What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Multiple IE popping up

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi,

Recently, when I open up Internet Explorer, sometimes multiple windows would pop up, and the only way I can stop it is by ending iexplore.exe on my Task Manager.
I'm not sure if I'm infected or not, and I would really appreciate some help.

Thanks so much!

Below are DDS.txt and my GMER.txt, and attached is my Attach.txt.


DDS.txt


DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 22:43:21.95 on 29/04/2010
Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_13
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.2813.1470 [GMT -7:00]

AV: nProtect GameGuard Personal 2007 *On-access scanning enabled* (Updated) {7D36BE97-9969-4C9F-9DC1-282DB4E1FBEA}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\STacSV.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\aestsrv.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe
C:\Windows\system32\INCAinternet\nProtect Security Platform 2007\nspsvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\SMINST\BLService.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\INCAInternet\nProtect Security Platform 2007\nspupsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Crawler\Notes\CNotes.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conime.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\INCAInternet\nProtect Security Platform 2007\nspupdt.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\ieuser.exe
c:\Program Files\MSN\Toolbar\3.0.0541.0\msntask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10e.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Marilyn Mach\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JFGQLNBM\dds[1].scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=91&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=91&bd=Pavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=91&bd=Pavilion&pf=cnnb
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.0.0.125\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.0.0.125\IPSBHO.DLL
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.0.0.125\coIEPlg.dll
TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [Aim6]
uRun: [BitTorrent DNA] "c:\users\marilyn mach\program files\dna\btdna.exe"
uRun: [CrawlerNotes] c:\progra~1\crawler\notes\cnotes.exe /notesshow
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [AdobeUpdater6] "c:\program files\common files\adobe\updater6\Adobe_Updater.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [DVDAgent] "c:\program files\hewlett-packard\media\dvd\DVDAgent.exe"
mRun: [TSMAgent] "c:\program files\hewlett-packard\touchsmart\media\TSMAgent.exe"
mRun: [CLMLServer for HP TouchSmart] "c:\program files\hewlett-packard\touchsmart\media\kernel\clml\CLMLSvc.exe"
mRun: [TVAgent] "c:\program files\hewlett-packard\media\tv\TVAgent.exe"
mRun: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"
mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"
mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [WirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [UCam_Menu] "c:\program files\hewlett-packard\media\webcam\muitransfer\muistartmenu.exe" "c:\program files\hewlett-packard\media\webcam" update "software\hewlett-packard\media\Webcam"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [nProtect Security Platform 2007] c:\program files\incainternet\nprotect security platform 2007\nspmain.exe -tray
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: []
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
StartupFolder: c:\users\marily~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &AIM Toolbar Search
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-ca.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-ca.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
AppInit_DLLs: avgrsstx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\users\marily~1\appdata\roaming\mozilla\firefox\profiles\ci5f330q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-4-16 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-4-16 29512]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-4-16 242896]
R2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/03/14 02:35:35];c:\program files\hewlett-packard\media\dvd\000.fcl [2008-11-28 87536]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_e7ea6efc\AEstSrv.exe [2009-3-14 77824]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-4-16 308064]
R2 hpsrv;HP Service;c:\windows\system32\hpservice.exe [2008-3-18 19456]
R3 enecir;ENE CIR Receiver;c:\windows\system32\drivers\enecir.sys [2008-1-24 52736]
R3 TKFsAc;TKFsAc;c:\windows\system32\TKFsAc2k.sys [2009-5-15 87776]
R3 TKFsFt;TKFsFt;c:\windows\system32\TKFsFt2k.sys [2009-5-15 82016]
R3 TKRgAc;TKRgAc;c:\windows\system32\TKRgAc2k.sys [2009-5-15 41984]
R3 TKRgFt;TKRgFt;c:\windows\system32\TKRgFtXp.sys [2009-5-15 24704]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2009-4-2 22072]
S3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-3-7 222512]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2008-7-21 100184]
S3 TKFsAv;TKFsAv;c:\windows\system32\TKFsAv2k.sys [2009-5-15 55776]

=============== Created Last 30 ================

2010-04-30 05:43:44 0 d—–w- c:\temp\Update
2010-04-23 05:01:12 505104 —-a-w- c:\windows\system32\msxml.dll
2010-04-23 05:01:12 115016 —-a-w- c:\windows\system32\MSINET.OCX
2010-04-23 05:01:10 89360 —-a-w- c:\windows\system32\VB5DB.DLL
2010-04-23 05:01:10 69632 —-a-w- c:\windows\system32\xmltok.dll
2010-04-23 05:01:10 36864 —-a-w- c:\windows\system32\xmlparse.dll
2010-04-23 05:01:10 35840 —-a-w- c:\windows\system32\comdlg32.oca
2010-04-23 05:01:10 29184 —-a-w- c:\windows\system32\MSINET.oca
2010-04-23 05:01:10 28432 —-a-w- c:\windows\system32\msxmlr.dll
2010-04-23 05:01:10 26088 —-a-w- c:\windows\system32\xmlinst.exe
2010-04-23 05:01:10 24576 —-a-w- c:\windows\system32\msxml3a.dll
2010-04-23 05:01:08 0 d—–w- c:\program files\directx
2010-04-22 22:08:49 0 d—–w- c:\users\marily~1\appdata\roaming\BitTorrent
2010-04-22 05:08:29 297 —-a-w- c:\windows\EReg077.dat
2010-04-22 05:07:36 289280 —-a-w- c:\windows\uninst.exe
2010-04-22 04:57:04 0 d–h–w- C:\$AVG
2010-04-16 19:39:33 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-04-16 19:39:30 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-16 19:39:23 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-04-16 19:39:20 0 d—–w- c:\windows\system32\drivers\Avg
2010-04-16 19:35:58 0 d—–w- c:\programdata\avg9
2010-04-15 00:53:32 3600776 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-15 00:53:32 3548040 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-04-15 00:53:28 79360 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-15 00:53:28 212992 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-15 00:53:28 106496 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-15 00:52:13 430080 —-a-w- c:\windows\system32\vbscript.dll
2010-04-15 00:51:58 62464 —-a-w- c:\windows\system32\l3codeca.acm
2010-04-15 00:51:58 220672 —-a-w- c:\windows\system32\l3codecp.acm
2010-04-15 00:50:00 904576 —-a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-15 00:49:59 25088 —-a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-15 00:49:59 200704 —-a-w- c:\windows\system32\iphlpsvc.dll
2010-04-13 21:20:34 172032 —-a-w- c:\windows\system32\wintrust.dll
2010-04-13 21:20:32 98304 —-a-w- c:\windows\system32\cabview.dll
2010-04-04 06:37:58 86683 —-a-w- c:\windows\system32\pthreadGC2.dll
2010-04-04 06:37:56 0 d—–w- c:\program files\AoA Audio Extractor
2010-04-02 07:17:09 0 d—–w- c:\program files\AVG

==================== Find3M ====================

2010-04-30 01:08:44 672380 —-a-w- c:\windows\system32\perfh00C.dat
2010-04-30 01:08:44 132080 —-a-w- c:\windows\system32\perfc00C.dat
2010-04-13 17:04:04 82016 —-a-w- c:\windows\system32\TKFsFt2k.sys
2010-04-13 17:04:04 81002 —-a-w- c:\windows\system32\TKFsFtNt4.sys
2010-04-13 17:04:04 69382 —-a-w- c:\windows\system32\TKFsAvNt4.sys
2010-04-13 17:04:04 65632 —-a-w- c:\windows\system32\TKFsAv2k64.sys
2010-04-13 17:04:04 63584 —-a-w- c:\windows\system32\TKFsFt2k64.sys
2010-04-13 17:04:04 55776 —-a-w- c:\windows\system32\TKFsAv2k.sys
2010-04-13 17:04:04 41476 —-a-w- c:\windows\system32\TKToolNt4.sys
2010-04-13 17:04:04 27232 —-a-w- c:\windows\system32\TKTool2k64.sys
2010-04-13 17:04:04 236544 —-a-w- c:\windows\system32\TKTool64.dll
2010-04-13 17:04:04 19456 —-a-w- c:\windows\system32\TKTool2k.sys
2010-04-12 08:14:58 13844 —-a-w- c:\users\marily~1\appdata\roaming\wklnhst.dat
2010-03-22 20:39:32 454656 —-a-w- c:\windows\system32\nspavxml.dll
2010-03-22 20:37:20 93792 —-a-w- c:\windows\system32\TKFsAc2k64.sys
2010-03-22 20:37:20 87776 —-a-w- c:\windows\system32\TKFsAc2k.sys
2010-03-22 20:37:20 318048 —-a-w- c:\windows\system32\TKFsAv.dll
2010-03-22 20:37:20 219744 —-a-w- c:\windows\system32\TKFsAv64.dll
2010-03-22 20:37:20 162700 —-a-w- c:\windows\system32\TKFsAcNt4.sys
2010-03-09 16:25:21 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-03-09 15:42:17 834048 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 17:16:06 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-20 23:06:41 24064 —-a-w- c:\windows\system32\nshhttp.dll
2010-02-20 23:05:14 30720 —-a-w- c:\windows\system32\httpapi.dll
2010-01-27 04:43:38 51200 —-a-w- c:\windows\inf\infpub.dat
2010-01-27 04:43:38 143360 —-a-w- c:\windows\inf\infstrng.dat
2009-10-30 05:23:49 665600 —-a-w- c:\windows\inf\drvindex.dat
2009-10-30 05:23:48 86016 —-a-w- c:\windows\inf\infstor.dat
2009-03-07 12:47:43 37390 —-a-w- c:\windows\inf\perflib\040c\perfd.dat
2009-03-07 12:47:43 37390 —-a-w- c:\windows\inf\perflib\040c\perfc.dat
2009-03-07 12:47:43 340236 —-a-w- c:\windows\inf\perflib\040c\perfi.dat
2009-03-07 12:47:43 340236 —-a-w- c:\windows\inf\perflib\040c\perfh.dat
2008-01-21 02:43:21 174 –sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-12-30 00:05:54 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\cookies\index.dat
2009-12-30 00:05:54 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\history\history.ie5\index.dat
2009-12-30 00:05:54 32768 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\temporary internet files\content.ie5\index.dat
2009-03-07 13:06:03 8192 –sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 22:46:41.56 ===============




GMER.txt


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-30 18:03:14
Windows 6.0.6002 Service Pack 2
Running: broxrisu.exe; Driver: C:\Users\MARILY~1\AppData\Local\Temp\agdcafoc.sys


—- System - GMER 1.0.15 —-

SSDT \??\C:\Windows\system32\TKFsFt2k.sys ZwTerminateProcess [0xB0E39BE0]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!KeSetEvent + 621 820C6D84 4 Bytes [E0, 9B, E3, B0] {LOOPNZ 0xffffffffffffff9d; JECXZ 0xffffffffffffffb4}
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x9F80B000, 0x23100A, 0xE8000020]
.text C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl section is writeable [0xB0E06000, 0x2892, 0xE8000020]
.vmp2 C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl entry point in ".vmp2" section [0xB0E29050]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Internet Explorer\iexplore.exe[5740] USER32.dll!DialogBoxParamW 766210B0 5 Bytes JMP 6D9FBF9F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] USER32.dll!DialogBoxIndirectParamW 76622EF5 5 Bytes JMP 6DB3B45A C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] USER32.dll!DialogBoxParamA 76638152 5 Bytes JMP 6DB3B41F C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] USER32.dll!DialogBoxIndirectParamA 7663847D 5 Bytes JMP 6DB3B495 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] USER32.dll!MessageBoxIndirectA 7664D4D9 5 Bytes JMP 6DB3B3DB C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] USER32.dll!MessageBoxIndirectW 7664D5D3 5 Bytes JMP 6DB3B397 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] USER32.dll!MessageBoxExA 7664D639 5 Bytes JMP 6DB3B35D C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] USER32.dll!MessageBoxExW 7664D65D 5 Bytes JMP 6DB3B323 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] SHELL32.dll!SHRestricted + D95 76768988 4 Bytes [99, 0B, D0, 72]
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] SHELL32.dll!SHRestricted + D9D 76768990 8 Bytes [A7, 0A, D0, 72, A4, 32, CF, …]
.text C:\Program Files\Internet Explorer\iexplore.exe[5740] ole32.dll!OleLoadFromStream 77331E12 5 Bytes JMP 6DB3B657 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs TKFsFt2k.sys
AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002186b8a8bc
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\002186b8a8bc (not active ControlSet)

—- EOF - GMER 1.0.15 —-






– Thanks again!

Attachments:

Post #2
Hello and :welcome:

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not install/uninstall anything on your computer unless advised.
  • Do not run any other scanning tools other than those instructed for you to use.
  • Follow the instructions on the order they are given.
  • Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
  • If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
  • If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 48 hours then the topic will be closed.
  • And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________



You will need to right click and choose "Run as Administrator" to run the tools we will use.



Are you still using AVG and Norton?
Running more than one anti virus at the same time does not only slow down your computer but provides less protection than they are programmed to do, due to the fact that they will be conflicting with each other rather than providing sufficient protection for your computer. Please uninstall one of your anti virus before proceeding with any of the fixes.

–Next–

You have BitTorrent, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

P2P (File Sharing ) programs form a direct conduit onto your computer, their security measures are easily circumvented, and Malware writers are increasingly exploiting them to spread their wares onto your computer. Further to that, if your P2P program is not configured correctly you may be sharing more files than you realize. There have been cases where people's Passwords, Address Books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

Many of the programs come bundled with other unwanted programs, but even the ones free of any bundled software are not safe to use.

This article from InfoWorld illustrates the dangers of a poorly configured P2P program.
http://www.infoworld.com/d/security-centra…-p-id-theft-103

When you use them you are downloading software from an unknown source directly onto your computer, bypassing your Firewall and Anti-Virus software. Hardly surprising then that many of these Downloads are being targeted to carry infections.

I would recommend that you uninstall BitTorrent, via Control Panel -> Add or Remove Programs.

However, if you do not wish to remove this program please be advised not to use the said program during the course of cleaning your machine.

References for the risk of these programs can be found in these links:
http://www.esecurityguy.com/p2p_file_sharing
http://www.microsoft.com/protect/data/down…ilesharing.aspx

–Next–

Please go to VirSCAN
  • Click on Browse.
  • On the File Upload window, copy/paste the text below into the File name box:
    c:\windows\uninst.exe
  • Click Upload. Allow the file to be scanned. If it says already scanned – click Reanalyze Now
Repeat the procedure with the following file:
c:\windows\system32\nspavxml.dll

Please post the results in your next reply.

To post in your next reply:
1. Regarding AVG and Norton.
2. VirSCAN log.
Post #3
Hi, thanks for your reply!

I actually have Bittorrent uninstalled, and I believe I'm only using AVG, not Norton.

Here is my log for the c:\windows\uninst.exe:

VirSCAN.org Scanned Report :
Scanned time : 2009/06/15 01:34:08 (PDT)
Scanner results: Scanners did not find malware!
File Name : uninst.exe
File Size : 289280 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 15de2e3601b4e221eecfa3f083c1a30d
SHA1 : ff6778bffeecb1d43f486cc4e999832a2f4921c4
Online report : http://virscan.org/report/9302a925e92b30cc…f4c23c9561.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.1 20090614213204 2009-06-14 40.13 -
AhnLab V3 2009.06.15.00 2009.06.15 2009-06-15 0.81 -
AntiVir 8.2.0.187 7.1.4.91 2009-06-15 0.25 -
Antiy 2.0.18 20090615.2540363 2009-06-15 0.12 -
Arcavir 2009 200906141032 2009-06-14 0.07 -
Authentium 5.1.1 200906141749 2009-06-14 1.40 -
AVAST! 4.7.4 090614-0 2009-06-14 0.02 -
AVG 8.5.286 270.12.69/2176 2009-06-15 3.42 -
BitDefender 7.81008.3348627 7.25991 2009-06-15 3.01 -
CA (VET) 9.0.0.143 31.6.6555 2009-06-13 6.81 -
ClamAV 0.95.1 9465 2009-06-14 0.05 -
Comodo 3.9 1333 2009-06-15 0.71 -
CP Secure 1.1.0.715 2009.06.15 2009-06-15 10.10 -
Dr.Web 4.44.0.9170 2009.06.15 2009-06-15 4.78 -
F-Prot 4.4.4.56 20090614 2009-06-14 1.40 -
F-Secure 5.51.6100 2009.06.15.03 2009-06-15 0.09 -
Fortinet 2.81-3.117 10.499 2009-06-14 0.27 -
GData 19.5844/19.364 20090615 2009-06-15 4.47 -
ViRobot 20090613 2009.06.13 2009-06-13 0.48 -
Ikarus T3.1.01.59 2009.06.15.72868 2009-06-15 3.44 -
JiangMin 11.0.706 2009.06.15 2009-06-15 2.09 -
Kaspersky 5.5.10 2009.06.15 2009-06-15 0.09 -
KingSoft 2009.2.5.15 2009.6.15.14 2009-06-15 0.59 -
McAfee 5.3.00 5646 2009-06-14 3.10 -
Microsoft 1.4701 2009.06.15 2009-06-15 4.34 -
mks_vir 2.01 2009.06.15 2009-06-15 3.38 -
Norman 6.01.09 6.01.00 2009-06-12 4.02 -
Panda 9.05.01 2009.06.14 2009-06-14 2.02 -
Trend Micro 8.700-1004 6.194.02 2009-06-14 0.03 -
Quick Heal 10.00 2009.06.15 2009-06-15 1.26 -
Rising 20.0 21.34.01.00 2009-06-15 0.83 -
Sophos 2.87.1 4.42 2009-06-15 2.48 -
Sunbelt 5187 5187 2009-06-13 1.01 -
Symantec 1.3.0.24 20090614.004 2009-06-14 0.05 -
nProtect 20090614.01 4249058 2009-06-14 5.56 -
The Hacker 6.3.4.3 v00345 2009-06-12 0.69 -
VBA32 3.12.10.7 20090614.1156 2009-06-14 2.11 -
VirusBuster 4.5.11.10 10.107.13/1629186 2009-06-14 2.50 -



And here is my scan result for c:\windows\system32\nspavxml.dll:

VirSCAN.org Scanned Report :
Scanned time : 2010/05/02 19:33:53 (PDT)
Scanner results: Scanners did not find malware!
File Name : nspavxml.dll
File Size : 454656 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : bd18a9cf77be06cb48a4a7f012814805
SHA1 : b3d608b36b8cac1750e93503bb74dd0f4ea3049d
Online report : http://virscan.org/report/3d16473e0b498655…10de4b80de.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20100501070118 2010-05-01 4.97 -
AhnLab V3 2010.04.30.02 2010.04.30 2010-04-30 1.18 -
AntiVir 8.2.1.224 7.10.7.17 2010-05-02 0.26 -
Antiy 2.0.18 20100429.4301541 2010-04-29 0.12 -
Arcavir 2009 201005020249 2010-05-02 0.09 -
Authentium 5.1.1 201005021844 2010-05-02 2.27 -
AVAST! 4.7.4 100502-1 2010-05-02 0.03 -
AVG 8.5.793 271.1.1/2850 2010-05-03 0.25 -
BitDefender 7.81008.5692927 7.31485 2010-05-03 3.75 -
ClamAV 0.95.3 10890 2010-05-02 0.10 -
Comodo 3.13.579 4738 2010-05-02 0.98 -
CP Secure 1.3.0.5 2010.05.03 2010-05-03 0.10 -
Dr.Web 5.0.2.3300 2010.05.03 2010-05-03 6.95 -
F-Prot 4.4.4.56 20100502 2010-05-02 2.48 -
F-Secure 7.02.73807 2010.05.02.06 2010-05-02 0.23 -
Fortinet 4.0.14 11.764 2010-05-01 0.22 -
GData 21.72/21.24 20100502 2010-05-02 6.72 -
ViRobot 20100501 2010.05.01 2010-05-01 0.41 -
Ikarus T3.1.01.80 2010.05.03.75766 2010-05-03 5.97 -
JiangMin 13.0.900 2010.05.02 2010-05-02 1.20 -
Kaspersky 5.5.10 2010.05.02 2010-05-02 0.13 -
KingSoft 2009.2.5.15 2010.5.2.16 2010-05-02 0.65 -
McAfee 5400.1158 5970 2010-05-02 0.02 -
Microsoft 1.5703 2010.05.01 2010-05-01 6.63 -
Norman 6.04.12 6.04.00 2010-05-01 4.01 -
Panda 9.05.01 2010.05.01 2010-05-01 2.42 -
Trend Micro 9.120-1004 7.142.09 2010-05-02 0.03 -
Quick Heal 10.00 2010.05.01 2010-05-01 1.66 -
Rising 20.0 22.45.04.03 2010-04-30 1.19 -
Sophos 3.06.0 4.52 2010-05-03 3.63 -
Sunbelt 3.9.2418.2 6248 2010-05-01 5.66 -
Symantec 1.3.0.24 20100502.005 2010-05-02 0.06 -
nProtect 20100501.01 8055427 2010-05-01 7.87 -
The Hacker 6.5.2.0 v00275 2010-05-01 0.43 -
VBA32 3.12.12.4 20100429.2024 2010-04-29 3.33 -
VirusBuster 4.5.11.10 10.126.11/2000534 2010-05-02 2.58 -


Thank you so much for your time!
Post #4
Hello MarilynM

inzanity has been called away for work so I'll see if I can help.



DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.



Please do not delete anything unless instructed to.


We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • [external image: Posted Image]
  • Then click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.


Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste". .
Post #5
Hi, thanks for your help! Here is my Malwarebytes Log: Malwarebytes' Anti-Malware 1.44 Database version: 3886 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 05/05/2010 4:45:02 PM mbam-log-2010-05-05 (16-45-02).txt Scan type: Quick Scan Objects scanned: 113182 Time elapsed: 9 minute(s), 16 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) By the way, I was wondering whether or not i should disable back the hidden and protected system files. Thanks again!
Post #6

By the way, I was wondering whether or not i should disable back the hidden and protected system files.

My all clear post will do that so wait until then.

That didn't show anything bad so lets dig deeper.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

    Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.
Post #7
Hi, thank you again for your reply.

Recently, I've had no cases of multiple IE's popping up.

Here is my ComboFix log:

ComboFix 10-05-05.04 - Marilyn Mach 05/05/2010 18:28:39.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.2813.1380 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: nProtect GameGuard Personal 2007 *On-access scanning enabled* (Updated) {7D36BE97-9969-4C9F-9DC1-282DB4E1FBEA}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1107710701-57340027-2756372459-500
c:\$recycle.bin\S-1-5-21-1328532141-2926075511-2386723770-500
c:\users\Marilyn Mach\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk

.
((((((((((((((((((((((((( Files Created from 2010-04-06 to 2010-05-06 )))))))))))))))))))))))))))))))
.

2010-05-06 01:39 . 2010-05-06 01:39 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-04-30 05:40 . 2010-04-30 05:40 ——– d—–w- c:\program files\ERUNT
2010-04-23 05:01 . 2001-05-04 12:05 505104 —-a-w- c:\windows\system32\msxml.dll
2010-04-23 05:01 . 2002-06-17 08:25 26088 —-a-w- c:\windows\system32\xmlinst.exe
2010-04-23 05:01 . 2002-01-07 17:30 24576 —-a-w- c:\windows\system32\msxml3a.dll
2010-04-23 05:01 . 2001-05-04 12:05 28432 —-a-w- c:\windows\system32\msxmlr.dll
2010-04-23 05:01 . 2000-03-17 09:21 36864 —-a-w- c:\windows\system32\xmlparse.dll
2010-04-23 05:01 . 2000-03-17 09:21 69632 —-a-w- c:\windows\system32\xmltok.dll
2010-04-23 05:01 . 1998-06-18 01:00 89360 —-a-w- c:\windows\system32\VB5DB.DLL
2010-04-23 05:01 . 2010-04-23 05:01 ——– d—–w- c:\program files\directx
2010-04-22 22:08 . 2010-05-03 02:27 ——– d—–w- c:\users\Marilyn Mach\AppData\Roaming\BitTorrent
2010-04-22 05:31 . 2010-04-22 05:31 ——– d—–w- c:\users\Marilyn Mach\AppData\Local\DOSBox
2010-04-22 05:08 . 2010-04-22 23:39 297 —-a-w- c:\windows\EReg077.dat
2010-04-22 05:07 . 1997-09-23 15:02 289280 —-a-w- c:\windows\uninst.exe
2010-04-22 04:57 . 2010-04-22 04:57 ——– d—–w- C:\$AVG
2010-04-20 02:19 . 2007-10-23 16:27 110592 —-a-w- c:\users\Marilyn Mach\AppData\Roaming\U3\temp\cleanup.exe
2010-04-16 19:39 . 2010-04-16 19:39 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-04-16 19:39 . 2010-04-21 22:08 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-16 19:39 . 2010-04-16 19:39 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-04-16 19:39 . 2010-05-05 21:45 ——– d—–w- c:\windows\system32\drivers\Avg
2010-04-16 19:39 . 2010-04-16 19:39 29512 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-04-15 00:53 . 2010-02-18 14:07 3600776 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-15 00:53 . 2010-02-18 14:07 3548040 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-04-15 00:53 . 2010-02-23 11:10 212992 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-15 00:53 . 2010-02-23 11:10 79360 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-15 00:53 . 2010-02-23 11:10 106496 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-15 00:52 . 2010-03-04 17:33 430080 —-a-w- c:\windows\system32\vbscript.dll
2010-04-15 00:50 . 2010-02-18 14:07 904576 —-a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-15 00:49 . 2010-02-18 13:30 200704 —-a-w- c:\windows\system32\iphlpsvc.dll
2010-04-15 00:49 . 2010-02-18 11:28 25088 —-a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-13 21:20 . 2009-12-23 11:33 172032 —-a-w- c:\windows\system32\wintrust.dll
2010-04-13 21:20 . 2010-01-13 17:34 98304 —-a-w- c:\windows\system32\cabview.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-04 06:52 . 2009-03-07 12:48 672380 —-a-w- c:\windows\system32\perfh00C.dat
2010-05-04 06:52 . 2009-03-07 12:48 132080 —-a-w- c:\windows\system32\perfc00C.dat
2010-05-03 03:56 . 2009-04-07 05:18 ——– d—–w- c:\users\Marilyn Mach\AppData\Roaming\FrostWire
2010-04-28 01:50 . 2009-03-07 11:35 12 —-a-w- c:\windows\bthservsdp.dat
2010-04-24 07:12 . 2009-04-03 19:10 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-04-22 04:25 . 2009-04-08 01:38 220926964 —-a-w- c:\users\Marilyn Mach\AppData\Roaming\ijjigame\U_GUNZ_setup.exe
2010-04-20 02:19 . 2010-01-07 06:04 ——– d—–w- c:\users\Marilyn Mach\AppData\Roaming\U3
2010-04-16 19:47 . 2009-03-07 12:10 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-04-16 01:49 . 2010-03-09 04:21 1335048 —-a-w- c:\windows\Help\OEM\scripts\SamsungHDDFW1HC.exe
2010-04-15 18:10 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-04-13 17:04 . 2009-05-16 05:50 69382 —-a-w- c:\windows\system32\TKFsAvNt4.sys
2010-04-13 17:04 . 2009-05-16 05:50 65632 —-a-w- c:\windows\system32\TKFsAv2k64.sys
2010-04-13 17:04 . 2009-05-16 05:50 55776 —-a-w- c:\windows\system32\TKFsAv2k.sys
2010-04-13 17:04 . 2009-05-16 05:50 41476 —-a-w- c:\windows\system32\TKToolNt4.sys
2010-04-13 17:04 . 2009-05-16 05:50 27232 —-a-w- c:\windows\system32\TKTool2k64.sys
2010-04-13 17:04 . 2009-05-16 05:50 236544 —-a-w- c:\windows\system32\TKTool64.dll
2010-04-13 17:04 . 2009-05-16 05:50 19456 —-a-w- c:\windows\system32\TKTool2k.sys
2010-04-13 17:04 . 2009-05-16 05:49 82016 —-a-w- c:\windows\system32\TKFsFt2k.sys
2010-04-13 17:04 . 2009-05-16 05:49 81002 —-a-w- c:\windows\system32\TKFsFtNt4.sys
2010-04-13 17:04 . 2009-05-16 05:49 63584 —-a-w- c:\windows\system32\TKFsFt2k64.sys
2010-04-12 08:14 . 2009-04-07 23:41 13844 —-a-w- c:\users\Marilyn Mach\AppData\Roaming\wklnhst.dat
2010-04-08 23:48 . 2010-04-27 03:59 18184 —-a-w- c:\windows\Help\OEM\scripts\HPHC_BUY_BATTERY.exe
2010-04-08 23:48 . 2010-03-23 03:27 17160 —-a-w- c:\windows\Help\OEM\scripts\HPHCDisableObject.exe
2010-04-07 00:52 . 2010-04-27 03:59 18184 —-a-w- c:\windows\Help\OEM\scripts\HC_Launch.exe
2010-04-04 06:37 . 2010-04-04 06:37 ——– d—–w- c:\program files\AoA Audio Extractor
2010-04-02 07:17 . 2010-04-02 07:17 ——– d—–w- c:\program files\AVG
2010-03-30 07:33 . 2009-04-03 05:56 122960 —-a-w- c:\users\Marilyn Mach\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-30 05:12 . 2006-11-02 12:37 ——– d—–w- c:\program files\MSBuild
2010-03-30 05:10 . 2010-03-30 05:10 ——– d—–w- c:\program files\Microsoft.NET
2010-03-30 05:07 . 2010-03-30 05:07 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2010-03-28 23:21 . 2010-03-17 06:40 ——– d—–w- c:\program files\RealArcade
2010-03-28 23:14 . 2010-03-28 23:14 ——– d—–w- c:\program files\Crawler
2010-03-22 20:39 . 2009-05-16 05:50 454656 —-a-w- c:\windows\system32\nspavxml.dll
2010-03-22 20:37 . 2009-05-16 05:50 318048 —-a-w- c:\windows\system32\TKFsAv.dll
2010-03-22 20:37 . 2009-05-16 05:50 219744 —-a-w- c:\windows\system32\TKFsAv64.dll
2010-03-22 20:37 . 2009-05-16 05:49 93792 —-a-w- c:\windows\system32\TKFsAc2k64.sys
2010-03-22 20:37 . 2009-05-16 05:49 87776 —-a-w- c:\windows\system32\TKFsAc2k.sys
2010-03-22 20:37 . 2009-05-16 05:49 162700 —-a-w- c:\windows\system32\TKFsAcNt4.sys
2010-03-21 21:19 . 2010-03-21 21:18 ——– d—–w- c:\program files\DivX
2010-03-21 21:18 . 2010-03-21 21:18 ——– d—–w- c:\program files\Common Files\DivX Shared
2010-03-20 02:18 . 2010-03-20 02:18 ——– d—–w- c:\users\Marilyn Mach\AppData\Roaming\Malwarebytes
2010-03-20 02:18 . 2010-03-20 02:18 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-18 21:43 . 2010-03-18 21:43 118784 —-a-w- c:\users\Marilyn Mach\AppData\Roaming\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-03-18 05:18 . 2009-10-16 07:09 ——– d—–w- c:\users\Marilyn Mach\AppData\Roaming\GetRightToGo
2010-03-18 01:12 . 2010-03-18 01:12 439816 —-a-w- c:\users\Marilyn Mach\AppData\Roaming\Real\Update\setup3.10\setup.exe
2010-03-17 06:42 . 2010-03-17 06:42 ——– d—–w- c:\users\Marilyn Mach\AppData\Roaming\PlayFirst
2010-03-16 05:20 . 2009-08-08 02:10 ——– d—–w- c:\users\Marilyn Mach\AppData\Roaming\NewSoft
2010-03-09 16:25 . 2010-03-30 20:18 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-03-09 15:42 . 2010-03-30 20:18 834048 —-a-w- c:\windows\system32\wininet.dll
2010-03-01 04:35 . 2009-11-24 22:46 439816 —-a-w- c:\users\Marilyn Mach\AppData\Roaming\Real\Update\setup3.09\setup.exe
2010-02-24 17:16 . 2009-10-02 16:28 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-20 23:06 . 2010-03-11 08:40 24064 —-a-w- c:\windows\system32\nshhttp.dll
2010-02-20 23:05 . 2010-03-11 08:40 30720 —-a-w- c:\windows\system32\httpapi.dll
2010-02-20 20:53 . 2010-03-11 08:40 411648 —-a-w- c:\windows\system32\drivers\http.sys
2010-02-05 01:51 . 2010-03-09 04:21 49152 —-a-w- c:\windows\Help\OEM\scripts\Interop.TaskScheduler.dll
2009-03-07 13:06 . 2009-03-07 12:50 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-27 3883856]
"CrawlerNotes"="c:\progra~1\crawler\notes\cnotes.exe" [2010-03-11 944640]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-30 61440]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2008-03-31 217088]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-11-29 1148200]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-12-25 1316136]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-12-25 189736]
"TVAgent"="c:\program files\Hewlett-Packard\Media\TV\TVAgent.exe" [2009-01-21 210216]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2008-11-19 914224]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-11-26 210216]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-10-10 206128]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-10-30 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-02 148888]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-12-08 432432]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312]
"UCam_Menu"="c:\program files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2008-11-15 218408]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-13 198160]
"nProtect Security Platform 2007"="c:\program files\INCAInternet\nProtect Security Platform 2007\nspmain.exe" [2009-10-09 932384]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-10-15 446556]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(B):8b,2c,6b,be,d6,17,ca,01

R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-07-21 100184]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-03-10 3601608]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2010-04-16 216200]
S1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2010-04-21 242896]
S2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/03/14 02:35];c:\program files\Hewlett-Packard\Media\DVD\000.fcl [2008-11-29 01:04 87536]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_e7ea6efc\aestsrv.exe [2008-10-15 77824]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-04-16 308064]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-03-18 19456]
S2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [2009-03-07 115560]
S2 NSPService;nProtect Security Platform 2007 Service;c:\windows\system32\INCAinternet\nProtect Security Platform 2007\nspsvc.exe [2009-10-09 354848]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-12-03 365952]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TVCapSvc;TV Background Capture Service (TVBCS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [2008-11-27 296320]
S2 TVSched;TV Task Scheduler (TVTS);c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [2008-11-27 116096]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-11-19 222512]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-01-24 52736]
S3 NSPUpdateService;nProtect Security Platform 2007 Update Service;c:\windows\System32\INCAInternet\nProtect Security Platform 2007\nspupsvc.exe [2009-10-21 813600]
S3 TKFsAc;TKFsAc;c:\windows\system32\TKFsAc2k.sys [2010-03-22 87776]
S3 TKFsAv;TKFsAv;c:\windows\system32\TKFsAv2k.sys [2010-04-13 55776]
S3 TKFsFt;TKFsFt;c:\windows\system32\TKFsFt2k.sys [2010-04-13 82016]
S3 TKRgAc;TKRgAc;c:\windows\system32\TKRgAc2k.sys [2009-05-14 41984]
S3 TKRgFt;TKRgFt;c:\windows\system32\TKRgFtXp.sys [2009-05-28 24704]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2008-05-29 22072]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-05-04 c:\windows\Tasks\HPCeeScheduleForMarilyn Mach.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2009-03-07 19:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_ca&c;=91&bd;=Pavilion&pf;=cnnb
uInternet Settings,ProxyOverride = *.local
IE: &AIM; Toolbar Search
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
FF - ProfilePath - c:\users\Marilyn Mach\AppData\Roaming\Mozilla\Firefox\Profiles\ci5f330q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrie7&query;=
FF - prefs.js: browser.search.selectedEngine - AIM Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrab&query;=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-Aim6 - (no file)
HKCU-Run-BitTorrent DNA - c:\users\Marilyn Mach\Program Files\DNA\btdna.exe
AddRemove-NIS - c:\program files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\16.0.0.125\InstStub.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-05 18:40
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-05-05 18:45:23
ComboFix-quarantined-files.txt 2010-05-06 01:45

Pre-Run: 151,186,792,448 bytes free
Post-Run: 151,276,457,984 bytes free

- - End Of File - - 92D560FAF16E3BB883AEB2EAC1A9CA7B



Thank you so much for your time. I really appreciate it :)
Post #8
Please go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:

c:\windows\system32\TKFsAv2k64.sys


Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


If virscan.org is too busy you can try these.

http://virscan.org/

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html
Post #9
Hi there,

Here is my log:

VirSCAN.org Scanned Report :
Scanned time : 2010/05/05 19:30:21 (PDT)
Scanner results: Scanners did not find malware!
File Name : TKFsAv2k64.sys
File Size : 65632 byte
File Type : PE32+ executable for MS Windows (native)
MD5 : 916540fdc3635f628c91154e691ad55a
SHA1 : 244581805d69cc2ccefae97dd7d1cf17e9a20be5
Online report : http://virscan.org/report/27aa29d44daedde6…cda6a1bf2d.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20100506053122 2010-05-06 5.31 -
AhnLab V3 2010.05.05.00 2010.05.05 2010-05-05 1.14 -
AntiVir 8.2.1.236 7.10.7.46 2010-05-05 0.26 -
Antiy 2.0.18 20100505.4326784 2010-05-05 0.12 -
Arcavir 2009 201005051803 2010-05-05 0.02 -
Authentium 5.1.1 201005060023 2010-05-06 1.27 -
AVAST! 4.7.4 100505-1 2010-05-05 0.01 -
AVG 8.5.793 271.1.1/2856 2010-05-06 0.23 -
BitDefender 7.81008.5745839 7.31525 2010-05-06 3.68 -
ClamAV 0.95.3 10925 2010-05-05 0.02 -
Comodo 3.13.579 4775 2010-05-05 0.88 -
CP Secure 1.3.0.5 2010.05.05 2010-05-05 0.05 -
Dr.Web 5.0.2.3300 2010.05.06 2010-05-06 7.01 -
F-Prot 4.4.4.56 20100505 2010-05-05 1.39 -
F-Secure 7.02.73807 2010.05.06.01 2010-05-06 0.17 -
Fortinet 4.0.14 11.777 2010-05-05 0.23 -
GData 21.99/21.34 20100505 2010-05-05 6.94 -
ViRobot 20100503 2010.05.03 2010-05-03 0.42 -
Ikarus T3.1.01.84 2010.05.06.75790 2010-05-06 6.15 -
JiangMin 13.0.900 2010.05.05 2010-05-05 1.50 -
Kaspersky 5.5.10 2010.05.05 2010-05-05 0.08 -
KingSoft 2009.2.5.15 2010.5.5.20 2010-05-05 0.72 -
McAfee 5400.1158 5973 2010-05-05 0.02 -
Microsoft 1.5703 2010.05.05 2010-05-05 6.53 -
Norman 6.04.12 6.04.00 2010-05-05 6.01 -
Panda 9.05.01 2010.05.05 2010-05-05 3.19 -
Trend Micro 9.120-1004 7.148.18 2010-05-05 0.03 -
Quick Heal 10.00 2010.05.03 2010-05-03 1.54 -
Rising 20.0 22.46.03.01 2010-05-06 0.25 -
Sophos 3.07.1 4.53 2010-05-06 3.26 -
Sunbelt 3.9.2421.2 6265 2010-05-05 6.01 -
Symantec 1.3.0.24 20100505.004 2010-05-05 0.25 -
nProtect 20100503.01 8108502 2010-05-03 8.50 -
The Hacker 6.5.2.0 v00275 2010-05-03 0.45 -
VBA32 3.12.12.4 20100504.2006 2010-05-04 2.45 -
VirusBuster 4.5.11.10 10.126.16/2005537 2010-05-06 2.33 -


Thank you!
Post #10
Good job :thumbup:

  • Click START Search
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.


If you used DeFogger
You must remember to re-enable your Emulation drivers once we are finished, double click DeFogger to run the tool.

  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.


Here's my usual all clean post

Log looks good :D



  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
    5. Change the Download signed ActiveX controls to Prompt
    6. Change the Download unsigned ActiveX controls to Disable
    7. Change the Initialize and script ActiveX controls not marked as safe to Disable
    8. Change the Installation of desktop items to Prompt
    9. Change the Launching programs and files in an IFRAME to Prompt
    10. Change the Navigate sub-frames across different domains to Prompt
    11. When all these settings have been made, click on the OK button.
    12. If it prompts you as to whether or not you want to save the settings, press the Yes button.

  • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would suggest you read How to Prevent Malware:
Post #11
Hi, Should I disable back the hidden and protected system files? Thank you so much! Glad my computer is not infected ^_^ I shall now read your all clean post.
Post #12 last edited

Should I disable back the hidden and protected system files?

If you run the combofix uninstall it should do that for you.

You can double check it.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
check "Hide file extensions for known file types."
Under the "Hidden files" folder, un-select "Show hidden files and folders."
check "Hide protected operating system files."
Click Apply, and then click OK.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI