Spyware / Malware / Virus Removal

[Resolved] IE 8 redirected, constant reinfection

12 min read

Looking for the outcome? Ask AI

Deleted Member Topic Starter

Post #1May 19, 2010, 7:36 PM UTC

I got infected a week or so ago and cleaned most of the problems up with SpyBot and Malewarebytes but I still get redirected when I click on a link in yahoo or google. PLEASE HELP! DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 14:31:24.17 on Wed 05/19/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2030.1015 [GMT -5:00] AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} ============== Running Processes =============== C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\FolderSize\FolderSizeSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Yahoo!\Common\YMailAdvisor.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Express ClickYes\ClickYes.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Microsoft Visual Studio\VB98\VB6.EXE C:\WINDOWS\system32\mdm.exe C:\DOCUME~1\DANNY~1.BRO\LOCALS~1\Temp\LXJw.exe C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\danny.brownhelicopter\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://my.yahoo.com/ uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = uInternet Settings,ProxyServer = http=127.0.0.1:5555 mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn4\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn4\yt.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn4\yt.dll TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll uRun: [Express ClickYes] c:\program files\express clickyes\ClickYes.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [vptray] c:\progra~1\symant~1\VPTray.exe mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe" mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [Seagull Drivers] ssdal_nc.exe startup mRun: [YMailAdvisor] "c:\program files\yahoo!\common\YMailAdvisor.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [SpybotSnD] "c:\program files\spybot - search & destroy\SpybotSD.exe" /autocheck /autofix mRun: [nwiz] nwiz.exe /installquiet mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit StartupFolder: c:\docume~1\danny~1.bro\startm~1\programs\startup\chat.lnk - g:\vbapps\Chat.exe uPolicies-explorer: DisablePersonalDirChange = 1 (0x1) uPolicies-explorer: NoWelcomeScreen = 1 (0x1) mPolicies-explorer: NoWelcomeScreen = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: EnableLUA = 0 (0x0) dPolicies-explorer: NoSetActiveDesktop = 1 (0x1) IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/mygarmin/m/GarminAxControl.CAB DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553536000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll Notify: igfxcui - igfxdev.dll Notify: NavLogon - c:\windows\system32\NavLogon.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-4-29 218592] R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2005-12-19 337592] R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2005-12-19 54968] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-3-24 192160] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-3-24 169632] R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032] R2 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-6-15 115952] R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-6-15 1805552] R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-3-4 102448] R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100503.002\naveng.sys [2010-5-3 84912] R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100503.002\navex15.sys [2010-5-3 1324720] S0 uvxjvi;uvxjvi;c:\windows\system32\drivers\rdsxrhb.sys –> c:\windows\system32\drivers\rdsxrhb.sys [?] S3 Commander Service;Commander Service;c:\program files\seagull\bartender\7.75\CmdrSrv.exe [2006-10-27 1099368] S3 EraserUtilDrv10910;EraserUtilDrv10910;\??\c:\program files\common files\symantec shared\eengine\eraserutildrv10910.sys –> c:\program files\common files\symantec shared\eengine\EraserUtilDrv10910.sys [?] S3 EraserUtilDrvI7;EraserUtilDrvI7;\??\c:\program files\common files\symantec shared\eengine\eraserutildrvi7.sys –> c:\program files\common files\symantec shared\eengine\EraserUtilDrvI7.sys [?] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-1-25 42000] S3 PublicPreviewTurbineMessageService;Turbine Message Service - PublicPreview;c:\program files\turbine\turbine download manager - lamannia\TurbineMessageService.exe [2009-6-19 267760] S3 PublicPreviewTurbineNetworkService;Turbine Network Service - PublicPreview;c:\program files\turbine\turbine download manager - lamannia\TurbineNetworkService.exe [2009-6-19 218608] S4 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2010-4-29 112592] =============== Created Last 30 ================ 2010-05-17 10:59 –d—– c:\program files\The Ur-Quan Masters 2010-05-17 10:59 –d—– c:\docume~1\danny~1.bro\applic~1\uqm 2010-05-14 15:21 –d—– c:\program files\Trend Micro 2010-05-13 09:35 121,320 a——- c:\windows\File Renamer - Basic Uninstaller.exe 2010-05-13 09:35 –d—– c:\program files\File Renamer 2010-05-13 09:31 –d—– c:\documents and settings\danny.brownhelicopter\WINDOWS 2010-05-06 07:51 –d—– c:\program files\scdata 2010-05-06 07:47 36 a——- c:\program files\skynet.dat 2010-05-06 07:47 –d—– C:\AKM Antivirus 2010 Pro 2010-05-03 11:43 –d—– c:\program files\Spybot - Search & Destroy 2010-05-03 11:43 –d—– c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2010-05-03 11:00 –d—– C:\TEMP 2010-04-29 17:37 181,632 ——– c:\windows\system32\MpSigStub.exe 2010-04-29 17:35 63,360 a——- c:\windows\system32\drivers\pctplsg.sys 2010-04-29 17:35 7,383 a——- c:\windows\system32\drivers\pctplsg.cat 2010-04-29 17:35 –d—– c:\program files\Spyware Doctor 2010-04-29 17:35 –d—– c:\program files\common files\PC Tools 2010-04-29 17:35 –d—– c:\docume~1\alluse~1\applic~1\PC Tools 2010-04-29 15:17 15,360 a——- c:\windows\system32\taskman2.exe 2010-04-29 14:47 256,512 a——- c:\windows\PEV.exe 2010-04-29 14:47 161,792 a——- c:\windows\SWREG.exe 2010-04-29 14:47 98,816 a——- c:\windows\sed.exe 2010-04-29 14:47 77,312 a——- c:\windows\MBR.exe 2010-04-29 14:46 –d—– C:\ComboFix 2010-04-29 14:06 –d—– C:\VundoFix Backups 2010-04-29 12:10 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 12:10 20,952 a——- c:\windows\system32\drivers\mbam.sys 2010-04-29 12:10 –d—– c:\program files\Malwarebytes' Anti-Malware 2010-04-29 11:29 –d—– C:\spoolerlogs 2010-04-29 02:59 726,528 ——– c:\windows\system32\SET1EE.tmp 2010-04-29 02:59 420,352 a——- c:\windows\system32\SET1EA.tmp 2010-04-28 15:31 64,000 a——- c:\windows\system32\ieframe.oca 2010-04-28 15:28 –dsh— c:\documents and settings\danny.brownhelicopter\IECompatCache 2010-04-28 15:28 –dsh— c:\documents and settings\danny.brownhelicopter\PrivacIE 2010-04-28 15:26 –dsh— c:\documents and settings\danny.brownhelicopter\IETldCache 2010-04-28 15:05 –d—– c:\windows\ie8updates 2010-04-28 15:02 -cd-h— c:\windows\ie8 2010-04-28 14:59 247,808 -c—— c:\windows\system32\dllcache\ieproxy.dll 2010-04-28 14:59 12,800 -c—— c:\windows\system32\dllcache\xpshims.dll 2010-04-28 14:59 64,000 -c—— c:\windows\system32\dllcache\iecompat.dll 2010-04-22 16:42 –d—– c:\docume~1\danny~1.bro\applic~1\Auslogics 2010-04-22 16:42 –d—– c:\program files\Auslogics 2010-04-20 15:41 –d—– c:\docume~1\danny~1.bro\applic~1\Realtime Soft ==================== Find3M ==================== 2010-04-26 08:54 5,776,224 a——- C:\partsbase.zip 2010-04-15 08:38 147,366 a——- c:\windows\help\hhcolreg.dat 2010-04-03 19:23 278,120 a——- c:\windows\system32\nvmccs.dll 2010-04-03 19:23 13,670,504 a——- c:\windows\system32\nvcpl.dll 2010-04-03 19:23 154,216 a——- c:\windows\system32\nvsvc32.exe 2010-04-03 19:23 145,000 a——- c:\windows\system32\nvcolor.exe 2010-04-03 19:23 110,696 a——- c:\windows\system32\nvmctray.dll 2010-04-03 19:22 81,920 a——- c:\windows\system32\nvwddi.dll 2010-04-02 16:54 600,680 ac—— c:\windows\system32\NVUNINST.EXE 2010-03-29 10:06 218,592 a——- c:\windows\system32\drivers\PCTCore.sys 2010-03-10 01:15 420,352 a——- c:\windows\system32\vbscript.dll 2010-02-25 01:24 916,480 a——- c:\windows\system32\wininet.dll 2009-02-20 17:07 22,328 a——- c:\docume~1\danny~1.bro\applic~1\PnkBstrK.sys 2008-08-26 10:04 5,018 a–sh— c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys 2008-08-26 10:04 88 —shr– c:\docume~1\alluse~1\applic~1\6F8A12233A.sys 2008-04-04 09:35 88 —shr– c:\docume~1\alluse~1\applic~1\0996A358D6.sys ============= FINISH: 14:33:30.67 ===============

mowman

Post #2May 19, 2010, 7:46 PM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post
•Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
•This may cause a delay in response time, but I will do my best to keep it as short as possible.
•I will reply back shortly with instructions.

mowman

Post #3May 21, 2010, 12:19 AM UTC

Hello,it seems that you have already run Combofix,please post the log it produced It should be located at C:\ComboFix.txt

Deleted Member

Post #4May 21, 2010, 2:37 PM UTC

Here you go and thanks for the help. ComboFix 10-04-29.01 - Administrator 04/29/2010 14:48:49.1.2 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2021.1597 [GMT -5:00] Running from: Z:\ComboFix.exe AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Outdated) {FB06448E-52B8-493A-90F3-E43226D3305C} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Documents and Settings\All Users\Application Data\pragmamfeklnmal.dll C:\Documents and Settings\All Users\Favorites\_favdata.dat C:\Documents and Settings\danny.brownhelicopter\Application Data\ezLife C:\Documents and Settings\danny.brownhelicopter\Local Settings\Application Data\ave.exe C:\Documents and Settings\danny.brownhelicopter\Local Settings\Temporary Internet Files\1XrI0x.jpg C:\Documents and Settings\danny.brownhelicopter\Local Settings\Temporary Internet Files\82J1CPvE0.jpg C:\Documents and Settings\danny.brownhelicopter\Local Settings\Temporary Internet Files\A1731R.jpg C:\Documents and Settings\danny.brownhelicopter\Local Settings\Temporary Internet Files\Cb2TnlDO.jpg C:\Documents and Settings\Danny\Application Data\Install.dat C:\Program Files\ezLife C:\Program Files\ezLife\ezLife\1.5.2.0\uninstall.exe C:\Program Files\Mozilla Firefox\components\ffxShot.dll C:\Program Files\Mozilla Firefox\components\nsFFxSHot.xpt C:\Program Files\Smart-Ads-Solutions C:\Program Files\Smart-Ads-Solutions\SmartAds\1.5.2.0\uninstall.exe C:\Program Files\test\test.exe C:\WINDOWS\PRAGMAjkfdijwmcq C:\WINDOWS\PRAGMAjkfdijwmcq\PRAGMAc.dll C:\WINDOWS\PRAGMAjkfdijwmcq\PRAGMAcfg.ini C:\WINDOWS\PRAGMAjkfdijwmcq\PRAGMAd.sys C:\WINDOWS\Qlaraa.exe C:\WINDOWS\system32\Cache C:\WINDOWS\system32\davapefu.dll c:\windows\system32\driVERs\yzycvn.sys C:\WINDOWS\system32\jarubare.dll C:\WINDOWS\system32\kawekega.dll C:\WINDOWS\system32\lfhaunjgihw.exe C:\WINDOWS\system32\net.net C:\WINDOWS\system32\pragmabbr.dll C:\WINDOWS\system32\pragmaserf.dll C:\WINDOWS\system32\PRAGMAsrcr.dat C:\WINDOWS\system32\uniacowchqpbboi.dll C:\WINDOWS\system32\ux02e14.dll C:\WINDOWS\system32\vagivoho.exe C:\WINDOWS\system32\vljnqqih.dll C:\WINDOWS\system32\zip32.dll C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job —– BITS: Possible infected sites —– hxxp://217.23.14.74 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\Legacy_PRAGMAJKFDIJWMCQ ——-\Service_PRAGMAjkfdijwmcq ——-\Legacy_yzycvn ——-\Service_yzycvn

mowman

Post #5May 21, 2010, 10:10 PM UTC

Hello DannyHaggard,please do the following.

Delete the copy of ComboFix you have and download a fresh copy.

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2

[external image: Posted Image]

[external image: Posted Image]

* IMPORTANT !!! Save Combo-Fix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on Combo-Fix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

The recovery console must be installed or Combofix may not be able to fix this infection

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Deleted Member

Post #6May 23, 2010, 6:01 PM UTC

Will do first think monday! Thanks

Deleted Member

Post #7May 24, 2010, 7:32 PM UTC

ComboFix 10-05-23.08 - danny 05/24/2010 14:14:08.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2030.1393 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\dannyfix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\AKM Antivirus 2010 Pro
c:\akm antivirus 2010 pro\AKM Antivirus 2010 Pro.lnk
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\scdata
c:\program files\scdata\dbsinit.exe
c:\program files\scdata\images\i1.gif
c:\program files\scdata\images\i2.gif
c:\program files\scdata\images\i3.gif
c:\program files\scdata\images\j1.gif
c:\program files\scdata\images\j2.gif
c:\program files\scdata\images\j3.gif
c:\program files\scdata\images\jj1.gif
c:\program files\scdata\images\jj2.gif
c:\program files\scdata\images\jj3.gif
c:\program files\scdata\images\l1.gif
c:\program files\scdata\images\l2.gif
c:\program files\scdata\images\l3.gif
c:\program files\scdata\images\pix.gif
c:\program files\scdata\images\t1.gif
c:\program files\scdata\images\t2.gif
c:\program files\scdata\images\Thumbs.db
c:\program files\scdata\images\up1.gif
c:\program files\scdata\images\up2.gif
c:\program files\scdata\images\w1.gif
c:\program files\scdata\images\w11.gif
c:\program files\scdata\images\w2.gif
c:\program files\scdata\images\w3.jpg
c:\program files\scdata\images\word.doc
c:\program files\scdata\images\wt1.gif
c:\program files\scdata\images\wt2.gif
c:\program files\scdata\images\wt3.gif
c:\program files\scdata\wispex.html
c:\program files\skynet.dat
.
—- Previous Run ——-
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\All Users\Application Data\pragmamfeklnmal.dll
c:\documents and settings\All Users\Favorites\_favdata.dat
c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\ave.exe
c:\documents and settings\danny.brownhelicopter\Local Settings\Temporary Internet Files\1XrI0x.jpg
c:\documents and settings\danny.brownhelicopter\Local Settings\Temporary Internet Files\82J1CPvE0.jpg
c:\documents and settings\danny.brownhelicopter\Local Settings\Temporary Internet Files\A1731R.jpg
c:\documents and settings\danny.brownhelicopter\Local Settings\Temporary Internet Files\Cb2TnlDO.jpg
c:\documents and settings\Danny\Application Data\Install.dat
c:\program files\ezLife\ezLife\1.5.2.0\uninstall.exe
c:\program files\Mozilla Firefox\components\ffxShot.dll
c:\program files\Mozilla Firefox\components\nsFFxSHot.xpt
c:\program files\Smart-Ads-Solutions\SmartAds\1.5.2.0\uninstall.exe
c:\program files\test\test.exe
c:\windows\PRAGMAjkfdijwmcq\PRAGMAc.dll
c:\windows\PRAGMAjkfdijwmcq\PRAGMAcfg.ini
c:\windows\PRAGMAjkfdijwmcq\PRAGMAd.sys
c:\windows\Qlaraa.exe
c:\windows\system32\davapefu.dll
c:\windows\system32\driVERs\yzycvn.sys
c:\windows\system32\jarubare.dll
c:\windows\system32\kawekega.dll
c:\windows\system32\lfhaunjgihw.exe
c:\windows\system32\net.net
c:\windows\system32\pragmabbr.dll
c:\windows\system32\pragmaserf.dll
c:\windows\system32\PRAGMAsrcr.dat
c:\windows\system32\uniacowchqpbboi.dll
c:\windows\system32\ux02e14.dll
c:\windows\system32\vagivoho.exe
c:\windows\system32\vljnqqih.dll
c:\windows\system32\zip32.dll
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

—– BITS: Possible infected sites —–

hxxp://www.photoshow.com
Infected copy of c:\windows\system32\drivers\intelppm.sys was found and disinfected
Restored copy from - Kitty had a snack

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PRAGMAJKFDIJWMCQ
——-\Service_PRAGMAjkfdijwmcq
——-\Legacy_yzycvn
——-\Service_yzycvn

((((((((((((((((((((((((( Files Created from 2010-04-24 to 2010-05-24 )))))))))))))))))))))))))))))))
.

2010-05-21 21:50 . 2010-05-21 21:51 ——– d—–w- c:\program files\NVIDIA Corporation
2010-05-20 20:40 . 2010-05-20 20:40 666112 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\pmv306hw-1004220-0-main.dll
2010-05-20 20:40 . 2010-05-20 20:40 319488 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
2010-05-17 15:59 . 2010-05-24 18:31 ——– d—–w- c:\program files\The Ur-Quan Masters
2010-05-17 15:59 . 2010-05-17 16:02 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\uqm
2010-05-14 20:21 . 2010-05-14 20:21 ——– d—–w- c:\program files\Trend Micro
2010-05-13 14:35 . 2010-05-13 14:35 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\File Renamer Basic
2010-05-13 14:35 . 2010-05-13 14:35 121320 —-a-w- c:\windows\File Renamer - Basic Uninstaller.exe
2010-05-13 14:35 . 2010-05-13 14:35 ——– d—–w- c:\program files\File Renamer
2010-05-13 14:31 . 2010-05-13 14:31 ——– d—–w- c:\documents and settings\danny.brownhelicopter\WINDOWS
2010-05-12 18:16 . 2010-04-03 22:55 61440 —-a-w- c:\windows\system32\OpenCL.dll
2010-05-12 18:16 . 2010-04-03 22:55 14757888 —-a-w- c:\windows\system32\nvoglnt.dll
2010-05-12 18:16 . 2010-04-03 22:55 4075520 —-a-w- c:\windows\system32\nvcuda.dll
2010-05-12 18:16 . 2010-04-03 22:55 2646632 —-a-w- c:\windows\system32\nvcuvenc.dll
2010-05-12 18:16 . 2010-04-03 22:55 2030184 —-a-w- c:\windows\system32\nvcuvid.dll
2010-05-12 18:16 . 2010-04-03 22:55 227944 —-a-w- c:\windows\system32\nvcodins.dll
2010-05-12 18:16 . 2010-04-03 22:55 227944 —-a-w- c:\windows\system32\nvcod.dll
2010-05-12 18:16 . 2010-04-03 22:55 2183470 —-a-w- c:\windows\system32\nvdata.bin
2010-05-12 18:16 . 2010-04-03 22:55 11647592 —-a-w- c:\windows\system32\nvcompiler.dll
2010-05-12 18:16 . 2010-04-03 22:55 1097728 —-a-w- c:\windows\system32\nvapi.dll
2010-05-08 12:20 . 2010-05-10 15:51 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\eltljdqge
2010-05-03 16:43 . 2010-05-03 16:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-03 16:43 . 2010-05-03 16:45 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-05-03 16:00 . 2010-05-21 21:36 ——– d—–w- C:\TEMP
2010-05-03 15:41 . 2010-05-03 15:41 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Threat Expert
2010-05-03 15:41 . 2010-05-03 15:41 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Yahoo!
2010-05-01 03:41 . 2010-05-01 03:44 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-29 22:46 . 2010-04-29 22:46 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\Threat Expert
2010-04-29 22:37 . 2010-02-24 15:16 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-04-29 22:36 . 2010-01-22 14:55 767952 —-a-w- c:\windows\BDTSupport.dll
2010-04-29 22:36 . 2010-01-22 14:56 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-04-29 22:36 . 2010-01-22 14:56 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-04-29 22:36 . 2010-01-22 14:56 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-04-29 22:36 . 2009-10-28 06:36 1152444 —-a-w- c:\windows\UDB.zip
2010-04-29 22:36 . 2008-11-26 17:08 131 —-a-w- c:\windows\IDB.zip
2010-04-29 22:36 . 2010-02-05 14:17 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-04-29 22:36 . 2010-03-29 15:06 218592 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-04-29 22:36 . 2009-11-23 18:54 88040 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-04-29 22:35 . 2010-04-08 19:29 63360 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-04-29 22:35 . 2010-04-29 22:55 ——– d—–w- c:\program files\Spyware Doctor
2010-04-29 22:35 . 2010-04-29 22:35 ——– d—–w- c:\program files\Common Files\PC Tools
2010-04-29 22:35 . 2010-04-29 22:35 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-04-29 22:35 . 2010-04-29 22:35 ——– d—–w- c:\documents and settings\Administrator\Application Data\PC Tools
2010-04-29 20:17 . 2007-07-27 12:00 15360 —-a-w- c:\windows\system32\taskman2.exe
2010-04-29 19:06 . 2010-04-29 19:06 ——– d—–w- C:\VundoFix Backups
2010-04-29 17:10 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 17:10 . 2010-04-29 22:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-29 17:10 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-29 16:40 . 2010-04-29 16:40 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2010-04-29 16:40 . 2008-02-21 14:04 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2010-04-29 16:37 . 2010-04-29 16:37 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-04-29 16:30 . 2010-04-29 23:08 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\cfkbetxpr
2010-04-29 16:29 . 2010-04-29 16:29 ——– d—–w- C:\spoolerlogs
2010-04-29 16:28 . 2010-04-29 16:28 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-04-28 20:28 . 2010-04-28 20:28 ——– d-sh–w- c:\documents and settings\danny.brownhelicopter\IECompatCache
2010-04-28 20:28 . 2010-04-28 20:28 ——– d-sh–w- c:\documents and settings\danny.brownhelicopter\PrivacIE
2010-04-28 20:26 . 2010-04-28 20:26 ——– d-sh–w- c:\documents and settings\danny.brownhelicopter\IETldCache
2010-04-28 20:05 . 2010-04-29 08:01 ——– d—–w- c:\windows\ie8updates
2010-04-28 20:02 . 2010-04-28 20:03 ——– dc-h–w- c:\windows\ie8
2010-04-28 19:59 . 2010-02-25 06:24 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-04-28 19:59 . 2010-02-25 06:24 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-04-28 19:59 . 2010-02-16 04:50 64000 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2010-04-27 15:46 . 2010-04-27 15:46 862872 ——w- c:\documents and settings\danny.brownhelicopter\Application Data\yahoo!\SearchProtection\fudogs_2.0.1.13_msgr_bts_setup.2010.04.01.01.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-24 19:12 . 2008-02-21 14:02 ——– d—–w- c:\program files\Symantec AntiVirus
2010-05-24 15:48 . 2007-12-13 15:28 ——– d—–w- c:\program files\BHI
2010-05-21 21:51 . 2010-04-01 13:48 ——– d—–w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-05-21 21:19 . 2010-04-07 21:05 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\vlc
2010-05-19 19:42 . 2007-12-13 15:05 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-05-19 19:37 . 2008-02-21 14:02 ——– d—–w- c:\program files\Symantec
2010-05-18 21:19 . 2007-12-21 16:50 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\uTorrent
2010-05-14 20:25 . 2008-06-30 21:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-03 21:15 . 2008-05-27 13:36 ——– d—–w- c:\program files\Google
2010-04-29 20:01 . 2008-08-14 19:04 ——– d—–w- c:\program files\test
2010-04-29 16:47 . 2010-04-29 16:47 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-04-29 16:44 . 2010-04-29 16:44 ——– d—–w- c:\documents and settings\Administrator\Application Data\DivX
2010-04-29 16:30 . 2008-06-11 16:28 ——– d—–w- c:\program files\Microsoft IntelliPoint
2010-04-28 19:08 . 2007-12-21 16:50 ——– d—–w- c:\program files\uTorrent
2010-04-27 21:49 . 2008-03-05 17:43 ——– d—–w- c:\program files\Phun
2010-04-27 21:48 . 2009-02-13 14:43 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\id Software
2010-04-27 15:46 . 2008-03-18 13:02 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-04-27 15:46 . 2007-12-13 15:58 ——– d—–w- c:\program files\Yahoo!
2010-04-26 17:07 . 2008-08-26 16:18 ——– d—–w- c:\documents and settings\All Users\Application Data\DVD Shrink
2010-04-26 13:54 . 2009-04-27 18:04 5776224 —-a-w- C:\partsbase.zip
2010-04-22 21:42 . 2010-04-22 21:42 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Auslogics
2010-04-22 21:42 . 2010-04-22 21:42 ——– d—–w- c:\program files\Auslogics
2010-04-20 20:53 . 2010-04-15 22:19 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\TeraCopy
2010-04-20 20:41 . 2010-04-20 20:41 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Realtime Soft
2010-04-20 15:07 . 2007-12-13 23:07 39344 —-a-w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-15 16:14 . 2010-04-15 15:41 ——– d—–w- c:\documents and settings\Danny\Application Data\TeraCopy
2010-04-15 15:47 . 2008-04-04 14:35 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Corel
2010-04-15 15:47 . 2008-02-14 14:24 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Apple Computer
2010-04-15 15:46 . 2009-01-14 19:55 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\GARMIN
2010-04-15 15:46 . 2008-07-31 22:20 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\deskPDF
2010-04-15 15:41 . 2010-04-15 15:41 ——– d—–w- c:\program files\TeraCopy
2010-04-15 15:37 . 2010-04-15 15:37 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\NesterSoft
2010-04-15 15:36 . 2010-04-15 15:36 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Video DVD Maker FREE
2010-04-15 15:26 . 2010-04-15 15:26 ——– d—–w- c:\documents and settings\Danny\Application Data\DivX
2010-04-15 14:39 . 2004-06-21 18:46 ——– d—–w- c:\documents and settings\Danny\Application Data\Yahoo!
2010-04-15 13:42 . 2010-04-15 13:42 ——– d—–w- c:\program files\Microsoft ActiveSync
2010-04-15 13:38 . 2007-12-13 15:53 147366 —-a-w- c:\windows\Help\hhcolreg.dat
2010-04-14 22:33 . 2007-12-20 17:36 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\ImgBurn
2010-04-13 22:13 . 2008-08-26 15:10 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\dvdcss
2010-04-11 07:34 . 2010-03-06 16:32 439816 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\setup.exe
2010-04-09 21:40 . 2010-04-07 21:43 ——– d—–w- c:\program files\eclipse
2010-04-07 19:42 . 2007-12-13 15:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-04-05 19:05 . 2010-04-05 19:05 9781800 —-a-w- c:\documents and settings\All Users\Application Data\Roxio\Auto Update\Roxio PhotoShow\update_files\roxio_photoshow_setup_0683.exe
2010-04-04 00:23 . 2010-04-04 00:23 278120 —-a-w- c:\windows\system32\nvmccs.dll
2010-04-04 00:23 . 2010-04-04 00:23 154216 —-a-w- c:\windows\system32\nvsvc32.exe
2010-04-04 00:23 . 2010-04-04 00:23 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-04-04 00:23 . 2010-04-04 00:23 13670504 —-a-w- c:\windows\system32\nvcpl.dll
2010-04-04 00:23 . 2010-04-04 00:23 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-04-04 00:22 . 2010-04-04 00:22 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-04-03 22:55 . 2007-12-13 15:19 600680 -c–a-w- c:\windows\system32\nvudisp.exe
2010-04-03 22:55 . 2007-12-13 08:42 10232128 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-04-03 22:55 . 2007-12-13 08:42 6432128 —-a-w- c:\windows\system32\nv4_disp.dll
2010-04-02 21:54 . 2007-12-13 15:16 600680 -c–a-w- c:\windows\system32\NVUNINST.EXE
2010-03-30 15:34 . 2008-01-24 15:13 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\gtk-2.0
2010-03-29 00:37 . 2010-03-29 00:37 20846064 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold.exe
2010-03-22 19:27 . 2009-12-05 05:47 79488 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-10 06:15 . 2010-04-29 07:59 420352 —-a-w- c:\windows\system32\SET1EA.tmp
2010-03-10 06:15 . 2007-07-27 12:00 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-03-07 00:33 . 2010-03-07 00:33 8405312 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-03-07 00:33 . 2010-03-07 00:33 149000 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
2010-03-07 00:33 . 2010-03-07 00:33 10309448 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe
2010-03-07 00:33 . 2010-03-07 00:33 283280 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\carb\CarboniteSetupLiteRealPreinstaller.exe
2010-03-07 00:33 . 2010-03-07 00:33 181768 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\carb\LaunchHelper.exe
2010-03-07 00:33 . 2010-03-07 00:33 79368 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-03-07 00:33 . 2010-03-07 00:33 64000 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-03-07 00:33 . 2010-03-07 00:33 52288 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-03-07 00:33 . 2010-03-07 00:33 50688 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-03-07 00:33 . 2010-03-07 00:33 49152 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-03-07 00:33 . 2010-03-07 00:33 118784 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll
2010-02-25 06:24 . 2007-07-27 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2007-07-27 12:00 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Express ClickYes"="c:\program files\Express ClickYes\ClickYes.exe" [2005-07-27 32256]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-06-15 124656]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2009-01-26 5365592]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-04 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-04 13670504]

c:\documents and settings\Danny\Start Menu\Programs\Startup\
Chat.lnk - g:\vbapps\Chat.exe [2004-5-15 57344]

c:\documents and settings\danny.brownhelicopter\Start Menu\Programs\Startup\
Chat.lnk - g:\vbapps\Chat.exe [2004-5-15 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3768510774-2719637463-2565569504-1153\Scripts\Logon\0\0]
"Script"=Drives.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3768510774-2719637463-2565569504-1153\Scripts\Logon\1\0]
"Script"=logon.bat

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^APC UPS Status.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\APC UPS Status.lnk
backup=c:\windows\pss\APC UPS Status.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ImageMixer 3 SE Camera Monitor Ver.5.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ImageMixer 3 SE Camera Monitor Ver.5.lnk
backup=c:\windows\pss\ImageMixer 3 SE Camera Monitor Ver.5.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
2010-03-09 13:40 1286608 —-a-w- c:\program files\Spyware Doctor\pctsTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Chat\\Chat.exe"=
"c:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"=
"c:\\Program Files\\Corel\\DVD9\\WinDVD.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [4/29/2010 5:36 PM 218592]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/17/2007 8:09 PM 11032]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/15/2006 2:40 AM 115952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [3/4/2010 5:05 PM 102448]
S0 uvxjvi;uvxjvi;c:\windows\system32\drivers\rdsxrhb.sys –> c:\windows\system32\drivers\rdsxrhb.sys [?]
S3 Commander Service;Commander Service;c:\program files\Seagull\BarTender\7.75\CmdrSrv.exe [10/27/2006 3:15 PM 1099368]
S3 EraserUtilDrv10910;EraserUtilDrv10910;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10910.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10910.sys [?]
S3 EraserUtilDrvI7;EraserUtilDrvI7;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/25/2007 12:31 PM 42000]
S3 PublicPreviewTurbineMessageService;Turbine Message Service - PublicPreview;c:\program files\Turbine\Turbine Download Manager - Lamannia\TurbineMessageService.exe [6/19/2009 11:34 AM 267760]
S3 PublicPreviewTurbineNetworkService;Turbine Network Service - PublicPreview;c:\program files\Turbine\Turbine Download Manager - Lamannia\TurbineNetworkService.exe [6/19/2009 11:34 AM 218608]
S4 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [4/29/2010 5:36 PM 112592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-05-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153Core.job
- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-03 08:10]

2010-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153UA.job
- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-03 08:10]

2010-05-19 c:\windows\Tasks\Roxio PhotoShow Updater.job
- c:\program files\Roxio\PhotoShow\auto_updater_shim.exe [2009-05-06 15:38]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei;=utf-8&fr;=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride =
uInternet Settings,ProxyServer = http=127.0.0.1:5555
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/mygarmin/m/GarminAxControl.CAB
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-nwiz - nwiz.exe
AddRemove-lfhaunjgihw - c:\windows\system32\lfhaunjgihw.exe
AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-24 14:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(904)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

- - - - - - - > 'lsass.exe'(960)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
c:\program files\Bonjour\mdnsNSP.dll
.
Completion time: 2010-05-24 14:28:54
ComboFix-quarantined-files.txt 2010-05-24 19:28

Pre-Run: 28,162,043,904 bytes free
Post-Run: 28,864,901,120 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 3F297E8A644CCC65417387EF18D4DA0E

mowman

Post #8May 24, 2010, 10:23 PM UTC

Hello DannyHaggard,please do the following

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
File:: 
c:\windows\system32\drivers\rdsxrhb.sys 

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5555

Driver:: 
uvxjvi
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
If you need help to disable your protection programs see here.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

You have Malwarebytes installed,please update and run a quick scan.

Please post the Combofix and MBAM logs in your next reply.

Deleted Member

Post #9May 25, 2010, 1:20 PM UTC

ComboFix 10-05-24.03 - danny 05/24/2010 17:43:20.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2030.1215 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\dannyfix.exe
Command switches used :: c:\documents and settings\danny.brownhelicopter\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::
"c:\windows\system32\drivers\rdsxrhb.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_uvxjvi

((((((((((((((((((((((((( Files Created from 2010-04-25 to 2010-05-25 )))))))))))))))))))))))))))))))
.

2010-05-25 08:00 . 2010-05-25 08:00 ——– d—–w- c:\windows\LastGood
2010-05-24 19:01 . 2010-05-24 19:29 ——– d—–w- C:\dannyfix
2010-05-21 21:50 . 2010-05-21 21:51 ——– d—–w- c:\program files\NVIDIA Corporation
2010-05-17 15:59 . 2010-05-24 18:31 ——– d—–w- c:\program files\The Ur-Quan Masters
2010-05-17 15:59 . 2010-05-17 16:02 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\uqm
2010-05-14 20:21 . 2010-05-14 20:21 ——– d—–w- c:\program files\Trend Micro
2010-05-13 14:35 . 2010-05-13 14:35 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\File Renamer Basic
2010-05-13 14:35 . 2010-05-13 14:35 121320 —-a-w- c:\windows\File Renamer - Basic Uninstaller.exe
2010-05-13 14:35 . 2010-05-13 14:35 ——– d—–w- c:\program files\File Renamer
2010-05-13 14:31 . 2010-05-13 14:31 ——– d—–w- c:\documents and settings\danny.brownhelicopter\WINDOWS
2010-05-12 18:16 . 2010-04-03 22:55 61440 —-a-w- c:\windows\system32\OpenCL.dll
2010-05-12 18:16 . 2010-04-03 22:55 14757888 —-a-w- c:\windows\system32\nvoglnt.dll
2010-05-12 18:16 . 2010-04-03 22:55 4075520 —-a-w- c:\windows\system32\nvcuda.dll
2010-05-12 18:16 . 2010-04-03 22:55 2646632 —-a-w- c:\windows\system32\nvcuvenc.dll
2010-05-12 18:16 . 2010-04-03 22:55 2030184 —-a-w- c:\windows\system32\nvcuvid.dll
2010-05-12 18:16 . 2010-04-03 22:55 227944 —-a-w- c:\windows\system32\nvcodins.dll
2010-05-12 18:16 . 2010-04-03 22:55 227944 —-a-w- c:\windows\system32\nvcod.dll
2010-05-12 18:16 . 2010-04-03 22:55 2183470 —-a-w- c:\windows\system32\nvdata.bin
2010-05-12 18:16 . 2010-04-03 22:55 11647592 —-a-w- c:\windows\system32\nvcompiler.dll
2010-05-12 18:16 . 2010-04-03 22:55 1097728 —-a-w- c:\windows\system32\nvapi.dll
2010-05-08 12:20 . 2010-05-10 15:51 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\eltljdqge
2010-05-03 16:43 . 2010-05-03 16:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-03 16:43 . 2010-05-03 16:45 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-05-03 16:00 . 2010-05-21 21:36 ——– d—–w- C:\TEMP
2010-05-03 15:41 . 2010-05-03 15:41 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Threat Expert
2010-05-03 15:41 . 2010-05-03 15:41 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Yahoo!
2010-05-01 03:41 . 2010-05-01 03:44 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-29 22:46 . 2010-04-29 22:46 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\Threat Expert
2010-04-29 22:37 . 2010-02-24 15:16 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-04-29 22:36 . 2010-01-22 14:55 767952 —-a-w- c:\windows\BDTSupport.dll
2010-04-29 22:36 . 2010-01-22 14:56 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-04-29 22:36 . 2010-01-22 14:56 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-04-29 22:36 . 2010-01-22 14:56 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-04-29 22:36 . 2009-10-28 06:36 1152444 —-a-w- c:\windows\UDB.zip
2010-04-29 22:36 . 2008-11-26 17:08 131 —-a-w- c:\windows\IDB.zip
2010-04-29 22:36 . 2010-02-05 14:17 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-04-29 22:36 . 2010-03-29 15:06 218592 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-04-29 22:36 . 2009-11-23 18:54 88040 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-04-29 22:35 . 2010-04-08 19:29 63360 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-04-29 22:35 . 2010-04-29 22:55 ——– d—–w- c:\program files\Spyware Doctor
2010-04-29 22:35 . 2010-04-29 22:35 ——– d—–w- c:\program files\Common Files\PC Tools
2010-04-29 22:35 . 2010-04-29 22:35 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-04-29 22:35 . 2010-04-29 22:35 ——– d—–w- c:\documents and settings\Administrator\Application Data\PC Tools
2010-04-29 20:17 . 2007-07-27 12:00 15360 —-a-w- c:\windows\system32\taskman2.exe
2010-04-29 19:06 . 2010-04-29 19:06 ——– d—–w- C:\VundoFix Backups
2010-04-29 17:10 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 17:10 . 2010-04-29 22:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-29 17:10 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-29 16:40 . 2010-04-29 16:40 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2010-04-29 16:40 . 2008-02-21 14:04 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2010-04-29 16:37 . 2010-04-29 16:37 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-04-29 16:30 . 2010-04-29 23:08 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\cfkbetxpr
2010-04-29 16:29 . 2010-04-29 16:29 ——– d—–w- C:\spoolerlogs
2010-04-29 16:28 . 2010-04-29 16:28 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-04-28 20:28 . 2010-04-28 20:28 ——– d-sh–w- c:\documents and settings\danny.brownhelicopter\IECompatCache
2010-04-28 20:28 . 2010-04-28 20:28 ——– d-sh–w- c:\documents and settings\danny.brownhelicopter\PrivacIE
2010-04-28 20:26 . 2010-04-28 20:26 ——– d-sh–w- c:\documents and settings\danny.brownhelicopter\IETldCache
2010-04-28 20:05 . 2010-04-29 08:01 ——– d—–w- c:\windows\ie8updates
2010-04-28 20:02 . 2010-04-28 20:03 ——– dc-h–w- c:\windows\ie8
2010-04-28 19:59 . 2010-02-25 06:24 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-04-28 19:59 . 2010-02-25 06:24 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-04-28 19:59 . 2010-02-16 04:50 64000 -c—-w- c:\windows\system32\dllcache\iecompat.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-25 13:04 . 2008-02-21 14:02 ——– d—–w- c:\program files\Symantec AntiVirus
2010-05-24 15:48 . 2007-12-13 15:28 ——– d—–w- c:\program files\BHI
2010-05-21 21:51 . 2010-04-01 13:48 ——– d—–w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-05-21 21:19 . 2010-04-07 21:05 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\vlc
2010-05-19 19:42 . 2007-12-13 15:05 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-05-19 19:37 . 2008-02-21 14:02 ——– d—–w- c:\program files\Symantec
2010-05-18 21:19 . 2007-12-21 16:50 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\uTorrent
2010-05-14 20:25 . 2008-06-30 21:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-03 21:15 . 2008-05-27 13:36 ——– d—–w- c:\program files\Google
2010-04-29 20:01 . 2008-08-14 19:04 ——– d—–w- c:\program files\test
2010-04-29 16:47 . 2010-04-29 16:47 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-04-29 16:44 . 2010-04-29 16:44 ——– d—–w- c:\documents and settings\Administrator\Application Data\DivX
2010-04-29 16:30 . 2008-06-11 16:28 ——– d—–w- c:\program files\Microsoft IntelliPoint
2010-04-28 19:08 . 2007-12-21 16:50 ——– d—–w- c:\program files\uTorrent
2010-04-27 21:49 . 2008-03-05 17:43 ——– d—–w- c:\program files\Phun
2010-04-27 21:48 . 2009-02-13 14:43 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\id Software
2010-04-27 15:46 . 2008-03-18 13:02 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-04-27 15:46 . 2007-12-13 15:58 ——– d—–w- c:\program files\Yahoo!
2010-04-26 17:07 . 2008-08-26 16:18 ——– d—–w- c:\documents and settings\All Users\Application Data\DVD Shrink
2010-04-26 13:54 . 2009-04-27 18:04 5776224 —-a-w- C:\partsbase.zip
2010-04-22 21:42 . 2010-04-22 21:42 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Auslogics
2010-04-22 21:42 . 2010-04-22 21:42 ——– d—–w- c:\program files\Auslogics
2010-04-20 20:53 . 2010-04-15 22:19 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\TeraCopy
2010-04-20 20:41 . 2010-04-20 20:41 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Realtime Soft
2010-04-20 15:07 . 2007-12-13 23:07 39344 —-a-w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-15 16:14 . 2010-04-15 15:41 ——– d—–w- c:\documents and settings\Danny\Application Data\TeraCopy
2010-04-15 15:47 . 2008-04-04 14:35 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Corel
2010-04-15 15:47 . 2008-02-14 14:24 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Apple Computer
2010-04-15 15:46 . 2009-01-14 19:55 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\GARMIN
2010-04-15 15:46 . 2008-07-31 22:20 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\deskPDF
2010-04-15 15:41 . 2010-04-15 15:41 ——– d—–w- c:\program files\TeraCopy
2010-04-15 15:37 . 2010-04-15 15:37 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\NesterSoft
2010-04-15 15:36 . 2010-04-15 15:36 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Video DVD Maker FREE
2010-04-15 15:26 . 2010-04-15 15:26 ——– d—–w- c:\documents and settings\Danny\Application Data\DivX
2010-04-15 14:39 . 2004-06-21 18:46 ——– d—–w- c:\documents and settings\Danny\Application Data\Yahoo!
2010-04-15 13:42 . 2010-04-15 13:42 ——– d—–w- c:\program files\Microsoft ActiveSync
2010-04-14 22:33 . 2007-12-20 17:36 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\ImgBurn
2010-04-13 22:13 . 2008-08-26 15:10 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\dvdcss
2010-04-09 21:40 . 2010-04-07 21:43 ——– d—–w- c:\program files\eclipse
2010-04-07 19:42 . 2007-12-13 15:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-04-04 00:23 . 2010-04-04 00:23 278120 —-a-w- c:\windows\system32\nvmccs.dll
2010-04-04 00:23 . 2010-04-04 00:23 154216 —-a-w- c:\windows\system32\nvsvc32.exe
2010-04-04 00:23 . 2010-04-04 00:23 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-04-04 00:23 . 2010-04-04 00:23 13670504 —-a-w- c:\windows\system32\nvcpl.dll
2010-04-04 00:23 . 2010-04-04 00:23 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-04-04 00:22 . 2010-04-04 00:22 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-04-03 22:55 . 2007-12-13 15:19 600680 -c–a-w- c:\windows\system32\nvudisp.exe
2010-04-03 22:55 . 2007-12-13 08:42 10232128 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-04-03 22:55 . 2007-12-13 08:42 6432128 —-a-w- c:\windows\system32\nv4_disp.dll
2010-04-02 21:54 . 2007-12-13 15:16 600680 -c–a-w- c:\windows\system32\NVUNINST.EXE
2010-03-30 15:34 . 2008-01-24 15:13 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\gtk-2.0
2010-03-10 06:15 . 2010-04-29 07:59 420352 —-a-w- c:\windows\system32\SET1EA.tmp
2010-03-10 06:15 . 2007-07-27 12:00 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24 . 2007-07-27 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2007-07-27 12:00 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Express ClickYes"="c:\program files\Express ClickYes\ClickYes.exe" [2005-07-27 32256]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-06-15 124656]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2009-01-26 5365592]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-04 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-04 13670504]

c:\documents and settings\Danny\Start Menu\Programs\Startup\
Chat.lnk - g:\vbapps\Chat.exe [2004-5-15 57344]

c:\documents and settings\danny.brownhelicopter\Start Menu\Programs\Startup\
Chat.lnk - g:\vbapps\Chat.exe [2004-5-15 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3768510774-2719637463-2565569504-1153\Scripts\Logon\0\0]
"Script"=Drives.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3768510774-2719637463-2565569504-1153\Scripts\Logon\1\0]
"Script"=logon.bat

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^APC UPS Status.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\APC UPS Status.lnk
backup=c:\windows\pss\APC UPS Status.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ImageMixer 3 SE Camera Monitor Ver.5.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ImageMixer 3 SE Camera Monitor Ver.5.lnk
backup=c:\windows\pss\ImageMixer 3 SE Camera Monitor Ver.5.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
2010-03-09 13:40 1286608 —-a-w- c:\program files\Spyware Doctor\pctsTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Chat\\Chat.exe"=
"c:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"=
"c:\\Program Files\\Corel\\DVD9\\WinDVD.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [4/29/2010 5:36 PM 218592]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/17/2007 8:09 PM 11032]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/15/2006 2:40 AM 115952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [3/4/2010 5:05 PM 102448]
S3 Commander Service;Commander Service;c:\program files\Seagull\BarTender\7.75\CmdrSrv.exe [10/27/2006 3:15 PM 1099368]
S3 EraserUtilDrv10910;EraserUtilDrv10910;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10910.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10910.sys [?]
S3 EraserUtilDrvI7;EraserUtilDrvI7;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/25/2007 12:31 PM 42000]
S3 PublicPreviewTurbineMessageService;Turbine Message Service - PublicPreview;c:\program files\Turbine\Turbine Download Manager - Lamannia\TurbineMessageService.exe [6/19/2009 11:34 AM 267760]
S3 PublicPreviewTurbineNetworkService;Turbine Network Service - PublicPreview;c:\program files\Turbine\Turbine Download Manager - Lamannia\TurbineNetworkService.exe [6/19/2009 11:34 AM 218608]
S4 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [4/29/2010 5:36 PM 112592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-05-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153Core.job
- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-03 08:10]

2010-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153UA.job
- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-03 08:10]

2010-05-19 c:\windows\Tasks\Roxio PhotoShow Updater.job
- c:\program files\Roxio\PhotoShow\auto_updater_shim.exe [2009-05-06 15:38]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride =
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/mygarmin/m/GarminAxControl.CAB
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-25 08:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(940)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

- - - - - - - > 'lsass.exe'(996)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
c:\program files\Bonjour\mdnsNSP.dll

- - - - - - - > 'explorer.exe'(3592)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\FolderSize\FolderSizeSvc.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Chat\Chat.EXE
.
**************************************************************************
.
Completion time: 2010-05-25 08:16:09 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-25 13:16
ComboFix2.txt 2010-05-24 19:28

Pre-Run: 28,787,236,864 bytes free
Post-Run: 28,669,128,704 bytes free

- - End Of File - - C02311864392B82B28E49EDBBDC78AE8

mowman

Post #10May 25, 2010, 6:23 PM UTC

Hi did you run the Malwarebytes scan i asked you to.If so please post the log

Deleted Member

Post #11May 25, 2010, 7:12 PM UTC

Sorry missed that part! Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4143 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 5/25/2010 2:07:58 PM mbam-log-2010-05-25 (14-07-58).txt Scan type: Quick scan Objects scanned: 146527 Time elapsed: 6 minute(s), 14 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

mowman

Post #12May 25, 2010, 8:07 PM UTC

Hello DannyHaggard,please do the following

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:dir
c:\documents and settings\NetworkService\Local Settings\Application Data\eltljdqge

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

I need you to run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Deleted Member

Post #13May 26, 2010, 1:01 PM UTC

SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 17:14 on 25/05/2010 by danny (Administrator - Elevation successful) ========== dir ========== c:\documents and settings\NetworkService\Local Settings\Application Data\eltljdqge - Parameters: "(none)" —Files— None found. —Folders— None found. -=End Of File=- C:\old-c\DOWNLOAD\bs230.exe multiple threats C:\old-c\DOWNLOAD\BS230b17.exe multiple threats C:\Qoobox\Quarantine\C\Program Files\ezLife\ezLife\1.5.2.0\uninstall.exe.vir multiple threats C:\Qoobox\Quarantine\C\Program Files\scdata\dbsinit.exe.vir Win32/Adware.WinAntiVirus application C:\Qoobox\Quarantine\C\Program Files\scdata\wispex.html.vir Win32/Adware.WinAntiVirus application C:\Qoobox\Quarantine\C\Program Files\Smart-Ads-Solutions\SmartAds\1.5.2.0\uninstall.exe.vir Win32/Adware.Lifze.H application C:\Qoobox\Quarantine\C\WINDOWS\PRAGMAjkfdijwmcq\PRAGMAd.sys.vir a variant of Win32/Rootkit.Kryptik.AZ trojan C:\System Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009938.exe Win32/Adware.WinAntiVirus application C:\System Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP7\A0007482.exe a variant of Win32/Adware.PCProtector.B application C:\System Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP7\A0008480.exe a variant of Win32/Adware.PCProtector.B application C:\System Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP7\A0008482.exe a variant of Win32/Adware.PCProtector.B application S:\backup\restored\hijackthis\NoLop.exe a variant of Win32/Kryptik.AE trojan S:\backup\restored\old-c\DOWNLOAD\bs230.exe multiple threats S:\backup\restored\old-c\DOWNLOAD\BS230b17.exe multiple threats S:\backup\restored\WINDOWS\ayxxay.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\baaadd.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\ghgihk.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\hklnmp.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\iknqss.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\kbui32.dll probably a variant of Win32/SpamTool.Agent.NDS trojan S:\backup\restored\WINDOWS\kjjiii.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\klmmlm.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\lonpqr.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\morutv.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\nprtss.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\ponmlm.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\pruuwa.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\qrqtvw.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\ssrutv.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\tuttut.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\ututss.ini Win32/Adware.Virtumonde.NEO application S:\backup\restored\WINDOWS\ycdghk.ini Win32/Adware.Virtumonde.NEO application

mowman

Post #14May 26, 2010, 6:43 PM UTC

Hello DannyHaggard,please do the following

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File:: 
C:\old-c\DOWNLOAD\BS230b17.exe 
C:\old-c\DOWNLOAD\bs230.exe 
S:\backup\restored\hijackthis\NoLop.exe 
S:\backup\restored\old-c\DOWNLOAD\bs230.exe 
S:\backup\restored\old-c\DOWNLOAD\BS230b17.exe 
S:\backup\restored\WINDOWS\ayxxay.ini 
S:\backup\restored\WINDOWS\baaadd.ini 
S:\backup\restored\WINDOWS\ghgihk.ini 
S:\backup\restored\WINDOWS\hklnmp.ini 
S:\backup\restored\WINDOWS\iknqss.ini 
S:\backup\restored\WINDOWS\kbui32.dll 
S:\backup\restored\WINDOWS\kjjiii.ini 
S:\backup\restored\WINDOWS\klmmlm.ini 
S:\backup\restored\WINDOWS\lonpqr.ini 
S:\backup\restored\WINDOWS\morutv.ini 
S:\backup\restored\WINDOWS\nprtss.ini 
S:\backup\restored\WINDOWS\ponmlm.ini 
S:\backup\restored\WINDOWS\pruuwa.ini 
S:\backup\restored\WINDOWS\qrqtvw.ini 
S:\backup\restored\WINDOWS\ssrutv.ini 
S:\backup\restored\WINDOWS\tuttut.ini 
S:\backup\restored\WINDOWS\ututss.ini 
S:\backup\restored\WINDOWS\ycdghk.ini 

Folder::
c:\documents and settings\NetworkService\Local Settings\Application Data\eltljdqge

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
If you need help to disable your protection programs see here.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Also tell me how the computer is running now.

Deleted Member

Post #15May 26, 2010, 7:18 PM UTC

Seems to be running well. I NAV did catch Backdoor.Tidserv!inf before I ran the last combofix. Also norton will not download update from live update.

Thanks again

ComboFix 10-05-24.03 - danny 05/26/2010 13:58:40.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2030.1047 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\dannyfix.exe
Command switches used :: c:\documents and settings\danny.brownhelicopter\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::
"c:\old-c\DOWNLOAD\bs230.exe"
"c:\old-c\DOWNLOAD\BS230b17.exe"
"s:\backup\restored\hijackthis\NoLop.exe"
"s:\backup\restored\old-c\DOWNLOAD\bs230.exe"
"s:\backup\restored\old-c\DOWNLOAD\BS230b17.exe"
"s:\backup\restored\WINDOWS\ayxxay.ini"
"s:\backup\restored\WINDOWS\baaadd.ini"
"s:\backup\restored\WINDOWS\ghgihk.ini"
"s:\backup\restored\WINDOWS\hklnmp.ini"
"s:\backup\restored\WINDOWS\iknqss.ini"
"s:\backup\restored\WINDOWS\kbui32.dll"
"s:\backup\restored\WINDOWS\kjjiii.ini"
"s:\backup\restored\WINDOWS\klmmlm.ini"
"s:\backup\restored\WINDOWS\lonpqr.ini"
"s:\backup\restored\WINDOWS\morutv.ini"
"s:\backup\restored\WINDOWS\nprtss.ini"
"s:\backup\restored\WINDOWS\ponmlm.ini"
"s:\backup\restored\WINDOWS\pruuwa.ini"
"s:\backup\restored\WINDOWS\qrqtvw.ini"
"s:\backup\restored\WINDOWS\ssrutv.ini"
"s:\backup\restored\WINDOWS\tuttut.ini"
"s:\backup\restored\WINDOWS\ututss.ini"
"s:\backup\restored\WINDOWS\ycdghk.ini"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\NetworkService\Local Settings\Application Data\eltljdqge
c:\old-c\DOWNLOAD\bs230.exe
c:\old-c\DOWNLOAD\BS230b17.exe
s:\backup\restored\hijackthis\NoLop.exe
s:\backup\restored\old-c\DOWNLOAD\bs230.exe
s:\backup\restored\old-c\DOWNLOAD\BS230b17.exe
s:\backup\restored\WINDOWS\ayxxay.ini
s:\backup\restored\WINDOWS\baaadd.ini
s:\backup\restored\WINDOWS\ghgihk.ini
s:\backup\restored\WINDOWS\hklnmp.ini
s:\backup\restored\WINDOWS\iknqss.ini
s:\backup\restored\WINDOWS\kbui32.dll
s:\backup\restored\WINDOWS\kjjiii.ini
s:\backup\restored\WINDOWS\klmmlm.ini
s:\backup\restored\WINDOWS\lonpqr.ini
s:\backup\restored\WINDOWS\morutv.ini
s:\backup\restored\WINDOWS\nprtss.ini
s:\backup\restored\WINDOWS\ponmlm.ini
s:\backup\restored\WINDOWS\pruuwa.ini
s:\backup\restored\WINDOWS\qrqtvw.ini
s:\backup\restored\WINDOWS\ssrutv.ini
s:\backup\restored\WINDOWS\tuttut.ini
s:\backup\restored\WINDOWS\ututss.ini
s:\backup\restored\WINDOWS\ycdghk.ini

—– BITS: Possible infected sites —–

hxxp://www.photoshow.com
.
((((((((((((((((((((((((( Files Created from 2010-04-26 to 2010-05-26 )))))))))))))))))))))))))))))))
.

2010-05-25 22:23 . 2010-05-25 22:23 ——– d—–w- c:\program files\ESET
2010-05-25 08:00 . 2010-05-25 08:00 ——– d—–w- c:\windows\LastGood
2010-05-24 22:42 . 2010-05-25 13:16 ——– d—–w- C:\dannyfix19068d
2010-05-24 19:01 . 2010-05-24 19:29 ——– d—–w- C:\dannyfix
2010-05-21 21:50 . 2010-05-21 21:51 ——– d—–w- c:\program files\NVIDIA Corporation
2010-05-20 20:40 . 2010-05-20 20:40 666112 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\pmv306hw-1004220-0-main.dll
2010-05-20 20:40 . 2010-05-20 20:40 319488 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
2010-05-17 15:59 . 2010-05-24 18:31 ——– d—–w- c:\program files\The Ur-Quan Masters
2010-05-17 15:59 . 2010-05-17 16:02 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\uqm
2010-05-14 20:21 . 2010-05-14 20:21 ——– d—–w- c:\program files\Trend Micro
2010-05-13 14:35 . 2010-05-13 14:35 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\File Renamer Basic
2010-05-13 14:35 . 2010-05-13 14:35 121320 —-a-w- c:\windows\File Renamer - Basic Uninstaller.exe
2010-05-13 14:35 . 2010-05-13 14:35 ——– d—–w- c:\program files\File Renamer
2010-05-13 14:31 . 2010-05-13 14:31 ——– d—–w- c:\documents and settings\danny.brownhelicopter\WINDOWS
2010-05-12 18:16 . 2010-04-03 22:55 61440 —-a-w- c:\windows\system32\OpenCL.dll
2010-05-12 18:16 . 2010-04-03 22:55 14757888 —-a-w- c:\windows\system32\nvoglnt.dll
2010-05-12 18:16 . 2010-04-03 22:55 4075520 —-a-w- c:\windows\system32\nvcuda.dll
2010-05-12 18:16 . 2010-04-03 22:55 2646632 —-a-w- c:\windows\system32\nvcuvenc.dll
2010-05-12 18:16 . 2010-04-03 22:55 2030184 —-a-w- c:\windows\system32\nvcuvid.dll
2010-05-12 18:16 . 2010-04-03 22:55 227944 —-a-w- c:\windows\system32\nvcodins.dll
2010-05-12 18:16 . 2010-04-03 22:55 227944 —-a-w- c:\windows\system32\nvcod.dll
2010-05-12 18:16 . 2010-04-03 22:55 2183470 —-a-w- c:\windows\system32\nvdata.bin
2010-05-12 18:16 . 2010-04-03 22:55 11647592 —-a-w- c:\windows\system32\nvcompiler.dll
2010-05-12 18:16 . 2010-04-03 22:55 1097728 —-a-w- c:\windows\system32\nvapi.dll
2010-05-03 16:43 . 2010-05-03 16:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-03 16:43 . 2010-05-03 16:45 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-05-03 16:00 . 2010-05-21 21:36 ——– d—–w- C:\TEMP
2010-05-03 15:41 . 2010-05-03 15:41 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Threat Expert
2010-05-03 15:41 . 2010-05-03 15:41 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Yahoo!
2010-05-01 03:41 . 2010-05-01 03:44 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-29 22:46 . 2010-04-29 22:46 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\Threat Expert
2010-04-29 22:37 . 2010-02-24 15:16 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-04-29 22:36 . 2010-01-22 14:55 767952 —-a-w- c:\windows\BDTSupport.dll
2010-04-29 22:36 . 2010-01-22 14:56 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-04-29 22:36 . 2010-01-22 14:56 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-04-29 22:36 . 2010-01-22 14:56 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-04-29 22:36 . 2009-10-28 06:36 1152444 —-a-w- c:\windows\UDB.zip
2010-04-29 22:36 . 2008-11-26 17:08 131 —-a-w- c:\windows\IDB.zip
2010-04-29 22:36 . 2010-02-05 14:17 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-04-29 22:36 . 2010-03-29 15:06 218592 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-04-29 22:36 . 2009-11-23 18:54 88040 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-04-29 22:35 . 2010-04-08 19:29 63360 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-04-29 22:35 . 2010-04-29 22:55 ——– d—–w- c:\program files\Spyware Doctor
2010-04-29 22:35 . 2010-04-29 22:35 ——– d—–w- c:\program files\Common Files\PC Tools
2010-04-29 22:35 . 2010-04-29 22:35 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-04-29 22:35 . 2010-04-29 22:35 ——– d—–w- c:\documents and settings\Administrator\Application Data\PC Tools
2010-04-29 20:17 . 2007-07-27 12:00 15360 —-a-w- c:\windows\system32\taskman2.exe
2010-04-29 19:06 . 2010-04-29 19:06 ——– d—–w- C:\VundoFix Backups
2010-04-29 17:10 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 17:10 . 2010-04-29 22:54 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-04-29 17:10 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-29 16:40 . 2010-04-29 16:40 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2010-04-29 16:40 . 2008-02-21 14:04 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2010-04-29 16:37 . 2010-04-29 16:37 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-04-29 16:30 . 2010-04-29 23:08 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\cfkbetxpr
2010-04-29 16:29 . 2010-04-29 16:29 ——– d—–w- C:\spoolerlogs
2010-04-29 16:28 . 2010-04-29 16:28 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-04-28 20:28 . 2010-04-28 20:28 ——– d-sh–w- c:\documents and settings\danny.brownhelicopter\IECompatCache
2010-04-28 20:28 . 2010-04-28 20:28 ——– d-sh–w- c:\documents and settings\danny.brownhelicopter\PrivacIE
2010-04-28 20:26 . 2010-04-28 20:26 ——– d-sh–w- c:\documents and settings\danny.brownhelicopter\IETldCache
2010-04-28 20:05 . 2010-04-29 08:01 ——– d—–w- c:\windows\ie8updates
2010-04-28 20:02 . 2010-04-28 20:03 ——– dc-h–w- c:\windows\ie8
2010-04-28 19:59 . 2010-02-25 06:24 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-04-28 19:59 . 2010-02-25 06:24 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-04-28 19:59 . 2010-02-16 04:50 64000 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2010-04-27 15:46 . 2010-04-27 15:46 862872 ——w- c:\documents and settings\danny.brownhelicopter\Application Data\yahoo!\SearchProtection\fudogs_2.0.1.13_msgr_bts_setup.2010.04.01.01.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-26 18:56 . 2008-02-21 14:02 ——– d—–w- c:\program files\Symantec AntiVirus
2010-05-24 15:48 . 2007-12-13 15:28 ——– d—–w- c:\program files\BHI
2010-05-21 21:51 . 2010-04-01 13:48 ——– d—–w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-05-21 21:19 . 2010-04-07 21:05 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\vlc
2010-05-19 19:42 . 2007-12-13 15:05 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-05-19 19:37 . 2008-02-21 14:02 ——– d—–w- c:\program files\Symantec
2010-05-18 21:19 . 2007-12-21 16:50 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\uTorrent
2010-05-14 20:25 . 2008-06-30 21:28 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-03 21:15 . 2008-05-27 13:36 ——– d—–w- c:\program files\Google
2010-04-29 20:01 . 2008-08-14 19:04 ——– d—–w- c:\program files\test
2010-04-29 16:47 . 2010-04-29 16:47 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-04-29 16:44 . 2010-04-29 16:44 ——– d—–w- c:\documents and settings\Administrator\Application Data\DivX
2010-04-29 16:30 . 2008-06-11 16:28 ——– d—–w- c:\program files\Microsoft IntelliPoint
2010-04-28 19:08 . 2007-12-21 16:50 ——– d—–w- c:\program files\uTorrent
2010-04-27 21:49 . 2008-03-05 17:43 ——– d—–w- c:\program files\Phun
2010-04-27 21:48 . 2009-02-13 14:43 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\id Software
2010-04-27 15:46 . 2008-03-18 13:02 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-04-27 15:46 . 2007-12-13 15:58 ——– d—–w- c:\program files\Yahoo!
2010-04-26 17:07 . 2008-08-26 16:18 ——– d—–w- c:\documents and settings\All Users\Application Data\DVD Shrink
2010-04-26 13:54 . 2009-04-27 18:04 5776224 —-a-w- C:\partsbase.zip
2010-04-22 21:42 . 2010-04-22 21:42 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Auslogics
2010-04-22 21:42 . 2010-04-22 21:42 ——– d—–w- c:\program files\Auslogics
2010-04-20 20:53 . 2010-04-15 22:19 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\TeraCopy
2010-04-20 20:41 . 2010-04-20 20:41 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Realtime Soft
2010-04-20 15:07 . 2007-12-13 23:07 39344 —-a-w- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-15 16:14 . 2010-04-15 15:41 ——– d—–w- c:\documents and settings\Danny\Application Data\TeraCopy
2010-04-15 15:47 . 2008-04-04 14:35 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Corel
2010-04-15 15:47 . 2008-02-14 14:24 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Apple Computer
2010-04-15 15:46 . 2009-01-14 19:55 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\GARMIN
2010-04-15 15:46 . 2008-07-31 22:20 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\deskPDF
2010-04-15 15:41 . 2010-04-15 15:41 ——– d—–w- c:\program files\TeraCopy
2010-04-15 15:37 . 2010-04-15 15:37 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\NesterSoft
2010-04-15 15:36 . 2010-04-15 15:36 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\Video DVD Maker FREE
2010-04-15 15:26 . 2010-04-15 15:26 ——– d—–w- c:\documents and settings\Danny\Application Data\DivX
2010-04-15 14:39 . 2004-06-21 18:46 ——– d—–w- c:\documents and settings\Danny\Application Data\Yahoo!
2010-04-15 13:42 . 2010-04-15 12:57 794624 —-a-r- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\outicon.exe
2010-04-15 13:42 . 2010-04-15 12:57 4096 —-a-r- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
2010-04-15 13:42 . 2010-04-15 12:57 27136 —-a-r- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
2010-04-15 13:42 . 2010-04-15 12:57 135168 —-a-r- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\misc.exe
2010-04-15 13:42 . 2010-04-15 12:57 12288 —-a-r- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
2010-04-15 13:42 . 2010-04-15 12:57 11264 —-a-r- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Installer\{90E00409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
2010-04-15 13:42 . 2010-04-15 13:42 ——– d—–w- c:\program files\Microsoft ActiveSync
2010-04-15 13:38 . 2007-12-13 15:53 147366 —-a-w- c:\windows\Help\hhcolreg.dat
2010-04-15 13:27 . 2010-04-15 13:27 3584 —-a-r- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Installer\{493800B7-D0CF-41D2-90DC-C6AFE888B180}\VRTCC.exe
2010-04-15 13:27 . 2010-04-15 13:27 6144 —-a-r- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Installer\{A4EDCE24-82DD-4988-B69E-08572C131043}\VRT17.exe
2010-04-14 22:33 . 2007-12-20 17:36 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\ImgBurn
2010-04-13 22:13 . 2008-08-26 15:10 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\dvdcss
2010-04-11 07:34 . 2010-03-06 16:32 439816 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\setup.exe
2010-04-09 21:40 . 2010-04-07 21:43 ——– d—–w- c:\program files\eclipse
2010-04-07 19:42 . 2007-12-13 15:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-04-05 19:05 . 2010-04-05 19:05 9781800 —-a-w- c:\documents and settings\All Users\Application Data\Roxio\Auto Update\Roxio PhotoShow\update_files\roxio_photoshow_setup_0683.exe
2010-04-04 00:23 . 2010-04-04 00:23 278120 —-a-w- c:\windows\system32\nvmccs.dll
2010-04-04 00:23 . 2010-04-04 00:23 154216 —-a-w- c:\windows\system32\nvsvc32.exe
2010-04-04 00:23 . 2010-04-04 00:23 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-04-04 00:23 . 2010-04-04 00:23 13670504 —-a-w- c:\windows\system32\nvcpl.dll
2010-04-04 00:23 . 2010-04-04 00:23 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-04-04 00:22 . 2010-04-04 00:22 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-04-03 22:55 . 2007-12-13 15:19 600680 -c–a-w- c:\windows\system32\nvudisp.exe
2010-04-03 22:55 . 2007-12-13 08:42 10232128 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-04-03 22:55 . 2007-12-13 08:42 6432128 —-a-w- c:\windows\system32\nv4_disp.dll
2010-04-02 21:54 . 2007-12-13 15:16 600680 -c–a-w- c:\windows\system32\NVUNINST.EXE
2010-03-30 15:34 . 2008-01-24 15:13 ——– d—–w- c:\documents and settings\danny.brownhelicopter\Application Data\gtk-2.0
2010-03-29 00:37 . 2010-03-29 00:37 20846064 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold.exe
2010-03-22 19:27 . 2009-12-05 05:47 79488 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-10 06:15 . 2010-04-29 07:59 420352 —-a-w- c:\windows\system32\SET1EA.tmp
2010-03-10 06:15 . 2007-07-27 12:00 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-03-07 00:33 . 2010-03-07 00:33 8405312 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-03-07 00:33 . 2010-03-07 00:33 149000 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe
2010-03-07 00:33 . 2010-03-07 00:33 10309448 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe
2010-03-07 00:33 . 2010-03-07 00:33 283280 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\carb\CarboniteSetupLiteRealPreinstaller.exe
2010-03-07 00:33 . 2010-03-07 00:33 181768 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\carb\LaunchHelper.exe
2010-03-07 00:33 . 2010-03-07 00:33 79368 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\vista.exe
2010-03-07 00:33 . 2010-03-07 00:33 64000 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll
2010-03-07 00:33 . 2010-03-07 00:33 52288 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll
2010-03-07 00:33 . 2010-03-07 00:33 50688 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll
2010-03-07 00:33 . 2010-03-07 00:33 49152 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll
2010-03-07 00:33 . 2010-03-07 00:33 118784 —-a-w- c:\documents and settings\danny.brownhelicopter\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-05-24_19.26.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-25 13:21 . 2010-05-25 13:21 16384 c:\windows\temp\Perflib_Perfdata_cb4.dat
+ 2010-05-25 13:02 . 2010-05-25 13:02 16384 c:\windows\temp\Perflib_Perfdata_474.dat
- 2007-11-13 11:31 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
+ 2007-11-13 11:31 . 2010-04-21 13:28 46080 c:\windows\system32\tzchange.exe
- 2009-02-04 16:31 . 2010-05-24 19:13 226982 c:\windows\system32\inetsrv\MetaBase.bin
+ 2009-02-04 16:31 . 2010-05-25 13:04 226982 c:\windows\system32\inetsrv\MetaBase.bin
- 2007-12-13 14:50 . 2008-04-11 19:04 691712 c:\windows\system32\inetcomm.dll
+ 2007-12-13 14:50 . 2010-01-29 15:01 691712 c:\windows\system32\inetcomm.dll
- 2008-08-14 18:53 . 2008-04-11 19:04 691712 c:\windows\system32\dllcache\inetcomm.dll
+ 2008-08-14 18:53 . 2010-01-29 15:01 691712 c:\windows\system32\dllcache\inetcomm.dll
- 2009-08-12 06:28 . 2009-07-10 13:27 1315328 c:\windows\system32\dllcache\msoe.dll
+ 2009-08-12 06:28 . 2010-01-29 15:01 1315328 c:\windows\system32\dllcache\msoe.dll
+ 2010-05-25 08:07 . 2010-04-30 16:51 32058312 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Express ClickYes"="c:\program files\Express ClickYes\ClickYes.exe" [2005-07-27 32256]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-06-15 124656]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2008-06-05 125208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SpybotSnD"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2009-01-26 5365592]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-04 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-04 13670504]

c:\documents and settings\Danny\Start Menu\Programs\Startup\
Chat.lnk - g:\vbapps\Chat.exe [2004-5-15 57344]

c:\documents and settings\danny.brownhelicopter\Start Menu\Programs\Startup\
Chat.lnk - g:\vbapps\Chat.exe [2004-5-15 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3768510774-2719637463-2565569504-1153\Scripts\Logon\0\0]
"Script"=Drives.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3768510774-2719637463-2565569504-1153\Scripts\Logon\1\0]
"Script"=logon.bat

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^APC UPS Status.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\APC UPS Status.lnk
backup=c:\windows\pss\APC UPS Status.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ImageMixer 3 SE Camera Monitor Ver.5.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ImageMixer 3 SE Camera Monitor Ver.5.lnk
backup=c:\windows\pss\ImageMixer 3 SE Camera Monitor Ver.5.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
2010-03-09 13:40 1286608 —-a-w- c:\program files\Spyware Doctor\pctsTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Chat\\Chat.exe"=
"c:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"=
"c:\\Program Files\\Corel\\DVD9\\WinDVD.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [4/29/2010 5:36 PM 218592]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/17/2007 8:09 PM 11032]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/15/2006 2:40 AM 115952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [3/4/2010 5:05 PM 102448]
S3 Commander Service;Commander Service;c:\program files\Seagull\BarTender\7.75\CmdrSrv.exe [10/27/2006 3:15 PM 1099368]
S3 EraserUtilDrv10910;EraserUtilDrv10910;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10910.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10910.sys [?]
S3 EraserUtilDrvI7;EraserUtilDrvI7;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys –> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [1/25/2007 12:31 PM 42000]
S3 PublicPreviewTurbineMessageService;Turbine Message Service - PublicPreview;c:\program files\Turbine\Turbine Download Manager - Lamannia\TurbineMessageService.exe [6/19/2009 11:34 AM 267760]
S3 PublicPreviewTurbineNetworkService;Turbine Network Service - PublicPreview;c:\program files\Turbine\Turbine Download Manager - Lamannia\TurbineNetworkService.exe [6/19/2009 11:34 AM 218608]
S4 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [4/29/2010 5:36 PM 112592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-05-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153Core.job
- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-03 08:10]

2010-05-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153UA.job
- c:\documents and settings\danny.brownhelicopter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-03 08:10]

2010-05-26 c:\windows\Tasks\Roxio PhotoShow Updater.job
- c:\program files\Roxio\PhotoShow\auto_updater_shim.exe [2009-05-06 15:38]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride =
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/mygarmin/m/GarminAxControl.CAB
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-26 14:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(940)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

- - - - - - - > 'lsass.exe'(996)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
c:\program files\Bonjour\mdnsNSP.dll
.
Completion time: 2010-05-26 14:09:50
ComboFix-quarantined-files.txt 2010-05-26 19:09
ComboFix2.txt 2010-05-25 13:16
ComboFix3.txt 2010-05-24 19:28

Pre-Run: 28,424,298,496 bytes free
Post-Run: 28,386,177,024 bytes free

- - End Of File - - 4D723196A54BF0AD00B11ABE995AF78E

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] IE 8 redirected, constant reinfection

✨ Ask AI

Ask AI