP_MJ_QUERY_INFORMATION : 81E61A9A 16:05:37:958 3092 IRP_MJ_SET_INFORMATION : 81E61A9A 16:05:37:958 3092 IRP_MJ_QUERY_EA : 81E61A9A 16:05:37:958 3092 IRP_MJ_SET_EA : 81E61A9A 16:05:37:958 3092 IRP_MJ_FLUSH_BUFFERS : 81E61A9A 16:05:37:958 3092 IRP_MJ_QUERY_VOLUME_INFORMATION : 81E61A9A 16:05:37:958 3092 IRP_MJ_SET_VOLUME_INFORMATION : 81E61A9A 16:05:37:958 3092 IRP_MJ_DIRECTORY_CONTROL : 81E61A9A 16:05:37:958 3092 IRP_MJ_FILE_SYSTEM_CONTROL : 81E61A9A 16:05:37:958 3092 IRP_MJ_DEVICE_CONTROL : 81E61A9A 16:05:37:958 3092 IRP_MJ_INTERNAL_DEVICE_CONTROL : 81E61A9A 16:05:37:958 3092 IRP_MJ_SHUTDOWN : 81E61A9A 16:05:37:958 3092 IRP_MJ_LOCK_CONTROL : 81E61A9A 16:05:37:968 3092 IRP_MJ_CLEANUP : 81E61A9A 16:05:37:968 3092 IRP_MJ_CREATE_MAILSLOT : 81E61A9A 16:05:37:968 3092 IRP_MJ_QUERY_SECURITY : 81E61A9A 16:05:37:968 3092 IRP_MJ_SET_SECURITY : 81E61A9A 16:05:37:968 3092 IRP_MJ_POWER : 81E61A9A 16:05:37:968 3092 IRP_MJ_SYSTEM_CONTROL : 81E61A9A 16:05:37:968 3092 IRP_MJ_DEVICE_CHANGE : 81E61A9A 16:05:37:968 3092 IRP_MJ_QUERY_QUOTA : 81E61A9A 16:05:37:968 3092 IRP_MJ_SET_QUOTA : 81E61A9A 16:05:37:968 3092 Driver "atapi" infected by TDSS rootkit! 16:05:37:968 3092 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: 1 16:05:37:968 3092 File "C:\WINDOWS\system32\DRIVERS\atapi.sys" infected by TDSS rootkit … 16:05:37:968 3092 Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys 16:05:37:968 3092 ProcessDirEnumEx: FindFirstFile(C:\WINDOWS\system32\DriverStore\FileRepository\*) error 3 16:05:38:519 3092 vfvi6 16:05:39:090 3092 !dsvbh1 16:05:43:396 3092 dsvbh2 16:05:43:416 3092 fdfb2 16:05:43:416 3092 Backup copy found, using it.. 16:05:43:967 3092 will be cured on next reboot 16:05:43:967 3092 Reboot required for cure complete.. 16:05:44:037 3092 Cure on reboot scheduled successfully 16:05:44:037 3092 16:05:44:037 3092 Completed 16:05:44:037 3092 16:05:44:037 3092 Results: 16:05:44:037 3092 Memory objects infected / cured / cured on reboot: 1 / 0 / 0 16:05:44:037 3092 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 16:05:44:047 3092 File objects infected / cured / cured on reboot: 1 / 0 / 1 16:05:44:047 3092 16:05:44:047 3092 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system 16:05:44:047 3092 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software 16:05:44:057 3092 UnloadDriverW: NtUnloadDriver error 1 16:05:44:057 3092 KLMD_Unload: UnloadDriverW(klmd21) error 1 16:05:44:137 3092 KLMD(ARK) unloaded successfully ******************************************************************************** *********** ******************************************************************************** *********** ******************************************************************************** *********** ******************************************************************************** *********** DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 16:15:39.02 on Fri 03/12/2010 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_18 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.223.72 [GMT -6:00] AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe svchost.exe C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe C:\Program Files\Logitech\Gaming Software\LWEMon.exe C:\Program Files\AT&T\Internet Security Wizard\ISW.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== mStart Page = hxxp://www.msn.com uInternet Connection Wizard,ShellNext = iexplore BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [VTPreset] VTPreset.exe mRun: [AudioDeck] c:\program files\via\viaudioi\sbadeck\ADeck.exe 1 mRun: [Start WingMan Profiler] c:\program files\logitech\gaming software\LWEMon.exe /noui mRun: [ATT-SST_McciTrayApp] "c:\program files\att-sst\McciTrayApp.exe" mRun: [ISW.exe] "c:\program files\at&t\internet security wizard\ISW.exe" /AUTORUN mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Trusted Zone: 0.0.0.0 Trusted Zone: motive.com\patttbc.att DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL LSA: Authentication Packages = msv1_0 c:\windows\system32\yayxwUnO mASetup: {28ABC5C0-4FCF-11CF-ADX5-81NXC1C635612} - c:\recycler\s-1-5-21-1482476501-1644491937-682003330-1013\wisenis32.exe ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\wal9bexx.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p= FF - prefs.js: browser.search.selectedEngine - AltaVista FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157 FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13917&gct=&gc=1&q= FF - plugin: c:\program files\mozilla firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\mozilla firefox\plugins\np32dsw.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdivx32.dll FF - plugin: c:\program files\mozilla firefox\plugins\npDivxPlayerPlugin.dll FF - plugin: c:\program files\mozilla firefox\plugins\npLegitCheckPlugin.dll FF - plugin: c:\program files\mozilla firefox\plugins\npnul32.dll FF - plugin: c:\program files\mozilla firefox\plugins\nppdf32.dll FF - plugin: c:\program files\mozilla firefox\plugins\nppl3260.dll FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin.dll FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin2.dll FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin3.dll FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin4.dll FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin5.dll FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin6.dll FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin7.dll FF - plugin: c:\program files\mozilla firefox\plugins\nprjplug.dll FF - plugin: c:\program files\mozilla firefox\plugins\nprpjplug.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPSWF32.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-2-25 64288] R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-3-9 11608] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 66632] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-3-9 108289] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-3-9 185089] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-3-9 56816] S2 ineti;\??\C;\??\c:\windows\temp\lzctreqbj.sys –> c:\windows\temp\lzctreqbj.sys [?] S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2009-2-12 16512] S3 ATHFMWDL;NETGEAR WG111T bootloader driver;c:\windows\system32\drivers\athfmwdl.sys –> c:\windows\system32\drivers\ATHFMWDL.sys [?] S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2006-11-20 17149] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1229232] S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872] S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-11-14 135664] =============== Created Last 30 ================ 2010-03-12 07:54:12 0 —-a-w- c:\documents and settings\owner\defogger_reenable 2010-03-10 00:27:43 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys 2010-03-10 00:27:31 0 d—–w- c:\program files\Avira 2010-03-10 00:27:31 0 d—–w- c:\docume~1\alluse~1\applic~1\Avira 2010-03-06 01:59:18 0 d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2010-03-06 01:45:52 0 d—–w- c:\program files\SUPERAntiSpyware 2010-03-06 01:45:46 0 d—–w- c:\docume~1\owner\applic~1\SUPERAntiSpyware.com 2010-03-02 01:56:27 73728 —-a-w- c:\windows\system32\javacpl.cpl 2010-03-01 01:38:20 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2010-02-28 01:03:26 2 –shatr- c:\windows\winstart.bat 2010-02-26 19:34:25 0 d—–w- c:\program files\FireFox 2010-02-26 15:29:07 15880 —-a-w- c:\windows\system32\lsdelete.exe 2010-02-26 01:41:24 0 d—–w- c:\program files\SpywareBlaster 2010-02-26 01:32:41 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys 2010-02-26 01:29:18 0 dc-h–w- c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6} 2010-02-26 01:27:13 0 d—–w- c:\program files\Lavasoft 2010-02-26 00:49:05 0 d—–w- c:\program files\Trend Micro 2010-02-25 23:59:31 0 d—–w- c:\docume~1\owner\applic~1\Panda Security 2010-02-25 19:41:56 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-25 19:41:52 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-02-25 19:41:52 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-02-25 19:30:19 0 d—–w- c:\docume~1\alluse~1\applic~1\Panda Security 2010-02-25 07:16:53 0 d-sh–w- c:\documents and settings\owner\IECompatCache 2010-02-21 09:04:26 0 d—–w- c:\windows\ie8updates 2010-02-20 15:02:33 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll 2010-02-20 15:02:31 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll 2010-02-20 15:02:28 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll 2010-02-20 15:02:27 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll 2010-02-20 15:02:19 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll 2010-02-20 15:01:58 11070464 -c—-w- c:\windows\system32\dllcache\ieframe.dll 2010-02-20 04:57:22 0 d-sh–w- c:\documents and settings\owner\PrivacIE 2010-02-19 21:03:41 0 d-sh–w- c:\documents and settings\owner\IETldCache 2010-02-19 20:01:08 81920 —-a-w- c:\windows\system32\ieencode.dll 2010-02-19 20:01:08 81920 —-a-w- c:\windows\system32\dllcache\ieencode.dll 2010-02-14 18:42:00 0 d—–w- c:\program files\Ares ==================== Find3M ==================== 2010-03-12 22:08:58 96512 —-a-w- c:\windows\system32\drivers\atapi.sys 2010-03-02 01:53:56 411368 —-a-w- c:\windows\system32\deploytk.dll 2009-12-22 05:21:05 667136 —-a-w- c:\windows\system32\wininet.dll 2009-12-16 18:43:27 343040 —-a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:08:23 33280 —-a-w- c:\windows\system32\csrsrv.dll ============= FINISH: 16:16:57.61 =============== ******************************************************************************** *********** ******************************************************************************** *********** ******************************************************************************** *********** ******************************************************************************** *********** UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-12-01.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 11/20/2006 11:11:58 PM System Uptime: 3/12/2010 4:08:55 PM (0 hours ago) Motherboard: U COMPANY | | U8648 Processor: Intel® Pentium® 4 CPU 1.80GHz | Socket 478 | 1808/100mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (NTFS) - 112 GiB total, 56.291 GiB free. D: is CDROM () E: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP359: 12/13/2009 6:27:24 AM - System Checkpoint RP360: 12/14/2009 7:17:12 AM - System Checkpoint RP361: 12/15/2009 8:17:15 AM - System Checkpoint RP362: 12/16/2009 8:18:16 AM - System Checkpoint RP363: 12/17/2009 11:29:41 AM - System Checkpoint RP364: 12/18/2009 12:44:01 PM - System Checkpoint RP365: 12/19/2009 12:56:17 PM - System Checkpoint RP366: 12/20/2009 1:07:07 PM - System Checkpoint RP367: 12/21/2009 6:14:45 PM - System Checkpoint RP368: 12/22/2009 6:53:05 PM - System Checkpoint RP369: 12/23/2009 7:07:09 PM - System Checkpoint RP370: 12/24/2009 7:18:45 PM - System Checkpoint RP371: 12/25/2009 7:49:25 PM - System Checkpoint RP372: 12/26/2009 7:56:54 PM - System Checkpoint RP373: 12/27/2009 8:20:26 PM - System Checkpoint RP374: 12/28/2009 11:44:38 PM - System Checkpoint RP375: 12/30/2009 12:01:17 AM - System Checkpoint RP376: 12/31/2009 12:48:33 AM - System Checkpoint RP377: 1/1/2010 1:00:10 AM - System Checkpoint RP378: 1/2/2010 1:56:26 AM - System Checkpoint RP379: 1/3/2010 2:06:42 AM - System Checkpoint RP380: 1/4/2010 2:52:59 AM - System Checkpoint RP381: 1/5/2010 3:34:38 AM - System Checkpoint RP382: 1/6/2010 12:26:17 PM - System Checkpoint RP383: 1/7/2010 12:36:39 PM - System Checkpoint RP384: 1/8/2010 1:05:51 PM - System Checkpoint RP385: 1/9/2010 2:02:03 PM - System Checkpoint RP386: 1/10/2010 2:59:38 PM - System Checkpoint RP387: 1/11/2010 4:11:38 PM - System Checkpoint RP388: 1/12/2010 4:25:29 PM - System Checkpoint RP389: 1/13/2010 4:27:04 PM - System Checkpoint RP390: 1/14/2010 5:27:07 PM - System Checkpoint RP391: 1/15/2010 5:32:16 PM - System Checkpoint RP392: 1/16/2010 6:09:46 PM - System Checkpoint RP393: 1/17/2010 3:00:59 AM - Software Distribution Service 3.0 RP394: 1/18/2010 11:57:43 AM - System Checkpoint RP395: 1/19/2010 12:08:09 PM - System Checkpoint RP396: 1/20/2010 12:33:20 PM - System Checkpoint RP397: 1/21/2010 12:50:21 PM - System Checkpoint RP398: 1/22/2010 1:00:44 PM - System Checkpoint RP399: 1/23/2010 1:49:19 PM - System Checkpoint RP400: 1/24/2010 3:00:49 AM - Software Distribution Service 3.0 RP401: 1/25/2010 3:40:20 AM - System Checkpoint RP402: 1/26/2010 4:26:16 AM - System Checkpoint RP403: 1/27/2010 6:32:29 AM - System Checkpoint RP404: 1/28/2010 9:02:45 AM - System Checkpoint RP405: 1/29/2010 9:43:18 AM - System Checkpoint RP406: 1/30/2010 9:47:53 AM - System Checkpoint RP407: 1/31/2010 10:41:32 AM - System Checkpoint RP408: 2/1/2010 11:31:06 AM - System Checkpoint RP409: 2/2/2010 6:51:56 PM - System Checkpoint RP410: 2/3/2010 7:00:20 PM - System Checkpoint RP411: 2/4/2010 7:12:01 PM - System Checkpoint RP412: 2/5/2010 8:11:58 PM - System Checkpoint RP413: 2/6/2010 8:13:07 PM - System Checkpoint RP414: 2/7/2010 9:36:39 PM - System Checkpoint RP415: 2/8/2010 9:47:05 PM - System Checkpoint RP416: 2/9/2010 11:42:25 PM - System Checkpoint RP417: 2/10/2010 2:59:26 AM - Software Distribution Service 3.0 RP418: 2/11/2010 3:08:15 PM - System Checkpoint RP419: 2/12/2010 4:15:59 PM - System Checkpoint RP420: 2/13/2010 4:34:10 PM - System Checkpoint RP421: 2/14/2010 4:49:14 PM - System Checkpoint RP422: 2/14/2010 9:45:00 PM - Removed Samsung PC Studio 3 RP423: 2/16/2010 12:49:01 AM - System Checkpoint RP424: 2/17/2010 12:55:15 AM - System Checkpoint RP425: 2/18/2010 9:40:53 AM - System Checkpoint RP426: 2/19/2010 12:24:06 PM - System Checkpoint RP427: 2/19/2010 2:04:14 PM - Installed Windows Internet Explorer 8. RP428: 2/20/2010 2:13:15 PM - System Checkpoint RP429: 2/21/2010 3:01:13 AM - Software Distribution Service 3.0 RP430: 2/22/2010 3:12:20 AM - System Checkpoint RP431: 2/23/2010 3:25:44 AM - System Checkpoint RP432: 2/24/2010 4:25:55 AM - System Checkpoint RP433: 2/24/2010 4:49:44 PM - Software Distribution Service 3.0 RP434: 2/25/2010 2:21:32 AM - Removed MSXML 4.0 SP2 (KB973688) RP435: 2/25/2010 12:10:50 PM - Removed Symantec AntiVirus RP436: 2/26/2010 3:55:19 PM - System Checkpoint RP437: 2/27/2010 4:33:24 PM - System Checkpoint RP438: 2/27/2010 7:14:01 PM - RegRun Virus Scan RP439: 2/27/2010 7:20:08 PM - RegRun Virus Scan RP440: 2/28/2010 6:31:17 PM - RegRun Virus Scan RP441: 3/1/2010 7:38:26 PM - Removed Java™ 6 Update 11 RP442: 3/1/2010 7:52:15 PM - Installed Java™ 6 Update 18 RP443: 3/2/2010 8:51:23 PM - RegRun Virus Scan RP444: 3/3/2010 10:55:44 AM - RegRun Virus Scan RP445: 3/4/2010 7:06:39 PM - System Checkpoint RP446: 3/5/2010 7:45:25 PM - Installed SUPERAntiSpyware Free Edition RP447: 3/6/2010 9:00:42 AM - RegRun Virus Scan RP448: 3/6/2010 2:59:46 PM - RegRun Virus Scan RP449: 3/7/2010 3:04:21 PM - System Checkpoint RP450: 3/9/2010 6:25:03 PM - Avira AntiVir Personal - 3/9/2010 18:24 RP451: 3/11/2010 12:17:18 AM - System Checkpoint RP452: 3/11/2010 10:51:52 PM - March 11 - Try to ffix RP453: 3/11/2010 11:43:59 PM - March 11 - Try to Fix ==== Installed Programs ====================== Ad-Aware Ad-Aware Email Scanner for Outlook Adobe Flash Player 10 Plugin Adobe Flash Player 9 ActiveX Adobe Reader 7.0.8 Adobe Shockwave Player 11.5 Apple Application Support Apple Mobile Device Support Apple Software Update Ares 2.1.5 AT&T Internet Security Wizard 1.5.11 AT&T Self Support Tool AT&T Toolbar AT&T Yahoo! Internet Mail AtomixMP3 v2.3 Trial ATT-HSI aTube Catcher 1.0 AutoUpdate Avira AntiVir Personal - Free Antivirus Bonjour Compatibility Pack for the 2007 Office system DivX Codec DivX Converter DivX Player DivX Version Checker DivX Web Player Easy Unit Converter eMule 0.49c ERUNT 1.1j Final Fantasy VII - Ultima Edition Free CD to MP3 Converter GenoPro 2.0.1.6 Google Earth Google Update Helper GSpot Codec Information Appliance High Quality Youtube Downloader 1.2 HijackThis 2.0.2 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) HSP56 MR Drivers Indeo Codecs iTunes Java Auto Updater Java™ 6 Update 18 K-Lite Codec Pack 4.1.6 (Full) LimeWire PRO 4.12.3 Logitech Gaming Software 5.02 Malwarebytes' Anti-Malware Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft Application Error Reporting Microsoft Choice Guard Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office XP Professional with FrontPage Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Move Media Player Mozilla Firefox (2.0.0.20) MSVCRT Nero OEM Next Video Converter 2.6.0 QuickTime RealPlayer Rhapsody Player Engine S3Display S3Gamma2 S3Info2 S3Overlay Security Update for CAPICOM (KB931906) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 8 (KB917734) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB963027) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969897) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972260) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974455) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB976325) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978706) Segoe UI SpywareBlaster 4.2 Statistics Statistics (Fall 2007 Student) SUPERAntiSpyware Free Edition TMPGEnc Plus 2.524.63.181 Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB961503) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Update for Windows XP (KB976749) Update for Windows XP (KB978207) VC80CRTRedist - 8.0.50727.762 Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Messenger Windows Live Sign-in Assistant Windows Live Upload Tool Windows Media Format 11 runtime Windows Media Player Firefox Plugin Windows Messenger 5.1 Windows XP Service Pack 3 WinPatrol 2008 WinRAR archiver Xvid 1.1.3 final uninstall ==== Event Viewer Messages From Past Week ======== 3/9/2010 5:48:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} 3/9/2010 5:45:00 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 3/9/2010 2:11:46 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect. 3/9/2010 2:11:46 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 3/9/2010 2:10:50 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE} 3/9/2010 2:00:26 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 3/9/2010 1:56:24 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips IPSec MRxSmb NetBIOS NetBT Processor PSINKNC RasAcd Rdbss SASDIFSV SASKUTIL StarOpen Tcpip 3/9/2010 1:56:24 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning. 3/9/2010 1:56:24 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 3/9/2010 1:56:24 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 3/9/2010 1:56:24 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 3/9/2010 1:56:24 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 3/9/2010 1:56:24 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 3/9/2010 1:56:01 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 3/9/2010 1:55:49 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 3/8/2010 10:38:42 AM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 3/8/2010 10:37:52 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect. 3/8/2010 10:36:34 AM, error: Service Control Manager [7001] - The Wireless Zero Configuration service depends on the NDIS Usermode I/O Protocol service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 3/8/2010 10:36:17 AM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory. 3/8/2010 10:36:17 AM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver. 3/7/2010 1:35:39 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 3/7/2010 1:35:37 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect. 3/7/2010 1:32:36 PM, error: Service Control Manager [7022] - The NanoServiceMain service hung on starting. 3/6/2010 8:48:22 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: viaagp ViaIde 3/6/2010 2:50:26 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the ALG service. 3/10/2010 6:36:09 PM, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service. 3/10/2010 4:41:14 PM, error: Service Control Manager [7022] - The Automatic Updates service hung on starting. 3/10/2010 11:44:31 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avgio avipbb Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss SASDIFSV SASKUTIL ssmdrv StarOpen Tcpip ==== End Of File =========================== ******************************************************************************** *********** ******************************************************************************** *********** The computer is working well right now. When I removed UnHackMe it stopped getting screwey at start up… except once when it had trouble booting up all together, but haven't ha any more of that. The TDDS had me reboot the computer so I did. Again… thanks!
Post #5
Hello Kilmez

The computer is working well right now.


Thats good to hear, but we may still have a lot of work to do. Please work your way through the following steps:


  • P2P Programs:

    • P2P programs are a major source of Malware infections.
    • From your log I see you have Ares 2.1.5 and LimeWire PRO 4.12.3. We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
    • The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
    • If you wish to keep the program(s), please do not use them until your computer is cleaned.
    • Information regarding the risk of using these programs can be found from here and here.
    • It is strongly recommend that you uninstall any P2P programs you have on your system.
    • To do this, Click on "Start" then on "Control Panel" and then on "Add or remove programs".
    • A list of currently installed programs will be displayed.
    • Find the Ares 2.1.5 and LimeWire PRO 4.12.3 programs, click on them once and then click on the "Remove" button.
    • If you are prompted to re-boot your computer to complete the uninstall please do so.


      PLEASE NOTE:
    • Even if you are using a P2P program that is deemed safe, it is only the program that is safe. Any files that you receive using a "safe" P2P program may be infected with Malware. Malware writers use P2P file-sharing as a major conduit to spread infected files.

  • Download Combofix and RE-NAME it BEFORE saving


    • Download Combofix from either of the links below. You must rename it to Kilmez.exe before saving it.
    • Save it to your desktop. Change the "save as file type" to "all files".
    • Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop.


    • If you are using Firefox, make sure that your download settings are as follows:
    • Tools->Options->Main tab
    • Set to "Always ask me where to Save the files".


    Link 1
    Link 2



    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.


    • NOTE: If ComboFix asks to install the Recovery Console, please ALLOW it to do so.


    • Double click on the renamed ComboFix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the C:\ComboFix.txt so we can continue cleaning the system.
Post #6
Hi again… here is the Combo Fix log…



ComboFix 10-03-13.01 - Owner 03/13/2010 11:28:40.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.223.101 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\Kilmez.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\Uninstall
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\drivers\4T9997F.sys
c:\windows\system32\ndisapi.dll
c:\windows\system32\vbzlib1.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_NDISRD
——-\Service_NDISRD


((((((((((((((((((((((((( Files Created from 2010-02-13 to 2010-03-13 )))))))))))))))))))))))))))))))
.

2010-03-12 05:48 . 2010-03-12 05:48 ——– d—–w- c:\program files\ERUNT
2010-03-10 20:29 . 2010-03-10 20:29 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-03-10 18:18 . 2010-03-10 18:18 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-03-10 00:27 . 2010-03-11 00:31 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-03-10 00:27 . 2009-03-30 15:33 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2010-03-10 00:27 . 2009-02-13 17:29 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-03-10 00:27 . 2009-02-13 17:17 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2010-03-10 00:27 . 2010-03-10 00:27 ——– d—–w- c:\program files\Avira
2010-03-10 00:27 . 2010-03-10 00:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2010-03-09 23:46 . 2010-03-09 23:46 ——– d—–w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-03-06 01:59 . 2010-03-06 01:59 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-06 01:45 . 2010-03-06 01:46 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-03-06 01:45 . 2010-03-06 01:45 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-03-03 03:24 . 2010-03-03 03:24 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-03-03 03:24 . 2010-03-03 03:24 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Apple Computer
2010-03-02 02:01 . 2010-03-02 02:01 ——– d—–w- c:\program files\Common Files\Java
2010-03-01 01:38 . 2010-03-01 01:36 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-02-28 19:11 . 2010-02-28 19:11 ——– d—–w- c:\documents and settings\NetworkService\Application Data\AdobeUM
2010-02-28 19:10 . 2010-02-28 19:11 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-02-28 01:03 . 2010-03-03 03:02 2 –shatr- c:\windows\winstart.bat
2010-02-26 19:34 . 2010-03-13 15:56 ——– d—–w- c:\program files\FireFox
2010-02-26 15:29 . 2010-02-04 15:52 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-02-26 02:23 . 2010-02-26 02:23 ——– d—–w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-26 01:41 . 2010-02-26 02:25 ——– d—–w- c:\program files\SpywareBlaster
2010-02-26 01:32 . 2010-02-04 15:53 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-26 01:29 . 2010-02-26 01:29 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-02-26 01:27 . 2010-02-26 01:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-02-26 01:27 . 2010-02-26 01:30 ——– d—–w- c:\program files\Lavasoft
2010-02-26 00:49 . 2010-02-26 00:51 ——– d—–w- c:\program files\Trend Micro
2010-02-25 23:59 . 2010-02-25 23:59 ——– d—–w- c:\documents and settings\Owner\Application Data\Panda Security
2010-02-25 19:41 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 19:41 . 2010-02-25 19:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-25 19:41 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-25 19:30 . 2010-03-09 23:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Panda Security
2010-02-25 07:16 . 2010-02-25 07:16 ——– d-sh–w- c:\documents and settings\Owner\IECompatCache
2010-02-24 22:24 . 2010-02-24 22:24 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-02-21 09:04 . 2010-02-25 18:00 ——– d—–w- c:\windows\ie8updates
2010-02-20 15:02 . 2009-12-21 19:14 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2010-02-20 15:02 . 2009-12-21 19:14 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-02-20 15:02 . 2009-12-21 19:14 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-02-20 15:02 . 2009-12-21 19:14 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-20 15:02 . 2009-12-21 19:14 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2010-02-20 15:01 . 2009-12-21 19:14 11070464 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2010-02-20 04:57 . 2010-02-20 04:57 ——– d-sh–w- c:\documents and settings\Owner\PrivacIE
2010-02-19 21:03 . 2010-02-19 21:03 ——– d-sh–w- c:\documents and settings\Owner\IETldCache
2010-02-19 20:01 . 2009-12-22 05:20 81920 —-a-w- c:\windows\system32\ieencode.dll
2010-02-19 20:01 . 2009-12-22 05:20 81920 —-a-w- c:\windows\system32\dllcache\ieencode.dll
2010-02-14 18:42 . 2010-02-14 18:42 ——– d—–w- c:\program files\Ares

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-12 22:08 . 2002-08-29 05:27 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-03-10 16:40 . 2010-03-10 16:39 20829680 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold.exe
2010-03-10 16:39 . 2010-03-10 16:39 8405312 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-03-10 16:38 . 2010-03-10 16:38 149000 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
2010-03-10 16:38 . 2010-03-10 16:37 10309448 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe
2010-03-10 16:37 . 2010-03-10 16:37 181768 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\carb\LaunchHelper.exe
2010-03-10 16:37 . 2010-03-10 16:37 283280 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\carb\CarboniteSetupLiteRealPreinstaller.exe
2010-03-10 16:37 . 2010-03-10 16:37 79368 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-03-10 16:36 . 2010-03-10 16:36 64000 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-03-10 16:36 . 2010-03-10 16:36 52288 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-03-10 16:36 . 2010-03-10 16:36 50688 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-03-10 16:36 . 2010-03-10 16:36 118784 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-03-10 16:36 . 2010-03-10 16:36 49152 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-03-10 01:28 . 2010-03-10 01:28 439816 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\setup.exe
2010-03-09 23:54 . 2006-11-21 05:24 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-03-09 23:47 . 2010-03-09 23:47 52224 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-03-09 23:47 . 2010-03-09 23:47 117760 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-06 02:02 . 2010-03-06 02:02 52224 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-03-06 02:01 . 2010-03-06 02:01 117760 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-06 01:37 . 2008-11-15 04:34 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-03-02 02:00 . 2010-03-02 02:00 348160 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-35f639fc-n\msvcr71.dll
2010-03-02 02:00 . 2010-03-02 02:00 503808 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-35f639fc-n\msvcp71.dll
2010-03-02 02:00 . 2010-03-02 02:00 499712 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-35f639fc-n\jmc.dll
2010-03-02 02:00 . 2010-03-02 02:00 61440 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-75b0ef46-n\decora-sse.dll
2010-03-02 02:00 . 2010-03-02 02:00 12800 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-75b0ef46-n\decora-d3d.dll
2010-03-02 01:53 . 2008-12-15 03:53 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-03-01 01:35 . 2010-03-01 01:35 6330848 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-01 01:35 . 2010-03-01 01:35 329048 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-01 01:35 . 2010-03-01 01:35 94712 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-01 01:35 . 2010-03-01 01:35 17480 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\EmailScannerBridge.dll
2010-03-01 01:35 . 2010-03-01 01:35 961984 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-01 01:35 . 2010-03-01 01:35 835312 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-01 01:35 . 2010-03-01 01:35 842992 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-01 01:35 . 2010-03-01 01:35 1593320 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-03-01 01:35 . 2010-03-01 01:35 815184 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-01 01:35 . 2010-03-01 01:35 1229232 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-02-28 09:14 . 2007-05-19 07:25 ——– d—–r- c:\program files\eMule
2010-02-26 19:29 . 2006-11-21 05:50 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-02-25 18:15 . 2006-11-21 06:51 ——– d—–w- c:\program files\Symantec AntiVirus
2010-02-25 18:15 . 2006-11-21 05:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2010-02-23 22:14 . 2008-05-02 18:26 ——– d—–w- c:\program files\Final Fantasy VII
2010-02-06 16:23 . 2010-02-06 16:19 ——– d—–w- c:\program files\iTunes
2010-02-06 16:20 . 2010-02-06 16:20 ——– d—–w- c:\program files\iPod
2010-02-06 16:20 . 2007-07-28 18:27 ——– d—–w- c:\program files\Common Files\Apple
2010-02-06 16:08 . 2007-07-28 18:30 ——– d—–w- c:\program files\QuickTime
2010-02-06 15:50 . 2010-02-06 15:50 72488 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-04 15:53 . 2010-02-26 01:29 2954656 -c–a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-01-11 03:12 . 2009-09-12 23:17 144160 —-a-w- c:\documents and settings\Owner\Application Data\Move Networks\uninstall.exe
2010-01-11 03:12 . 2009-12-10 19:26 4187512 —-a-w- c:\documents and settings\Owner\Application Data\Move Networks\plugins\npqmp071505000011.dll
2010-01-11 03:12 . 2010-01-11 03:12 1436320 —-a-w- c:\documents and settings\Owner\Application Data\Move Networks\MoveMediaPlayerWinSilent_071505000011.exe
2009-12-31 16:50 . 2001-08-23 12:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:21 . 2006-06-23 17:33 667136 —-a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2006-11-21 05:04 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2002-08-29 07:40 33280 —-a-w- c:\windows\system32\csrsrv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"VTPreset"="VTPreset.exe" [2004-02-25 45056]
"AudioDeck"="c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe" [2006-11-02 528384]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
"ATT-SST_McciTrayApp"="c:\program files\ATT-SST\McciTrayApp.exe" [2008-09-19 1529856]
"ISW.exe"="c:\program files\AT&T\Internet Security Wizard\ISW.exe" [2007-05-03 2061816]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-06 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG111T Smart Wizard.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NETGEAR WG111T Smart Wizard.lnk
backup=c:\windows\pss\NETGEAR WG111T Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-06-03 02:44 1660952 —-a-w- c:\program files\Messenger\Msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 ineti;C;??\c:\windows\TEMP\lzctreqbj.sys [x]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 16512]
R3 ATHFMWDL;NETGEAR WG111T bootloader driver;c:\windows\system32\Drivers\ATHFMWDL.sys [x]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\System32\DNINDIS5.SYS [2003-07-24 17149]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-01 1229232]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-02-17 12872]
R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-14 135664]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-02-04 64288]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-02-17 66632]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]

.
Contents of the 'Scheduled Tasks' folder

2010-03-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 01:35]
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://www.msn.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: 0.0.0.0
Trusted Zone: motive.com\patttbc.att
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\wal9bexx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13917&gct=&gc=1&q=
FF - component: c:\program files\FireFox\components\xpinstal.dll
.
- - - - ORPHANS REMOVED - - - -

ShellIconOverlayIdentifiers-{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6} - c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.DLL
ShellIconOverlayIdentifiers-{0847B599-9191-4A27-BD61-DE11598D3B1B} - c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.DLL
ShellIconOverlayIdentifiers-{9AE343CB-BA45-4618-AF6A-0230EE6FC793} - c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.DLL
Notify-WgaLogon - (no file)
SafeBoot-klmdb.sys
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
ActiveSetup-{28ABC5C0-4FCF-11CF-ADX5-81NXC1C635612} - c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\wisenis32.exe
AddRemove-Final Fantasy VII - c:\program files\Final Fantasy VII\Uninst.isu
AddRemove-HijackThis - c:\documents and settings\Owner\My Documents\Anti-Spyware\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-13 11:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe 1????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(524)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(2748)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-03-13 12:08:15 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-13 18:07

Pre-Run: 62,035,619,840 bytes free
Post-Run: 61,953,871,872 bytes free

- - End Of File - - 0AAD626D4E0540A73EE816CA3023EAD8
Post #7
Hello Kilmez

Thank you for the log.

I can see that you use Avira AntiVir as your resident Anti-virus, but I can also see evidence of Symantec (Norton) products in your log. Do you still use Norton products? If you do not, and if you would like to remove these products from your system please let me know and I will provide a removal tool once you machine is clean.

Do you still use the NETGEAR WG111T bootloader? Please let me know.


  • P2P Programs:

    • I can see you have "eMule" installed (I missed this from your previous post :( ).
    • To remove eMule, Please follow the same removal instructions you used for Ares and LimeWire (post #5).

  • Please work through the following steps


    • Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
    • NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
    • Copy and Paste the text in the codebox below into the open Notepad window:

      http://forums.whatthetech.com/Definitely_infected_please_help_t110864.html&view=findpost&p=640782#entry640782

Collect::
c:\windows\TEMP\lzctreqbj.sys

Driver::
ineti

DDS::
Trusted Zone: 0.0.0.0
Trusted Zone: motive.com\patttbc.att
    • Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
    • Close any open browsers.
    • Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Refering to the picture below, drag CFScript.txt into ComboFix.exe

      [external image: Posted Image]
    • When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
    • Once the log is produced, re-engage your resident anti virus.
    • Note: When ComboFix finishes running, the ComboFix log will open along with a message box - do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
    • Ensure you are connected to the internet and click OK on the message box.

  • MBAM:

    • I can see you have MBAM installed.
    • Double click on the MalwareBytes AntiMalware icon to launch the program.
    • A screen will appear. It will look like this:

    [external image: Posted Image]


    • Click on the "Update" tab and then on "Check for Updates".
    • The program will now install the latest Malware definition files.
    • Once complete, click on the "Scanner" tab, select "Perform full scan"and then click on "Scan".
    • Once the program has scanned your computer, a log file will be created in Notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.


    • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
    • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
    • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
    • Come back here to this thread and Paste the log in your next reply.

  • Please perform the following scan:


    • This is a very deep scan that can take many hours. In some instances you may need to let it run overnight. Please be patient.
    • It is recommended that you disable your onboard antivirus program and antispyware programs while performing scans to eliminate software conflicts and to speed up scan time.
    • DO NOT surf the net while your resident protection is disabled!
    • Once the scan is finished remember to re-enable your resident antivirus protection along with whatever antispyware applications you use.

    Please perform a Kaspersky Online Scan of your computer by clicking here.
    An alternative link to the Kaspersky Online Scan Tool can be found here.

    You will be taken to a web page. It will look like this:
    [external image: Posted Image]
    • Click on the Accept button and install any components it needs.
    • The program will install and then begin downloading the latest definition files.
    • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
    • This will start the program and scan your system.
    • The scan will take a while, so be patient and let it run (at times it may appear to stall).
    • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.

    • Once the scan is complete, click on View scan report. To obtain the report:
    • Click on: Save Report As
    • Next, in the Save as prompt, Save in area, select: Desktop
    • In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select:Text file [*.txt]
    • Then, click: Save
    • Please post the Kaspersky Online Scanner Report in your reply.
    • If you need help performing the above steps, an animated tutorial can be found here.

    In your next reply, please provide the ComboFix log, the MBAM log and the Kaspersky Online Scan log.
Post #8
Finally, the Kaspersky scan took 8 hours. :pullhair: As for the P2P programs I have Im gonna keep em a while… I know I shouldn't, in fact last time I got help the same recommendation was made. Evetually I'll ge rid of them… but not just yet… :blush:
Also, I still use the Netgear bootloader, and yes… once the pc is clean could you send me the tool to get rid of any Symantec remainders???

Well, here are the logs:

***********************************************************************
***********************************************************************

ComboFix 10-03-13.01 - Owner 03/14/2010 0:55.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.223.101 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\Kilmez.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_INETI
——-\Service_ineti


((((((((((((((((((((((((( Files Created from 2010-02-14 to 2010-03-14 )))))))))))))))))))))))))))))))
.

2010-03-12 05:48 . 2010-03-12 05:48 ——– d—–w- c:\program files\ERUNT
2010-03-10 20:29 . 2010-03-10 20:29 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-03-10 18:18 . 2010-03-10 18:18 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-03-10 16:39 . 2010-03-10 16:40 20829680 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold.exe
2010-03-10 16:39 . 2010-03-10 16:39 8405312 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-03-10 16:38 . 2010-03-10 16:38 149000 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
2010-03-10 16:37 . 2010-03-10 16:38 10309448 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe
2010-03-10 16:37 . 2010-03-10 16:37 181768 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\carb\LaunchHelper.exe
2010-03-10 16:37 . 2010-03-10 16:37 283280 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\carb\CarboniteSetupLiteRealPreinstaller.exe
2010-03-10 16:37 . 2010-03-10 16:37 79368 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-03-10 16:36 . 2010-03-10 16:36 64000 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-03-10 16:36 . 2010-03-10 16:36 52288 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-03-10 16:36 . 2010-03-10 16:36 50688 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-03-10 16:36 . 2010-03-10 16:36 118784 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-03-10 16:36 . 2010-03-10 16:36 49152 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-03-10 01:28 . 2010-03-10 01:28 439816 —-a-w- c:\documents and settings\Owner\Application Data\Real\Update\setup3.10\setup.exe
2010-03-10 00:27 . 2010-03-11 00:31 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-03-10 00:27 . 2009-03-30 15:33 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2010-03-10 00:27 . 2009-02-13 17:29 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-03-10 00:27 . 2009-02-13 17:17 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2010-03-10 00:27 . 2010-03-10 00:27 ——– d—–w- c:\program files\Avira
2010-03-10 00:27 . 2010-03-10 00:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2010-03-09 23:47 . 2010-03-09 23:47 52224 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-03-09 23:47 . 2010-03-09 23:47 117760 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-09 23:46 . 2010-03-09 23:46 ——– d—–w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-03-06 02:02 . 2010-03-06 02:02 52224 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-03-06 02:01 . 2010-03-06 02:01 117760 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-03-06 01:59 . 2010-03-06 01:59 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-06 01:45 . 2010-03-06 01:46 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-03-06 01:45 . 2010-03-06 01:45 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-03-03 03:24 . 2010-03-03 03:24 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2010-03-03 03:24 . 2010-03-03 03:24 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Apple Computer
2010-03-02 02:01 . 2010-03-02 02:01 ——– d—–w- c:\program files\Common Files\Java
2010-03-02 02:00 . 2010-03-02 02:00 348160 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-35f639fc-n\msvcr71.dll
2010-03-02 02:00 . 2010-03-02 02:00 503808 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-35f639fc-n\msvcp71.dll
2010-03-02 02:00 . 2010-03-02 02:00 499712 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-35f639fc-n\jmc.dll
2010-03-02 02:00 . 2010-03-02 02:00 61440 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-75b0ef46-n\decora-sse.dll
2010-03-02 02:00 . 2010-03-02 02:00 12800 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-75b0ef46-n\decora-d3d.dll
2010-03-01 01:38 . 2010-03-01 01:36 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-01 01:35 . 2010-03-01 01:35 6330848 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-03-01 01:35 . 2010-03-01 01:35 329048 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-03-01 01:35 . 2010-03-01 01:35 94712 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-03-01 01:35 . 2010-03-01 01:35 17480 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\EmailScannerBridge.dll
2010-03-01 01:35 . 2010-03-01 01:35 961984 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-03-01 01:35 . 2010-03-01 01:35 835312 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-03-01 01:35 . 2010-03-01 01:35 842992 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-03-01 01:35 . 2010-03-01 01:35 1593320 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-03-01 01:35 . 2010-03-01 01:35 815184 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-03-01 01:35 . 2010-03-01 01:35 1229232 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-02-28 19:11 . 2010-02-28 19:11 ——– d—–w- c:\documents and settings\NetworkService\Application Data\AdobeUM
2010-02-28 19:10 . 2010-02-28 19:11 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-02-28 01:03 . 2010-03-03 03:02 2 –shatr- c:\windows\winstart.bat
2010-02-26 19:34 . 2010-03-14 06:47 ——– d—–w- c:\program files\FireFox
2010-02-26 15:29 . 2010-02-04 15:52 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-02-26 02:23 . 2010-02-26 02:23 ——– d—–w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-26 01:41 . 2010-02-26 02:25 ——– d—–w- c:\program files\SpywareBlaster
2010-02-26 01:32 . 2010-02-04 15:53 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-26 01:29 . 2010-02-04 15:53 2954656 -c–a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-02-26 01:29 . 2010-02-26 01:29 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-02-26 01:27 . 2010-02-26 01:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-02-26 01:27 . 2010-02-26 01:30 ——– d—–w- c:\program files\Lavasoft
2010-02-26 00:49 . 2010-02-26 00:51 ——– d—–w- c:\program files\Trend Micro
2010-02-25 23:59 . 2010-02-25 23:59 ——– d—–w- c:\documents and settings\Owner\Application Data\Panda Security
2010-02-25 19:41 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-25 19:41 . 2010-02-25 19:42 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-25 19:41 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-25 19:30 . 2010-03-09 23:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Panda Security
2010-02-25 07:16 . 2010-02-25 07:16 ——– d-sh–w- c:\documents and settings\Owner\IECompatCache
2010-02-24 22:24 . 2010-02-24 22:24 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-02-21 09:04 . 2010-02-25 18:00 ——– d—–w- c:\windows\ie8updates
2010-02-20 15:02 . 2009-12-21 19:14 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2010-02-20 15:02 . 2009-12-21 19:14 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-02-20 15:02 . 2009-12-21 19:14 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-02-20 15:02 . 2009-12-21 19:14 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-20 15:02 . 2009-12-21 19:14 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2010-02-20 15:01 . 2009-12-21 19:14 11070464 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2010-02-20 04:57 . 2010-02-20 04:57 ——– d-sh–w- c:\documents and settings\Owner\PrivacIE
2010-02-19 21:03 . 2010-02-19 21:03 ——– d-sh–w- c:\documents and settings\Owner\IETldCache
2010-02-19 20:01 . 2009-12-22 05:20 81920 —-a-w- c:\windows\system32\ieencode.dll
2010-02-19 20:01 . 2009-12-22 05:20 81920 —-a-w- c:\windows\system32\dllcache\ieencode.dll
2010-02-14 18:42 . 2010-02-14 18:42 ——– d—–w- c:\program files\Ares

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-12 22:08 . 2002-08-29 05:27 96512 ——w- c:\windows\system32\drivers\atapi.sys
2010-03-09 23:54 . 2006-11-21 05:24 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-03-06 01:37 . 2008-11-15 04:34 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-03-02 01:53 . 2008-12-15 03:53 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-02-28 09:14 . 2007-05-19 07:25 ——– d—–r- c:\program files\eMule
2010-02-26 19:29 . 2006-11-21 05:50 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-02-25 18:15 . 2006-11-21 06:51 ——– d—–w- c:\program files\Symantec AntiVirus
2010-02-25 18:15 . 2006-11-21 05:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2010-02-23 22:14 . 2008-05-02 18:26 ——– d—–w- c:\program files\Final Fantasy VII
2010-02-06 16:23 . 2010-02-06 16:19 ——– d—–w- c:\program files\iTunes
2010-02-06 16:20 . 2010-02-06 16:20 ——– d—–w- c:\program files\iPod
2010-02-06 16:20 . 2007-07-28 18:27 ——– d—–w- c:\program files\Common Files\Apple
2010-02-06 16:08 . 2007-07-28 18:30 ——– d—–w- c:\program files\QuickTime
2010-02-06 15:50 . 2010-02-06 15:50 72488 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-01-11 03:12 . 2009-09-12 23:17 144160 —-a-w- c:\documents and settings\Owner\Application Data\Move Networks\uninstall.exe
2010-01-11 03:12 . 2009-12-10 19:26 4187512 —-a-w- c:\documents and settings\Owner\Application Data\Move Networks\plugins\npqmp071505000011.dll
2010-01-11 03:12 . 2010-01-11 03:12 1436320 —-a-w- c:\documents and settings\Owner\Application Data\Move Networks\MoveMediaPlayerWinSilent_071505000011.exe
2009-12-31 16:50 . 2001-08-23 12:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 05:21 . 2006-06-23 17:33 667136 ——w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2006-11-21 05:04 343040 —-a-w- c:\windows\system32\mspaint.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"VTPreset"="VTPreset.exe" [2004-02-25 45056]
"AudioDeck"="c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe" [2006-11-02 528384]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
"ATT-SST_McciTrayApp"="c:\program files\ATT-SST\McciTrayApp.exe" [2008-09-19 1529856]
"ISW.exe"="c:\program files\AT&T;\Internet Security Wizard\ISW.exe" [2007-05-03 2061816]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-06 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG111T Smart Wizard.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NETGEAR WG111T Smart Wizard.lnk
backup=c:\windows\pss\NETGEAR WG111T Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-06-03 02:44 1660952 —-a-w- c:\program files\Messenger\Msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 16512]
R3 ATHFMWDL;NETGEAR WG111T bootloader driver;c:\windows\system32\Drivers\ATHFMWDL.sys [x]
R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\System32\DNINDIS5.SYS [2003-07-24 17149]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-03-01 1229232]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-02-17 12872]
R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-14 135664]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-02-04 64288]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-02-17 66632]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]

.
Contents of the 'Scheduled Tasks' folder

2010-03-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 01:35]
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://www.msn.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\wal9bexx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p;=
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13917&gct;=&gc;=1&q;=
FF - component: c:\program files\FireFox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-14 01:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe 1????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(524)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(1792)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-03-14 01:32:00 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-14 07:31
ComboFix2.txt 2010-03-13 18:08

Pre-Run: 61,944,340,480 bytes free
Post-Run: 61,910,257,664 bytes free

- - End Of File - - DE56F702324C07F200D6D3EB2D8B087A

***********************************************************************
***********************************************************************

Malwarebytes' Anti-Malware 1.44
Database version: 3865
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

3/14/2010 5:30:16 AM
mbam-log-2010-03-14 (05-30-16).txt

Scan type: Full Scan (C:\|)
Objects scanned: 204050
Time elapsed: 1 hour(s), 7 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\4T9997F.sys.vir (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3454468E-9477-4148-B1AC-26ED7ED7F8F0}\RP454\A0139227.sys (Rootkit.Agent) -> Quarantined and deleted successfully.


***********************************************************************
***********************************************************************

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, March 14, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, March 14, 2010 09:29:41
Records in database: 3793735
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Objects scanned: 74033
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 08:22:56


File name / Threat / Threats count
C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\57\36d3f0f9-522837ef Infected: Trojan-Downloader.Java.Agent.ab 1

Selected area has been scanned.

***********************************************************************
***********************************************************************

Seriously… thank you so much for your help. :thumbup:
Post #9
Hello Kilmez

Thank you for the logs.

As for the P2P programs I have Im gonna keep em a while… I know I shouldn't, in fact last time I got help the same recommendation was made.

You were given good advice then and now.

Chances are you became infected through files acquired when using your P2P programs. This time it was a TDL3 rootkit infection (nasty). The next time it might be Virut, in which case you would have to perform a full system reformat if you wanted your computer back.

We can only advise you to remove these programs. However, you are responsible for making that decision, and therefore (by extension) for any future damage that may be caused to your machine by not removing them.

The one remaining infected file is located in your Java Cache. We will take care of this now:


  • Please Clear Your Sun Java Cache


    • Click on "Start", then on "Control Panel" and then on the Java icon (looks like a coffee cup). If you do not see the icon, look to your left and click "Switch to Classic View".
    • On the "General" tab, under "Temporary Internet Files", click the "Settings" button.
    • Next, click on the "Delete Files" button.
    • There are two options in the window to clear the cache - ("Applications and Applets" and "Trace and Log Files").
    • Leave BOTH Checked
    • Click "OK" on Delete Temporary Files Window.
    • Note: This deletes ALL the Downloaded Applications and Applets from the Cache.
    • Click "OK" to leave the Temporary Files Window.
    • Click "OK" to leave the Java Control Panel.


    once the pc is clean could you send me the tool to get rid of any Symantec remainders???

  • Please download and run the Norton Removal Tool


    • The Norton removal tool will locate and remove all traces of Norton products from your computer.
    • To download the tool, click here.
    • Read throught the information on the page, and then select the Norton product that you have (this is the one that will be removed).
    • Follow the instructions to obtain the removal tool and to complete the removal process.

  • Please remove the following tools


    • You no longer need GMER, DDS or TDSSKiller.
    • Please delete these tools from your system.

  • Please Uninstall Combofix

    • Click on "Start" and then on "Run".
    • Now type combofix /uninstall in the run box and click "OK". Please note the space between the "x" and the "/Uninstall", it needs to be there.

  • Your Internet Explorer is out of date


    • A newer version of Internet Explorer is available from here.
    • Alternatively, you can use Firefox (I will provide the link later).

  • Your Adobe is out of date


    • You can obtain the latest version of Adobe Reader from here, and the latest version of Flash Player from here.
    • For more information and links to Adobe updates and downloads click here.


    Once you have completed the above steps you should be good to go! If you have any further questions, please feel free to ask.

  • Finally, please take the time to read through the information provided below:

    Enhance your System Security

    • For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.

    • IMPORTANT! Do not run more than ONE firewall and ONE real-time antivirus on your system at any one time. When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
    • Once complete, remember to re-engage your resident security before going online.

    Web Browsers and Browser Security

    Firefox
    • Firefox is generally considered to have greater browsing security in comparison to other popular programs. You can download Firefox 3.0 from here.

    No-Script
    • If you use Firefox as your default browser, No-Script can provide additional security by preventing malicious scripts from being executed on your system.
    • You can download No-Script by clicking here.

    Internet Explorer
    • The newest version of Internet Explorer is available from here.

    SpywareBlaster
    • If you use Internet Explorer as your default browser, SpywareBlaster would be a valuable addition to your online security.
    • SpywareBlaster prevents malicious ActiveX objects from being downloaded onto your system.
    • You can download SpywareBlaster by clicking here.

    Web of Trust
    • When using search engines, Web of Trust provides you with an easy way of telling the good sites from the bad and is compatible with both Firefox and Internet Explorer.
    • Coloured symbols are displayed next to search results, giving you more confidence in the links you choose to click on: Green (To go), Yellow (Caution) and Red (Stop).
    • You can download Web of Trust by clicking here.

    Keep your Software Updated
    • Outdated software can sometimes have vulnerabilities that are exploitable by malware.
    • Check if there are available updates for your installed software with Secunia's Online Software Inspector by clicking here.

    Passwords
    • Learn how to create strong passwords by clicking here and test the strength of the passwords you already use by clicking here.

    General Reading

    Learn How To Combat Malware
    • Would you like to learn how to fight back against malware and help others? Enroll at the What The Tech (Formerly Tom Coyotes) Malware Classroom by clicking here.
Post #10
Thanks for your help JonTom! :notworthy: Did all the last steps you told me to. I know I should get rid of the P2P's, but hopefully I'll be getting a new PC soon, this one is really old… once I have the new one I won't be using any of those programs no more. Once again… thanks!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI