What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Redirects and missing services

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46 last edited
ComboFix Script
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::
Registry::
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\atapi]
"ImagePath"=hex(2):73,79,73,74,65,6d,33,32,5c,44,52,49,56,45, \
52,53,5c,61,74,61,70,69,2e,73,79,73,00

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #48
Did you see my instructions to hold up on running the CF script? or did you go ahead and run it? The board software isn't playing nice with me today, and is changing the output of the script.
Post #51
ok…here's the new ComboFix scan results you asked for. Will await further instructions from you on what other scans, if any, need to be executed.

ComboFix 10-06-03.01 - Jim Fanning 06/05/2010 10:43:19.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2415 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jim Fanning\Desktop\CFScript.txt
AV: CA Anti-Virus Plus *On-access scanning disabled* (Updated) {6B98D35F-BB76-41C0-876B-A50645ED099A}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\userinit.exe

.
((((((((((((((((((((((((( Files Created from 2010-05-05 to 2010-06-05 )))))))))))))))))))))))))))))))
.

2010-06-04 02:05 . 2010-06-04 02:05 ——– d—–w- C:\_OTL
2010-06-01 20:23 . 2010-06-01 20:23 ——– d—–w- c:\program files\ESET
2010-05-31 20:04 . 2010-05-31 20:04 ——– d—–w- c:\windows\system32\MpEngineStore
2010-05-31 16:55 . 2010-05-31 16:55 52432 —-a-w- c:\windows\system32\drivers\klmdb.sys
2010-05-30 19:11 . 2010-05-30 22:34 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-30 19:11 . 2010-05-30 19:13 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-05-30 04:30 . 2010-05-30 04:30 ——– d—–w- c:\documents and settings\All Users\Application Data\ATI
2010-05-30 00:04 . 2010-04-07 01:26 143360 —-a-w- c:\windows\system32\atiapfxx.exe
2010-05-30 00:03 . 2010-05-30 04:54 ——– d—–w- c:\program files\ATI
2010-05-28 02:09 . 2009-08-25 03:08 28160 —-a-w- c:\windows\system32\DfSdkBt.exe
2010-05-28 02:09 . 2010-05-28 02:09 ——– d—–w- c:\program files\Ashampoo
2010-05-27 02:59 . 2010-05-27 02:59 ——– d—–w- c:\documents and settings\Jim Fanning\Application Data\Malwarebytes
2010-05-27 02:59 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-27 02:59 . 2010-05-27 02:59 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-27 02:59 . 2010-05-27 02:59 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-27 02:59 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-05-27 02:29 . 2010-05-27 02:29 1152 —-a-w- c:\windows\system32\windrv.sys
2010-05-27 02:29 . 2010-05-27 02:32 ——– d—–w- c:\documents and settings\Jim Fanning\Application Data\GetRightToGo
2010-05-24 01:19 . 2010-06-05 15:40 ——– d—–w- c:\documents and settings\Jim Fanning\Application Data\CallingID
2010-05-24 01:19 . 2010-05-24 01:19 ——– d—–w- c:\program files\ISSThirdParty
2010-05-24 01:03 . 2010-05-24 01:15 148653048 —-a-w- c:\documents and settings\All Users\Application Data\CA\Consumer\CCube\tmp\A76D1D524150F0A541E0EAF1E3C241F7.exe
2010-05-24 00:43 . 2010-05-24 00:43 ——– d—–w- c:\windows\system32\winsflte.dl1
2010-05-24 00:43 . 2010-05-24 00:43 ——– d—–w- c:\windows\system32\winsflt.dl1
2010-05-23 17:34 . 2010-05-23 17:55 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-23 13:33 . 2010-05-23 13:33 ——– d—–w- c:\windows\system32\wbem\Repository
2010-05-23 13:32 . 2010-05-23 13:32 ——– d—–w- c:\program files\Bonjour
2010-05-23 13:32 . 2010-05-23 13:32 ——– d—–w- c:\program files\QuickTime
2010-05-23 13:31 . 2010-05-23 13:31 ——– d—–w- c:\program files\iPod
2010-05-23 03:12 . 2010-05-23 03:12 ——– d—–w- c:\program files\Common Files\iS3
2010-05-21 11:07 . 2010-05-21 11:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-05-13 04:52 . 2010-05-23 13:30 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Thunderbird
2010-05-13 04:52 . 2010-05-13 04:52 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Thunderbird
2010-05-12 18:49 . 2010-05-12 18:49 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-05-12 12:32 . 2010-05-13 01:45 ——– d—–w- c:\windows\system32\MpEngineStore(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-05 15:48 . 2009-12-04 21:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PCPitstop
2010-06-05 15:47 . 2009-03-20 00:12 ——– d—–w- c:\program files\Microsoft Silverlight
2010-05-31 16:55 . 2010-05-31 16:55 96512 —-a-w- c:\windows\system32\drivers\tsk3F.tmp
2010-05-30 16:15 . 2009-09-10 02:42 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-05-30 04:22 . 2009-01-22 22:38 ——– d—–w- c:\program files\ATI Technologies
2010-05-29 22:27 . 2010-03-30 21:43 ——– d—–w- c:\program files\Scanitto Pro
2010-05-29 14:19 . 2009-01-31 22:39 ——– d—–w- c:\program files\Uniblue
2010-05-29 14:17 . 2009-01-24 20:21 ——– d—–w- c:\documents and settings\Jim Fanning\Application Data\Uniblue
2010-05-29 04:57 . 2009-10-25 15:16 ——– d—–w- c:\program files\Common Files\DataViz
2010-05-28 21:43 . 2010-02-21 18:10 ——– d—–w- c:\program files\thinkTDA
2010-05-28 21:43 . 2009-09-19 11:58 ——– d—–w- c:\program files\Family Toolbar
2010-05-24 02:52 . 2010-04-04 16:40 5025192 —-a-w- c:\documents and settings\Jim Fanning\Application Data\Uniblue\RegistryBooster\_temp\ub.exe
2010-05-24 01:18 . 2010-05-24 01:17 ——– d—–w- c:\program files\CA
2010-05-24 01:18 . 2010-05-24 01:18 5845744 —-a-w- c:\windows\system32\win32cpr.dll
2010-05-24 01:18 . 2010-05-24 01:18 1872624 —-a-w- c:\windows\system32\winsflt.dll
2010-03-30 21:41 . 2010-03-30 21:41 3181546 —-a-w- C:\ScanittoPro.zip
2010-03-20 09:46 . 2010-05-24 01:18 201968 —-a-w- c:\windows\system32\Isafprod.dll
2010-03-20 09:46 . 2010-05-24 01:18 128240 —-a-w- c:\windows\system32\Isafeif.dll
2010-03-20 09:46 . 2009-12-31 01:53 95472 —-a-w- c:\windows\system32\Vetredir.dll
2010-03-11 22:52 . 2010-03-14 14:07 200704 —-a-w- c:\documents and settings\Jim Fanning\Application Data\Mozilla\Firefox\Profiles\tgjt5pvw.default\extensions\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}\components\mhxpcom2.dll
2010-03-10 06:15 . 2002-08-29 12:00 420352 —-a-w- c:\windows\system32\vbscript.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-05-31_20.17.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-05 15:48 . 2010-06-05 15:48 16384 c:\windows\temp\Perflib_Perfdata_600.dat
+ 2004-08-04 05:59 . 2008-04-13 18:40 96512 c:\windows\system32\drivers\atapi.sys
- 2009-01-22 19:35 . 2010-05-31 20:04 96512 c:\windows\system32\drivers\atapi.sys
+ 2010-06-04 21:56 . 2010-06-04 21:56 49152 c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2010-06-04 21:56 . 2010-06-04 21:56 20242432 c:\windows\Installer\22ba9.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48}"= "c:\program files\Family Toolbar\tbhelper.dll" [2009-05-07 355840]

[HKEY_CLASSES_ROOT\clsid\{1c4ab6a5-595f-4e86-b15f-f93cce2bbd48}]
[HKEY_CLASSES_ROOT\URLSearchHook.MHURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{1EA6B471-CAD2-419a-9539-0586EEFE2D09}]
[HKEY_CLASSES_ROOT\URLSearchHook.MHURLSearchHook]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-03-16 1040384]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-03 5964800]
"Share-to-Web Namespace Daemon"="c:\hewlett-packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 69632]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\itunes\iTunesHelper.exe" [2009-09-21 305440]
"HotSync"="c:\program files\palmOne\Hotsync.exe" [2008-01-03 1392640]
"cctray"="c:\program files\CA\CA Internet Security Suite\casc.exe" [2010-04-09 1721680]
"capfupgrade"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2010-03-23 337136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-04-02 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]

c:\documents and settings\Jim Fanning\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2008-1-3 1392640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2009-10-25 28672]
HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2008-1-3 1392640]
officejet 6100.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-6-11 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideShutdownScripts"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 99 (0x63)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{1869181A-9F50-4FCF-8BFF-1B8588ECB85C}"= "c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\LinkAdvisor\CIDLinkAdvisor.dll" [2010-03-22 1852856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
2009-03-27 20:27 79368 —-a-w- c:\windows\system32\UmxWNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\UmxSbxExw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\C\0autocheck autochk *

[HKLM\~\startupfolder\C:^Documents and Settings^Jim Fanning^Start Menu^Programs^Startup^Launch K9.lnk]
backup=c:\windows\pss\Launch K9.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PPCtlPriv"=3 (0x3)
"IS360service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiMalware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Yahoo Messenger\\Messenger\\YahooMessenger.exe"=
"c:\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R0 KmxAMRT;KmxAMRT;c:\windows\system32\drivers\KmxAMRT.sys [12/23/2009 11:29 AM 132088]
R0 KmxStart;KmxStart;c:\windows\system32\drivers\KmxStart.sys [6/8/2009 10:02 AM 108024]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [6/23/2008 5:21 PM 150568]
R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [12/23/2009 11:29 AM 78840]
R1 KmxFile;KmxFile;c:\windows\system32\drivers\KmxFile.sys [9/2/2009 5:29 PM 53240]
R1 KmxFw;KmxFw;c:\windows\system32\drivers\KmxFw.sys [6/8/2009 10:02 AM 115704]
R2 ccSchedulerSVC;CA Common Scheduler Service;c:\program files\CA\CA Internet Security Suite\ccschedulersvc.exe [5/23/2010 8:18 PM 206160]
R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [8/14/2009 11:43 AM 145912]
R2 KmxSbx;KmxSbx;c:\windows\system32\drivers\KmxSbx.sys [9/30/2009 4:51 PM 60920]
R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [11/13/2008 2:43 PM 204800]
R2 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [12/4/2009 4:53 PM 90352]
R2 UmxAgent;HIPS Event Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [8/4/2009 10:42 AM 887288]
R2 UmxCfg;HIPS Configuration Interpreter;c:\program files\CA\SharedComponents\HIPSEngine\UmxCfg.exe [7/13/2009 10:39 AM 760664]
R2 UmxPol;HIPS Policy Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxPol.exe [7/27/2009 3:40 PM 227832]
R2 WinExtManager;WinSock Extention Manager;c:\windows\system32\mdmcls32.exe [5/23/2010 8:18 PM 2347760]
R2 WinSvchostManager;WinSock Svchost Manager;c:\windows\system32\svcprs32.exe [5/23/2010 8:18 PM 1377008]
R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [9/30/2009 4:51 PM 239608]
R3 NmPar;Unusable Parallel Port;c:\windows\system32\drivers\NmPar.sys [12/24/2008 5:40 AM 80256]
R3 nmserial;PCI Serial Port;c:\windows\system32\drivers\NmSerial.sys [12/16/2008 6:10 AM 70016]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [5/27/2010 9:09 PM 406016]
S3 KmxAMVet;KmxAMVet;c:\windows\system32\drivers\KmxAMVet.sys [3/27/2009 3:27 PM 598656]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [5/2/2009 5:37 PM 18176]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [5/2/2009 5:37 PM 7680]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [5/2/2009 5:37 PM 42112]
.
Contents of the 'Scheduled Tasks' folder

2010-05-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2010-06-03 c:\windows\Tasks\FRU Task 2002-06-11 17:56ewlett-Packard2002-06-11 17:56p psc 2200 series0873DBB30DAF953F7DCEA1BDCC4F78BFDB130745252256089.job
- c:\hewlett-packard\Digital Imaging\Bin\hpqfrucl.exe [2009-01-31 15:56]

2009-12-07 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4252259923.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 22:56]

2009-08-01 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2009-01-07 22:57]

2010-06-05 c:\windows\Tasks\User_Feed_Synchronization-{88C3313F-B8C1-4AE3-96F1-7DB5582ADBDB}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://search.myheritage.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
LSP: c:\windows\system32\winsflt.dll
LSP: c:\windows\system32\VetRedir.dll
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
Handler: callingid - {086D03BA-57AC-4C8E-A33D-0BAABF742411} - c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\Toolbar\CallingIDToolbar.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {A084A130-28AE-4B32-B51A-1C8CE164BC88} - hxxp://www.convergysworkathome.com/AppHardT.CAB
FF - ProfilePath - c:\documents and settings\Jim Fanning\Application Data\Mozilla\Firefox\Profiles\tgjt5pvw.default\
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Jim Fanning\Application Data\Mozilla\Firefox\Profiles\tgjt5pvw.default\extensions\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}\components\mhxpcom2.dll
FF - component: c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\LinkAdvisor\Firefox\components\CallingIDLinkAdvisorGecko.dll
FF - component: c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\Toolbar\Firefox\components\CIDDomFx3.dll
FF - component: c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\Toolbar\Firefox\components\CIDDomFx35.dll
FF - component: c:\program files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.02010687\Toolbar\Firefox\components\CIDDomFx36.dll
FF - plugin: c:\documents and settings\Jim Fanning\Application Data\Mozilla\Firefox\Profiles\tgjt5pvw.default\extensions\[removed]\plugins\npImgCtl.dll
FF - plugin: c:\itunes\Mozilla Plugins\npitunes.dll
FF - plugin: c:\mozilla firefox\plugins\np-mswmp.dll
FF - plugin: c:\picasa3\npPicasa3.dll
FF - plugin: c:\progra~1\palmOne\PACKAG~1\NPInstal.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autoFill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
c:\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-05 10:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,50,f6,3b,25,ca,ca,c2,43,ae,03,41,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,50,f6,3b,25,ca,ca,c2,43,ae,03,41,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\UmxWnp.Dll

- - - - - - - > 'lsass.exe'(984)
c:\windows\system32\relog_ap.dll
c:\windows\system32\winsflt.dll

- - - - - - - > 'explorer.exe'(5864)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
c:\program files\Common Files\Maxtor\Schedule2\schedul2.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\windows\system32\java.exe
c:\hewlett-packard\HP Share-to-Web\hpgs2wnf.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\windows\system32\msiexec.exe
c:\program files\CA\CA Internet Security Suite\ccprovsp.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-06-05 10:52:52 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-05 15:52
ComboFix2.txt 2010-06-01 19:15
ComboFix3.txt 2010-06-01 18:42
ComboFix4.txt 2010-05-31 20:21

Pre-Run: 462,613,749,760 bytes free
Post-Run: 462,583,345,152 bytes free

- - End Of File - - DCCBBE498FFA1A9E5899E42EB8DAF3D0


Machine seems to be working fine but then it has everytime we have it booted.

Taz :)
Post #52
Hello,

Please Set Your System to Show Hidden Files
  • Go to Start -> My Computer (Or click the My Computer icon on your desktop)
  • Go to the Tools Menu -> Folder Options.
  • Select the "View" tab.
  • Where you see [external image: Posted Image], click the [external image: Posted Image] radio button.
  • Uncheck "Hide extensions for known file types"
  • Uncheck "Hide protected operating system files"
  • Click Ok.
  • Exit/Close My Computer.

VirusTotal File Scan
Please go to: VirusTotal
  • [external image: Posted Image]
  • Click the Browse button and search for the following file: c:\windows\system32\userinit.exe
  • Click Open
  • Then click Send File
  • Please be patient while the file is scanned.
  • Once the scan results appear, please provide them in your next reply.
If it says already scanned – click "reanalyze now"

Please post the results in your next reply
Post #53
OK… Here's what it came up with: MD5: a93aee1928a9d7ce3e16d24ec7380f89 First received: 2009.02.12 02:28:35 UTC Date: 2010.06.03 18:01:33 UTC [+1D] Results: 0/40 Permalink: analisis/944cd2135e171af338352568aa7fe1b8004733a4281395ad6723e0cf43d5f53f-1275588093
Post #54
Ok SweetTech I have a function to attend so I'll be gone for the next 6-7 hours. If you post anything I'll get to it when I return. Thanks for all your help, its very much appreciated! Taz
Post #55
Okay. Your logs are looking clean, I just need to look into a few things, and maybe grab a few files from you. I'll get back to you with new instructions sometime today.
Post #56
Hello,

Your logs are clean.

If you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.



NEXT:



Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall



NEXT:



OTL Clean-Up
Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.



NEXT:



All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.
  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them     then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE
  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here
    • If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
      • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.
Post #57
Hi SweetTech!

Well, you did it! I believe I'm cured! As for your recommended procedures, here we go:

  • Housekeeping completed. Uninstalled ComboFix per your instructions.
  • Executed OTL Cleanup and rebooted
  • All diagnostic programs and their files have been deleted (except for the MBAM program)
  • My CA Security Suite is enabled but I'm having an issue with the firewall being disabled. I have the XP firewall on until this is fixed.
  • Passwords will be changed as I use them
  • Windows updates have been done religiously in the past and will be continued
  • I will download and install Spyblaster after I finish this.
  • I'm running Spybot S&D now, do I also need Spyware Guard? If not, which is better?
  • I don't use IE, rather Firefox. I keep the latest version updated. NoScript has been installed.
  • Will keep ATF installed
  • MVPS has been installed
  • WOT - Do I need this? CA has this feature in its Suite.
  • ERUNT has been installed
  • I regularly run CC Cleaner, Advanced System Care (free ver), and Uniblue Registry Booster. What is your opinion of these programs? Should I continue to use these or not? CA scans every day. I use the others once per week.

Once again, thank you for being so patient with this issue and sending me very prompt directions to bring my PC back to good health. I will certainly recommend both you and this site to my friends and family who may be in need of your services in the future!

Thanks and good luck…..(but really, ANTARCTICA? :) )

Taz
Post #58 last edited
Hi SweetTech!

Well, you did it! I believe I'm cured! As for your recommended procedures, here we go:

  • Housekeeping completed. Uninstalled ComboFix per your instructions.
  • Executed OTL Cleanup and rebooted
  • All diagnostic programs and their files have been deleted (except for the MBAM program)
  • My CA Security Suite is enabled but I'm having an issue with the firewall being disabled. I have the XP firewall on until this is fixed.
  • Passwords will be changed as I use them
  • Windows updates have been done religiously in the past and will be continued
  • I will download and install Spyblaster after I finish this.
  • I'm running Spybot S&D now, do I also need Spyware Guard? If not, which is better?
  • I don't use IE, rather Firefox. I keep the latest version updated. NoScript has been installed.
  • Will keep ATF installed
  • MVPS has been installed
  • WOT - Do I need this? CA has this feature in its Suite.
  • ERUNT has been installed
  • I regularly run CC Cleaner, Advanced System Care (free ver), and Uniblue Registry Booster. What is your opinion of these programs? Should I continue to use these or not? CA scans every day. I use the others once per week.

Once again, thank you for being so patient with this issue and sending me very prompt directions to bring my PC back to good health. I will certainly recommend both you and this site to my friends and family who may be in need of your services in the future!

Thanks and good luck…..(but really, ANTARCTICA? :) )

Taz

Oops…hit the button twice! Sorry………
Post #59 last edited
Question: I'm running Spybot S&D now, do I also need Spyware Guard? If not, which is better?
Answer: No, I don't think you need both. I think Spyware Guard is better than Spybot S&D.

Question: WOT - Do I need this? CA has this feature in its Suite.
Answer: If this is a feature that comes with CA then No you don't.

Question: I regularly run CC Cleaner, Advanced System Care (free ver), and Uniblue Registry Booster. What is your opinion of these programs? Should I continue to use these or not?
Answer: I have no problems with CCleaner. I use it everyday. I'm not really big on registry cleaners. Removing the wrong thing in the registry can cause your computer to not boot. Also I've never really heard of anyone say that after using a registry cleaner they have noticed an increase in the performance of their computer.

but really, ANTARCTICA?

The penguins and I get along very well.
Post #60
Ok then…..:) I'll take your suggestions to the bank! I'd love to retire to Antarctica….get me away from the crazies here! I could get along with penguins…..they're shorter than I am! LOL Thanks for all your help…..I REALLY appreciate it. Taz

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI