You may want to print out these instructions so you have them handy as you follow the steps.
If you encounter any problems or are unclear on any instructions, please stop and let me know.
In order to use the next tool, we need to make sure you have the Recovery Console installed on your computer.
Using your Windows XP CD, please follow the instructions in the following link to install the Recovery Console:
http://www.bleepingcomputer.com/tutorials/tutorial117.html
Download
maxlook , saving the file to your desktop.
Double click maxlook.exe to run it.
Note - you must run it only once!
As instructed when the tool runs, restart the computer and logon to the Recovery Console.
Execute the following bolded command at the
x :\windows> prompt <— the red x represents your operating system drive letter, usually C
batch look.bat
Press Enter
You will see
1 file copied many times then return to the
x :\windows> prompt.
Type
Exit to restart your computer then logon in normal mode.
Once back in Windows, go to Start > Run, and copy/paste the following then press Enter.
maxlook -sig
Follow the prompts, and post (or attach) the log produced, C:\looklog.txt
i don't have my windows xp cd anymore it was lost a long time ago
We will install the Recovery Console another way. Please be sure that you allow it to install as noted in the steps below. It is very important this be installed.
Download and Install Combofix
Download
ComboFix from one of the following locations:
Link 1 Link 2 VERY IMPORTANT !!! Save ComboFix.exe to your
Desktop
*
IMPORTANT -
Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
here
Double click on ComboFix.exe & follow the prompts.
As part of it's process,
ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's
strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: [external image: Posted Image]
Click on Yes , to continue scanning for malware.
When finished, it shall produce a log for you.
Please include the C:\ComboFix.txt in your next reply.
Notes:
Please make sure you include the combo fix log in your next reply.
sorry it took awhile here is the combo fix log. it didn't install a windows recovery console:
ComboFix 10-05-15.03 - Andrew Lawrence 05/16/2010 11:33:01.6.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1007.242 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\wintybrd.jpg
.
((((((((((((((((((((((((( Files Created from 2010-04-16 to 2010-05-16 )))))))))))))))))))))))))))))))
.
2010-05-11 23:38 . 2010-05-11 23:38 63488 —-a-w- c:\documents and settings\Andrew Lawrence\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-05-11 20:07 . 2010-05-13 15:13 ——– d—–w- c:\documents and settings\Andrew Lawrence\Local Settings\Application Data\Yahoo
2010-05-11 20:06 . 2010-05-11 20:06 ——– d—–w- c:\documents and settings\Andrew Lawrence\Local Settings\Application Data\Yahoo!
2010-05-11 20:06 . 2010-05-11 20:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-05-11 20:06 . 2010-05-11 20:07 ——– d—–w- c:\documents and settings\Andrew Lawrence\Application Data\Yahoo!
2010-05-11 20:05 . 2010-04-20 20:45 607472 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2010-05-03 12:24 . 2010-05-09 20:58 439816 —-a-w- c:\documents and settings\Andrew Lawrence\Application Data\Real\Update\setup3.10\setup.exe
2010-04-28 20:06 . 2010-04-28 20:06 ——– d—–w- c:\program files\Atari
2010-04-21 21:20 . 2010-04-21 21:20 57344 —-a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-04-21 21:19 . 2010-04-21 21:14 754984 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll
2010-04-21 21:19 . 2010-04-21 21:14 1180952 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe
2010-04-21 21:19 . 2010-04-21 21:19 56978 —-a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe
2010-04-21 21:19 . 2010-04-21 21:19 56766 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-21 21:19 . 2010-04-21 21:19 53600 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe
2010-04-21 21:19 . 2010-04-21 21:19 57679 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Player\Uninstaller.exe
2010-04-21 21:19 . 2010-04-21 21:19 84040 —-a-w- c:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe
2010-04-21 21:19 . 2010-04-21 21:19 57054 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-21 21:19 . 2010-04-21 21:19 54166 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DSAVCDecoder\Uninstaller.exe
2010-04-21 21:19 . 2010-04-21 21:19 57532 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DSASPDecoder\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 56458 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 54174 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DSAACDecoder\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 54153 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 54128 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Converter\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 54629 —-a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 57409 —-a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 54101 —-a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 52963 —-a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 54073 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe
2010-04-21 21:18 . 2010-04-21 21:18 ——– d—–w- c:\program files\Common Files\DivX Shared
2010-04-21 21:18 . 2010-04-21 21:18 56969 —-a-w- c:\documents and settings\All Users\Application Data\DivX\ASPEncoder\Uninstaller.exe
2010-04-21 21:14 . 2010-04-21 21:14 144696 —-a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-04-21 21:14 . 2010-04-21 21:19 ——– d—–w- c:\documents and settings\All Users\Application Data\DivX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-29 19:53 . 2008-01-01 00:18 ——– d—–w- c:\documents and settings\Andrew Lawrence\Application Data\DivX
2010-05-29 16:27 . 2009-11-27 17:00 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-15 21:19 . 2008-05-29 00:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-05-12 20:20 . 2010-03-24 16:51 52289493 —-a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-05-12 07:01 . 2008-11-07 04:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-05-11 23:38 . 2010-03-23 03:17 117760 —-a-w- c:\documents and settings\Andrew Lawrence\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-11 20:06 . 2007-12-05 18:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-05-11 20:06 . 2007-12-05 18:40 ——– d—–w- c:\program files\Yahoo!
2010-05-04 23:25 . 2007-12-05 05:39 ——– d—–w- c:\program files\Opera
2010-05-04 03:06 . 2009-07-09 00:25 ——– d—–w- c:\documents and settings\Andrew Lawrence\Application Data\Any Video Converter
2010-05-01 23:23 . 2010-03-23 03:16 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-04-28 20:06 . 2008-05-29 00:44 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-04-28 19:40 . 2007-12-05 18:36 ——– d—–w- c:\documents and settings\Andrew Lawrence\Application Data\uTorrent
2010-04-28 14:02 . 2008-07-18 02:06 ——– d—–w- c:\program files\uTorrent
2010-04-21 21:19 . 2008-01-01 00:10 ——– d—–w- c:\program files\DivX
2010-04-09 14:34 . 2010-03-23 02:50 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-04-06 20:06 . 2008-05-04 22:22 ——– d—–w- c:\program files\PrintMaster 16
2010-03-31 01:58 . 2008-01-01 00:10 9200 ——w- c:\windows\system32\drivers\cdralw2k.sys
2010-03-31 01:58 . 2008-01-01 00:10 9072 ——w- c:\windows\system32\drivers\cdr4_xp.sys
2010-03-31 01:58 . 2008-01-01 00:10 44944 ——w- c:\windows\system32\drivers\PxHelp20.sys
2010-03-31 01:58 . 2008-01-01 00:10 133616 ——w- c:\windows\system32\pxafs.dll
2010-03-31 01:58 . 2008-01-01 00:10 125424 ——w- c:\windows\system32\pxinsi64.exe
2010-03-31 01:58 . 2008-01-01 00:10 123888 ——w- c:\windows\system32\pxcpyi64.exe
2010-03-30 04:46 . 2010-03-25 02:01 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 04:45 . 2010-03-25 02:01 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-30 04:16 . 2009-02-02 05:42 3467776 —-a-w- c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2010-03-30 04:16 . 2009-02-02 05:35 2285056 —-a-w- c:\windows\system32\TUKernel.exe
2010-03-25 00:53 . 2008-06-02 03:03 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-03-25 00:47 . 2008-08-17 02:17 ——– d—–w- c:\documents and settings\Andrew Lawrence\Application Data\AVGTOOLBAR
2010-03-24 15:59 . 2007-12-05 05:08 134968 —-a-w- c:\documents and settings\Andrew Lawrence\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-24 15:54 . 2009-04-18 03:16 ——– d—–w- c:\program files\Microsoft Works
2010-03-24 15:30 . 2010-03-24 15:30 ——– d—–w- c:\program files\MSBuild
2010-03-24 15:30 . 2010-03-24 15:30 ——– d—–w- c:\program files\Reference Assemblies
2010-03-24 00:40 . 2010-03-24 00:40 ——– d—–w- c:\program files\Trend Micro
2010-03-23 03:17 . 2010-03-23 03:17 52224 —-a-w- c:\documents and settings\Andrew Lawrence\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-03-23 03:16 . 2010-03-23 03:16 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-23 03:16 . 2010-03-23 03:16 ——– d—–w- c:\documents and settings\Andrew Lawrence\Application Data\SUPERAntiSpyware.com
2010-03-23 03:15 . 2010-03-23 02:12 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-03-23 03:12 . 2010-03-23 03:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Agnitum
2010-03-23 02:51 . 2010-03-23 02:51 ——– d—–w- c:\documents and settings\All Users\Application Data\MailFrontier
2010-03-23 02:49 . 2010-03-23 02:49 ——– d—–w- c:\program files\Zone Labs
2010-03-23 02:34 . 2010-03-23 02:32 ——– d—–w- c:\program files\TuneUp Utilities 2010
2010-03-23 02:32 . 2007-12-05 18:54 ——– d—–w- c:\documents and settings\All Users\Application Data\TuneUp Software
2010-03-23 02:31 . 2010-03-23 02:31 ——– d-sh–w- c:\documents and settings\All Users\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-03-23 02:13 . 2010-03-23 02:12 ——– d—–w- c:\program files\TuneUp Utilities 2007
2010-03-23 02:06 . 2010-03-23 02:05 ——– d—–w- c:\program files\Lavasoft
2010-03-23 02:06 . 2010-03-23 02:06 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-23 02:05 . 2008-12-19 04:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-03-22 21:07 . 2010-01-02 03:36 7631232 —-a-w- c:\documents and settings\Andrew Lawrence\Application Data\MySpace\IM\Install\MSIMClientSetup.1.0.823.0-static-A.exe
2010-03-18 14:50 . 2008-06-18 14:46 ——– d—–w- c:\program files\Verizon
2010-03-18 14:49 . 2009-03-01 04:37 ——– d—–w- c:\program files\Common Files\Motive
2010-03-09 11:09 . 2004-08-04 12:00 430080 —-a-w- c:\windows\system32\vbscript.dll
2010-03-08 17:59 . 2010-03-08 17:59 94208 —-a-w- c:\windows\system32\dpl100.dll
2010-02-26 05:43 . 2004-08-04 12:00 667136 —-a-w- c:\windows\system32\wininet.dll
2010-02-26 05:43 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2010-02-25 15:03 . 2010-03-23 02:33 30536 —-a-w- c:\windows\system32\TURegOpt.exe
2010-02-25 14:56 . 2010-03-23 02:12 30024 —-a-w- c:\windows\system32\uxtuneup.dll
2010-02-24 13:11 . 2004-08-04 12:00 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-19 19:27 . 2010-02-19 19:27 720384 —-a-w- c:\windows\system32\DivX.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 —-a-w- c:\windows\system32\divx_xx0c.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 —-a-w- c:\windows\system32\divx_xx07.dll
2010-02-19 19:27 . 2010-02-19 19:27 847872 —-a-w- c:\windows\system32\divx_xx0a.dll
2010-02-19 19:27 . 2010-02-19 19:27 843776 —-a-w- c:\windows\system32\divx_xx16.dll
2010-02-19 19:27 . 2010-02-19 19:27 839680 —-a-w- c:\windows\system32\divx_xx11.dll
2010-02-16 14:08 . 2004-08-04 12:00 2146304 ——w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2004-08-03 22:59 2024448 ——w- c:\windows\system32\ntkrnlpa.exe
2007-07-15 03:26 . 2008-07-18 03:58 53248 —-a-w- c:\program files\Armaccess.dll
2007-07-15 03:26 . 2008-07-18 03:58 1630208 —-a-w- c:\program files\FP3D.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-05-01 2020592]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-04-29 5248312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DevconDefaultDB"="c:\windows\READREG" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-05 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-05 77824]
"AsioReg"="CTASIO.DLL" [2003-11-13 126976]
"CTHelper"="CTHELPER.EXE" [2004-03-11 28672]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2007-08-07 200704]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-12-31 185632]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SmartSoft PDF Printer (demo) Agent"="c:\program files\Smart PDF Converter\sspdfagentd.exe" [2007-10-22 94208]
"SmartSoft PDF Printer (demo) virtual printer agent"="c:\program files\Smart PDF Converter\sspdfagentd.exe" [2007-10-22 94208]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\PrintMaster 16\pmremind.exe [2004-1-20 339968]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 18:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-12 03:12 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-17 05:26 49152 —-a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHider]
2008-07-14 14:56 1048576 —-a-w- c:\program files\IP Hider\IP Hider.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-15 18:11 267048 —-a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
2008-12-12 18:46 9555968 —-a-w- c:\program files\MySpace\IM\MySpaceIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 20:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VerizonServicepoint.exe]
2008-02-13 17:03 2065648 —-a-w- c:\program files\Verizon\VSP\VerizonServicepoint.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Aim6"="c:\program files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
"SetDefaultMIDI"=MIDIDef.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"88fb7389"=rundll32.exe "c:\windows\system32\huyerifi.dll",b
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\IP Hider\\IP Hider.exe"=
"c:\\WINDOWS\\system32\\LVCOMSX.EXE"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
R0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\system32\drivers\Achernar.sys [12/24/2008 10:10 PM 18432]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [1/5/2010 7:56 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 61440]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [4/5/2009 7:43 PM 108289]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2/25/2010 10:59 AM 1047880]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2/25/2010 10:18 AM 10064]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/21/2009 5:24 PM 135664]
S3 Aldebaran;Aldebaran - Storage Filter Drivers;\??\c:\windows\system32\Drivers\Aldebaran.sys –> c:\windows\system32\Drivers\Aldebaran.sys [?]
S3 ctlsb16;Creative SB16/AWE32/AWE64 Driver (WDM);c:\windows\system32\drivers\ctlsb16.sys [12/5/2007 3:04 AM 96256]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 12872]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
2010-05-14 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-04-27 01:51]
2010-05-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2010-05-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-29 07:55]
2010-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 21:23]
2010-05-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 21:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
uInternet Settings,ProxyServer = 200.171.104.234:8080->Brazil(high-anonymous)
uInternet Settings,ProxyOverride = local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Andrew Lawrence\Application Data\Mozilla\Firefox\Profiles\9wyxdvwm.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - plugin: c:\documents and settings\Andrew Lawrence\Local Settings\Application Data\Yahoo!\BrowserPlus\2.7.1\Plugins\npybrowserplus_2.7.1.dll
FF - plugin: c:\program files\Common Files\Motive\npMotive.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft Research\HDView for Firefox\nphdview.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: content.switch.threshold - 600000
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
**************************************************************************
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files:
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(792)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2010-05-16 11:40:07
ComboFix-quarantined-files.txt 2010-05-16 15:40
ComboFix2.txt 2010-03-25 01:31
Pre-Run: 51,834,396,672 bytes free
Post-Run: 51,870,507,008 bytes free
- - End Of File - - BE51B1878A8210220028233FFF3384A8
Please go to:
VirusTotal [external image: Posted Image] Click the Browse button and search for the following file:C:\WINDOWS\System32\zonajagi Click Open Then click Send File Please be patient while the file is scanned. Once the scan results appear, please provide them in your next reply.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.
C:\WINDOWS\System32\zonajagi:
It could not find files
c:\windows\system32\huyerifi.dll
C:\WINDOWS\infocard.exe
Run
OTL.exe
Download
Flash_Disinfector.exe by
sUBs from
HERE and save it to your desktop.
Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear. The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well. Wait until it has finished scanning and then exit the program. Reboot your computer when done. Note :
Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection .
Please let me know how your computer is behaving now.
Do you have any questions on the previous set of instructions, or are you having any trouble with them? Reminder: Threads with no reply in 4 days will be closed.
Due to inactivity this topic will be closed.
If you need help please start a new thread.
New members follow the instructions here
http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic
