What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Redirects and missing services

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
SweetTech,

Here's the new ComboFix log as you asked for…its also with an update of the program.

ComboFix 10-06-01.01 - Jim Fanning 06/01/2010 14:10:40.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2403 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: CA Anti-Virus Plus *On-access scanning disabled* (Updated) {6B98D35F-BB76-41C0-876B-A50645ED099A}
.

((((((((((((((((((((((((( Files Created from 2010-05-01 to 2010-06-01 )))))))))))))))))))))))))))))))
.

2010-05-31 20:04 . 2010-05-31 20:04 ——– d—–w- c:\windows\system32\MpEngineStore
2010-05-31 16:55 . 2010-05-31 16:55 52432 —-a-w- c:\windows\system32\drivers\klmdb.sys
2010-05-30 19:11 . 2010-05-30 22:34 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-30 19:11 . 2010-05-30 19:13 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-05-30 04:30 . 2010-05-30 04:30 ——– d—–w- c:\documents and settings\All Users\Application Data\ATI
2010-05-30 00:04 . 2010-04-07 01:26 143360 —-a-w- c:\windows\system32\atiapfxx.exe
2010-05-30 00:03 . 2010-05-30 04:54 ——– d—–w- c:\program files\ATI
2010-05-28 02:09 . 2009-08-25 03:08 28160 —-a-w- c:\windows\system32\DfSdkBt.exe
2010-05-28 02:09 . 2010-05-28 02:09 ——– d—–w- c:\program files\Ashampoo
2010-05-27 02:59 . 2010-05-27 02:59 ——– d—–w- c:\documents and settings\Jim Fanning\Application Data\Malwarebytes
2010-05-27 02:59 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-27 02:59 . 2010-05-27 02:59 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-27 02:59 . 2010-05-27 02:59 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-27 02:59 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-05-27 02:29 . 2010-05-27 02:29 1152 —-a-w- c:\windows\system32\windrv.sys
2010-05-27 02:29 . 2010-05-27 02:32 ——– d—–w- c:\documents and settings\Jim Fanning\Application Data\GetRightToGo
2010-05-24 01:19 . 2010-06-01 19:08 ——– d—–w- c:\documents and settings\Jim Fanning\Application Data\CallingID
2010-05-24 01:19 . 2010-05-24 01:19 ——– d—–w- c:\program files\ISSThirdParty
2010-05-24 01:03 . 2010-05-24 01:15 148653048 —-a-w- c:\documents and settings\All Users\Application Data\CA\Consumer\CCube\tmp\A76D1D524150F0A541E0EAF1E3C241F7.exe
2010-05-24 00:43 . 2010-05-24 00:43 ——– d—–w- c:\windows\system32\winsflte.dl1
2010-05-24 00:43 . 2010-05-24 00:43 ——– d—–w- c:\windows\system32\winsflt.dl1
2010-05-23 17:34 . 2010-05-23 17:55 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-23 13:33 . 2010-05-23 13:33 ——– d—–w- c:\windows\system32\wbem\Repository
2010-05-23 13:32 . 2010-05-23 13:32 ——– d—–w- c:\program files\Bonjour
2010-05-23 13:32 . 2010-05-23 13:32 ——– d—–w- c:\program files\QuickTime
2010-05-23 13:31 . 2010-05-23 13:31 ——– d—–w- c:\program files\iPod
2010-05-23 03:12 . 2010-05-23 03:12 ——– d—–w- c:\program files\Common Files\iS3
2010-05-21 11:07 . 2010-05-21 11:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-05-13 04:52 . 2010-05-23 13:30 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Thunderbird
2010-05-13 04:52 . 2010-05-13 04:52 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Thunderbird
2010-05-12 18:49 . 2010-05-12 18:49 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-05-12 12:32 . 2010-05-13 01:45 ——– d—–w- c:\windows\system32\MpEngineStore(2)
2010-05-04 22:10 . 2010-05-04 22:10 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-01 18:37 . 2009-12-04 21:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PCPitstop
2010-05-30 16:15 . 2009-09-10 02:42 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-05-30 04:22 . 2009-01-22 22:38 ——– d—–w- c:\program files\ATI Technologies
2010-05-29 22:27 . 2010-03-30 21:43 ——– d—–w- c:\program files\Scanitto Pro
2010-05-29 14:19 . 2009-01-31 22:39 ——– d—–w- c:\program files\Uniblue
2010-05-29 14:17 . 2009-01-24 20:21 ——– d—–w- c:\documents and settings\Jim Fanning\Application Data\Uniblue
2010-05-29 04:57 . 2009-10-25 15:16 ——– d—–w- c:\program files\Common Files\DataViz
2010-05-28 21:43 . 2010-02-21 18:10 ——– d—–w- c:\program files\thinkTDA
2010-05-28 21:43 . 2009-09-19 11:58 ——– d—–w- c:\program files\Family Toolbar
2010-05-24 02:52 . 2010-04-04 16:40 5025192 —-a-w- c:\documents and settings\Jim Fanning\Application Data\Uniblue\RegistryBooster\_temp\ub.exe
2010-05-24 01:18 . 2010-05-24 01:17 ——– d—–w- c:\program files\CA
2010-05-24 01:18 . 2010-05-24 01:18 5845744 —-a-w- c:\windows\system32\win32cpr.dll
2010-03-30 21:41 . 2010-03-30 21:41 3181546 —-a-w- C:\ScanittoPro.zip
2010-03-20 09:46 . 2010-05-24 01:18 201968 —-a-w- c:\windows\system32\Isafprod.dll
2010-03-20 09:46 . 2010-05-24 01:18 128240 —-a-w- c:\windows\system32\Isafeif.dll
2010-03-20 09:46 . 2009-12-31 01:53 95472 —-a-w- c:\windows\system32\Vetredir.dll
2010-03-11 22:52 . 2010-03-14 14:07 200704 —-a-w- c:\documents and settings\Jim Fanning\Application Data\Mozilla\Firefox\Profiles\tgjt5pvw.default\extensions\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}\components\mhxpcom2.dll
2010-03-10 06:15 . 2002-08-29 12:00 420352 —-a-w- c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-05-31_20.17.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-01 18:37 . 2010-06-01 18:37 16384 c:\windows\temp\Perflib_Perfdata_40c.dat
+ 2004-08-04 05:59 . 2008-04-13 18:40 96512 c:\windows\system32\drivers\atapi.sys
- 2009-01-22 19:35 . 2010-05-31 20:04 96512 c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48}"= "c:\program files\Family Toolbar\tbhelper.dll" [2009-05-07 355840]

[HKEY_CLASSES_ROOT\clsid\{1c4ab6a5-595f-4e86-b15f-f93cce2bbd48}]
[HKEY_CLASSES_ROOT\URLSearchHook.MHURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{1EA6B471-CAD2-419a-9539-0586EEFE2D09}]
[HKEY_CLASSES_ROOT\URLSearchHook.MHURLSearchHook]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-03-16 1040384]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-03 5964800]
"Share-to-Web Namespace Daemon"="c:\hewlett-packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 69632]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\itunes\iTunesHelper.exe" [2009-09-21 305440]
"HotSync"="c:\program files\palmOne\Hotsync.exe" [2008-01-03 1392640]
"cctray"="c:\program files\CA\CA Internet Security Suite\casc.exe" [2010-04-09 1721680]
"capfupgrade"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2010-03-23 337136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-04-02 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]

c:\documents and settings\Jim Fanning\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2008-1-3 1392640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2009-10-25 28672]
HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2008-1-3 1392640]
officejet 6100.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-6-11 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideShutdownScripts"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 99 (0x63)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{1869181A-9F50-4FCF-8BFF-1B8588ECB85C}"= "c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\LinkAdvisor\CIDLinkAdvisor.dll" [2010-03-22 1852856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
2009-03-27 20:27 79368 —-a-w- c:\windows\system32\UmxWNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\UmxSbxExw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\C\0autocheck autochk *

[HKLM\~\startupfolder\C:^Documents and Settings^Jim Fanning^Start Menu^Programs^Startup^Launch K9.lnk]
backup=c:\windows\pss\Launch K9.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PPCtlPriv"=3 (0x3)
"IS360service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiMalware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Yahoo Messenger\\Messenger\\YahooMessenger.exe"=
"c:\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R0 KmxAMRT;KmxAMRT;c:\windows\system32\drivers\KmxAMRT.sys [12/23/2009 11:29 AM 132088]
R0 KmxStart;KmxStart;c:\windows\system32\drivers\KmxStart.sys [6/8/2009 10:02 AM 108024]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [6/23/2008 5:21 PM 150568]
R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [12/23/2009 11:29 AM 78840]
R1 KmxFile;KmxFile;c:\windows\system32\drivers\KmxFile.sys [9/2/2009 5:29 PM 53240]
R1 KmxFw;KmxFw;c:\windows\system32\drivers\KmxFw.sys [6/8/2009 10:02 AM 115704]
R2 ccSchedulerSVC;CA Common Scheduler Service;c:\program files\CA\CA Internet Security Suite\ccschedulersvc.exe [5/23/2010 8:18 PM 206160]
R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [8/14/2009 11:43 AM 145912]
R2 KmxSbx;KmxSbx;c:\windows\system32\drivers\KmxSbx.sys [9/30/2009 4:51 PM 60920]
R2 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [12/4/2009 4:53 PM 90352]
R2 UmxAgent;HIPS Event Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [8/4/2009 10:42 AM 887288]
R2 UmxCfg;HIPS Configuration Interpreter;c:\program files\CA\SharedComponents\HIPSEngine\UmxCfg.exe [7/13/2009 10:39 AM 760664]
R2 UmxPol;HIPS Policy Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxPol.exe [7/27/2009 3:40 PM 227832]
R2 WinExtManager;WinSock Extention Manager;c:\windows\system32\mdmcls32.exe [5/23/2010 8:18 PM 2347760]
R2 WinSvchostManager;WinSock Svchost Manager;c:\windows\system32\svcprs32.exe [5/23/2010 8:18 PM 1377008]
R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [9/30/2009 4:51 PM 239608]
R3 NmPar;Unusable Parallel Port;c:\windows\system32\drivers\NmPar.sys [12/24/2008 5:40 AM 80256]
R3 nmserial;PCI Serial Port;c:\windows\system32\drivers\NmSerial.sys [12/16/2008 6:10 AM 70016]
S2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [11/13/2008 2:43 PM 204800]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [5/27/2010 9:09 PM 406016]
S3 KmxAMVet;KmxAMVet;c:\windows\system32\drivers\KmxAMVet.sys [3/27/2009 3:27 PM 598656]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [5/2/2009 5:37 PM 18176]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [5/2/2009 5:37 PM 7680]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [5/2/2009 5:37 PM 42112]
.
Contents of the 'Scheduled Tasks' folder

2010-05-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2010-05-31 c:\windows\Tasks\FRU Task 2002-06-11 17:56ewlett-Packard2002-06-11 17:56p psc 2200 series0873DBB30DAF953F7DCEA1BDCC4F78BFDB130745252256089.job
- c:\hewlett-packard\Digital Imaging\Bin\hpqfrucl.exe [2009-01-31 15:56]

2009-12-07 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4252259923.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 22:56]

2009-08-01 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2009-01-07 22:57]

2010-06-01 c:\windows\Tasks\User_Feed_Synchronization-{88C3313F-B8C1-4AE3-96F1-7DB5582ADBDB}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://search.myheritage.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
LSP: c:\windows\system32\winsflt.dll
LSP: c:\windows\system32\VetRedir.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
Handler: callingid - {086D03BA-57AC-4C8E-A33D-0BAABF742411} - c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\Toolbar\CallingIDToolbar.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {A084A130-28AE-4B32-B51A-1C8CE164BC88} - hxxp://www.convergysworkathome.com/AppHardT.CAB
FF - ProfilePath - c:\documents and settings\Jim Fanning\Application Data\Mozilla\Firefox\Profiles\tgjt5pvw.default\
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Jim Fanning\Application Data\Mozilla\Firefox\Profiles\tgjt5pvw.default\extensions\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}\components\mhxpcom2.dll
FF - component: c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\LinkAdvisor\Firefox\components\CallingIDLinkAdvisorGecko.dll
FF - component: c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\Toolbar\Firefox\components\CIDDomFx3.dll
FF - component: c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\Toolbar\Firefox\components\CIDDomFx35.dll
FF - component: c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\Toolbar\Firefox\components\CIDDomFx36.dll
FF - plugin: c:\documents and settings\Jim Fanning\Application Data\Mozilla\Firefox\Profiles\tgjt5pvw.default\extensions\[removed]\plugins\npImgCtl.dll
FF - plugin: c:\itunes\Mozilla Plugins\npitunes.dll
FF - plugin: c:\mozilla firefox\plugins\np-mswmp.dll
FF - plugin: c:\picasa3\npPicasa3.dll
FF - plugin: c:\progra~1\palmOne\PACKAG~1\NPInstal.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autoFill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
c:\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-01 14:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\atapi]
"ImagePath"="system32\drivers\tsk3F.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,50,f6,3b,25,ca,ca,c2,43,ae,03,41,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,50,f6,3b,25,ca,ca,c2,43,ae,03,41,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\UmxWnp.Dll

- - - - - - - > 'lsass.exe'(984)
c:\windows\system32\relog_ap.dll
c:\windows\system32\winsflt.dll

- - - - - - - > 'explorer.exe'(5808)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-06-01 14:15:33
ComboFix-quarantined-files.txt 2010-06-01 19:15
ComboFix2.txt 2010-06-01 18:42
ComboFix3.txt 2010-05-31 20:21

Pre-Run: 462,759,280,640 bytes free
Post-Run: 462,737,698,816 bytes free

- - End Of File - - 540B22F4FABBE2C5851BEFF03558A409


Will be awaiting the next step…..thanks for your patience on this matter. I certainly do appreciate it.

Jim :)
Post #17
Hello, Okay. Could you please proceed with running the MalwareBytes' Anti-Malware scan, the ESET Online Scanner, and then provide me with a fresh OTL Log? Thanks, SweetTech.
Post #18
SweetTech, I'm having a bit of an issue here. I've run MBAM and it was ok, however I've tried to run ESET 2x now and it comes to a complete halt after the progress bar reaches 10% of the HDD capacity. It seems the file it freezes on is some mail I have filed in a folder in Thunderbird. The first time it froze for 50 mins before I stopped it. The second time it was over 2 hours when I stopped it. Somehow I think there's something else going on. Both times it says it found 3 threats - Win32/AutoRun.YM worm (two instances) and Win32/Oflicla.EU trojan. How should I proceed at this point? Will ESET take MORE than 2 hours to complete? If not, I need some guidance on the next step. Unfortunately, I don't have a lot of time over the next 2 days to spend with this due to my work schedule. Thanks, Jim
Post #19
We can try a different Online Scanner. Please make note of anything it finds (location of file as well as infection name) if possible.

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Post #20
SweetTech, OK…..(sigh) The Kaspersky Scan took a little over 8 hrs to complete! I didn't realize it was going to be that long…..I'm including both the KasScan and a new MBAM scan with this note. Let me know what we're doing next! ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Thursday, June 3, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Wednesday, June 02, 2010 18:33:27 Records in database: 4196936 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Objects scanned: 230080 Threats found: 18 Infected objects found: 49 Suspicious objects found: 19 Scan duration: 08:02:22 File name / Threat / Threats count C:\Documents and Settings\Jim Fanning\Application Data\K9\Emails\Spam\6A3DB9B9.kml Infected: Worm.Win32.Mabezat.h 1 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\303xm7y8.default\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Bankfraud.sv 1 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\303xm7y8.default\Mail\mail.odyssy.net\Inbox Infected: Trojan.Win32.Agent.anae 1 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\303xm7y8.default\Mail\mail.odyssy.net\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 2 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\Tasman27\303xm7y8.default\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Bankfraud.sv 1 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\Tasman27\303xm7y8.default\Mail\mail.odyssy.net\Inbox Infected: Trojan.Win32.Agent.anae 1 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\Tasman27\303xm7y8.default\Mail\mail.odyssy.net\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 2 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\Tasman27\Mail\mail.comcast.net\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 2 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\Tasman27\Mail\mail.odyssy.net\Inbox Infected: Packed.Win32.Krap.an 1 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\Tasman27\Mail\mail.odyssy.net\Inbox Infected: Worm.Win32.Mabezat.h 1 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\Tasman27\Mail\mail.odyssy.net\Junk Infected: Packed.Win32.Krap.an 1 C:\Documents and Settings\Jim Fanning\Application Data\Thunderbird\Profiles\Tasman27\Mail\mail.odyssy.net\Junk Infected: Worm.Win32.Mabezat.h 1 D:\Documents and Settings\Jim Fanning\Application Data\Mozilla\Profiles\Tasman27\303xm7y8.default\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Bankfraud.sv 1 D:\Documents and Settings\Jim Fanning\Application Data\Mozilla\Profiles\Tasman27\303xm7y8.default\Mail\mail.odyssy.net\Inbox Infected: Trojan.Win32.Agent.anae 1 D:\Documents and Settings\Jim Fanning\Application Data\Mozilla\Profiles\Tasman27\303xm7y8.default\Mail\mail.odyssy.net\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 2 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Email-Worm.Win32.Mimail.txt 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Bayfraud.g 7 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Bayfraud.em 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Citifraud.bm 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Paylap.by 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Dropper.VBS.Zerolin 4 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Downloader.JS.gen 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Exploit.HTML.Iframe.FileDownload 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Citifraud.ay 2 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Sunfraud.aj 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Bayfraud.ac 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Bayfraud.ks 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Junk Infected: Trojan-Dropper.VBS.Zerolin 4 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Junk Infected: Trojan-Spy.HTML.Bayfraud.g 3 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Junk Infected: Trojan-Downloader.JS.gen 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Junk Infected: Exploit.HTML.Iframe.FileDownload 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Junk Infected: Trojan-Spy.HTML.Citifraud.ay 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Mozilla\Profiles\Jim\rl508tcf.slt\Mail\mail.odyssy.net\Sent Infected: Trojan-Spy.HTML.Citifraud.bm 2 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Thunderbird\Profiles\303xm7y8.default\Mail\mail.comcast.net\Junk Infected: Trojan-Spy.HTML.Bankfraud.sv 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Thunderbird\Profiles\303xm7y8.default\Mail\mail.odyssy.net\Inbox Infected: Trojan-Spy.HTML.Bankfraud.sv 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Thunderbird\Profiles\303xm7y8.default\Mail\mail.odyssy.net\Inbox Infected: Trojan.Win32.Agent.anae 1 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Thunderbird\Profiles\303xm7y8.default\Mail\mail.odyssy.net\Inbox Suspicious: Trojan-Spy.HTML.Fraud.gen 2 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Thunderbird\Profiles\303xm7y8.default\Mail\mail.odyssy.net\Junk Suspicious: Trojan-Spy.HTML.Fraud.gen 6 D:\Documents and Settings\Jim Fanning.DAD\Application Data\Thunderbird\Profiles\303xm7y8.default\Mail\mail.odyssy.net\Spam Suspicious: Trojan-Spy.HTML.Fraud.gen 2 D:\MagicDVDRipper\MagicDVDRipper.exe Infected: Trojan.Win32.Cosmu.xln 1 Selected area has been scanned. ******************************************************************************** ********************************************************************************* ******************************** Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4168 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/3/2010 5:56:04 PM mbam-log-2010-06-03 (17-56-04).txt Scan type: Quick scan Objects scanned: 125438 Time elapsed: 3 minute(s), 30 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) I'll check for a response later. Thanks, Jim
Post #21
Hello,

How are things running?

Infected emails

What the Kaspersky Online Scanner scan found are stored emails in your Inbox, Junk, and Sent box, unfortunately I cannot tell which one or ones it is.
What I need you to do is go through all of your emails in your Inbox, Junk, and Sent box, and any other saved boxes you may have.
Please delete any that you don't want/need/recognize. Odds are that the infected email will have an attachment or at least a link.
Therefore, do not open any attachments or click on any links.



NEXT:



OTL Fix

We need to run an OTL Fix
  • Please reopen [external image: Posted Image] on your desktop.
  • Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

    :Services
:Files
D:\MagicDVDRipper\MagicDVDRipper.exe
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]
  • Push [external image: Posted Image]
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click [external image: Posted Image].
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



OTL Custom Scan

We need to run an OTL Custom Scan
  • Please reopen [external image: Posted Image] on your desktop.
  • Copy and Paste the following bolded text into the [external image: Posted Image] textbox.


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\drivers\*.sys /180

  • Push [external image: Posted Image]
  • A report will open. Copy and Paste that report in your next reply.


NEXT:



Security Check
Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Post #22
SweetTech, Ran the OTL fix with the fix script you have and when it finished it rebooted into the loop again…..had to shut it down. What do we need to do to get it to stop doing this? I won't be able to do anything until after 4pm CDT on Friday. I'm on the laptop for now….not even turning the PC on until I hear from you. Frustrated …… Jim
Post #23
Hello,

What do we need to do to get it to stop doing this?


Try the instructions below to see if that will allow you to boot up properly.

Last Known Good Configuration

Start the computer by using the last known good configuration. To start the computer by using the last known good configuration, follow these steps:

  • Restart your computer.
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll to Last Known Good Configuration
  • Then press the Enter Key on your Keyboard
  • Go into your usual account
Post #24
I'm familiar with the procedure, but it didn't work. The computer still recycles in the boot-up mode with a flash of a BSOD.
Post #25
Hello,

Try doing the following again:

We need to replace the file in Recovery Console:
  • Restart your computer
  • Before Windows loads, you will be prompted to choose which Operating System to start
  • Use the up and down arrow key to select Microsoft Windows Recovery Console
  • You must enter which Windows installation to log onto. Type 1 and press enter.
  • At the C:\Windows prompt, type the following bolded text, and press Enter:
    set allowallpaths = true
  • At the next prompt type the following bolded text, and press Enter:

    cd system32\drivers
  • At the next prompt type the following bolded text, and press Enter:

    copy C:\Qoobox\Quarantine\c\windows\system32\drivers\tsk3F.tmp.vir tsk3F.tmp
  • The command should then show 1 file(s) copied.
  • At the next prompt type the following bolded text, and press Enter:

    exit
Windows will now begin loading. Let me know if the loop continues.
Post #27
Hello,

Registry Export
I need some more information on a key in your registry. Please do the following:
Press Start => Run, Copy/Paste the command below into the run dialog box and press Ok:

reg export "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\atapi" "%userprofile%\desktop\look.txt"

You should see a new file on your Desktop named look.txt. Please double click on the file to open it, and then post the contents of look.txt in this thread.
Post #29
Go to Start > Run > cmd.exe

Copy/Paste the following bolded text into the command prompt:

reg export "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\atapi" "%userprofile%\desktop\look.txt"

See if that works.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI