What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] zedo virus Combo fix and Hijack this file included

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have a virus which redirects google and slows firefox and computer. Computer will freeze and I have to shut it down. I followed instructions on another forum with LDTate and downloaded and used ATF Cleaner and then Combo Fix

Would someone please help me finish this process by looking at these files and tell me what to do next. Thanks
COMBO FIX FILE

ComboFix 10-06-01.01 - a 06/01/2010 15:48:05.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3071.2684 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\a\Application Data\inst.exe
c:\documents and settings\HelpAssistant.PAYMAN\Application Data\inst.exe

.
original MBR restored successfully !
.
((((((((((((((((((((((((( Files Created from 2010-05-01 to 2010-06-01 )))))))))))))))))))))))))))))))
.

2010-06-01 21:05 . 2010-04-29 22:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-01 21:05 . 2010-04-29 22:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-06-01 21:05 . 2010-06-01 21:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-01 20:50 . 2009-10-08 18:31 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-06-01 20:50 . 2009-10-08 18:31 767952 —-a-w- c:\windows\BDTSupport.dll
2010-06-01 20:50 . 2009-10-02 21:19 1152470 —-a-w- c:\windows\UDB.zip
2010-06-01 20:50 . 2008-11-26 19:08 131 —-a-w- c:\windows\IDB.zip
2010-06-01 20:50 . 2009-10-08 18:31 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-06-01 20:50 . 2009-10-08 18:31 1636304 —-a-w- c:\windows\PCTBDCore.dll
2010-06-01 20:50 . 2009-09-24 15:55 229304 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-06-01 20:50 . 2009-10-06 23:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-06-01 20:50 . 2009-09-23 23:10 207280 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-06-01 20:49 . 2009-09-03 16:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-06-01 20:49 . 2010-06-01 20:51 ——– d—–w- c:\program files\Common Files\PC Tools
2010-06-01 20:49 . 2010-06-01 20:52 ——– d—–w- c:\program files\Spyware Doctor
2010-06-01 20:49 . 2010-06-01 20:49 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-06-01 20:49 . 2010-06-01 20:49 ——– d—–w- c:\documents and settings\a\Application Data\PC Tools
2010-06-01 19:25 . 2010-05-06 20:39 164048 —-a-w- c:\windows\system32\drivers\aswSP.sys
2010-06-01 19:25 . 2010-05-06 20:33 19024 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-06-01 19:25 . 2010-05-06 20:34 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2010-06-01 19:25 . 2010-05-06 20:39 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2010-06-01 19:25 . 2010-05-06 20:33 100432 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2010-06-01 19:25 . 2010-05-06 20:33 94800 —-a-w- c:\windows\system32\drivers\aswmon.sys
2010-06-01 19:25 . 2010-05-06 20:33 28880 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2010-06-01 19:25 . 2010-05-06 20:59 38848 —-a-w- c:\windows\system32\avastSS.scr
2010-06-01 19:25 . 2010-05-06 20:59 165032 —-a-w- c:\windows\system32\aswBoot.exe
2010-06-01 19:25 . 2010-06-01 19:25 ——– d—–w- c:\program files\Alwil Software
2010-06-01 19:25 . 2010-06-01 19:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-06-01 18:31 . 2010-06-01 18:31 ——– d—–w- c:\documents and settings\a\Local Settings\Application Data\Threat Expert
2010-06-01 18:30 . 2010-06-01 18:30 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\PC Tools
2010-06-01 17:17 . 2010-06-01 17:17 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Malwarebytes
2010-06-01 16:39 . 2010-06-01 16:39 ——– d—–w- c:\documents and settings\a\Application Data\Malwarebytes
2010-06-01 16:39 . 2010-06-01 16:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-01 16:00 . 2010-06-01 17:17 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\AVG7
2010-06-01 15:56 . 2010-06-01 15:56 ——– d—–w- c:\documents and settings\LocalService\Application Data\AVG7
2010-06-01 15:50 . 2010-06-01 16:27 ——– d—–w- c:\documents and settings\a\Application Data\AVG7
2010-06-01 15:50 . 2010-06-01 17:43 ——– d—–w- c:\documents and settings\All Users\Application Data\avg7
2010-05-28 20:31 . 2010-06-01 22:16 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\QuickScan
2010-05-28 20:31 . 2010-05-19 00:21 868456 —-a-w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-28 20:31 . 2010-05-19 00:21 702120 —-a-w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-27 23:32 . 2010-06-01 21:16 ——– d—–w- c:\documents and settings\a\Application Data\QuickScan
2010-05-27 23:32 . 2010-05-19 00:21 702120 —-a-w- c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-27 23:32 . 2010-05-19 00:21 868456 —-a-w- c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-27 23:16 . 2010-05-27 23:16 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\STOPzilla!
2010-05-27 23:08 . 2010-05-27 23:08 ——– d—–w- c:\program files\Common Files\iS3
2010-05-27 23:08 . 2010-06-01 22:54 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-05-27 23:08 . 2010-06-01 20:40 ——– d—–w- c:\documents and settings\All Users\Application Data\ZILLAbar
2010-05-27 23:01 . 2010-05-27 23:01 ——– d—–w- c:\documents and settings\a\Application Data\STOPzilla!
2010-05-27 23:01 . 2010-06-01 17:18 ——– d—–w- c:\program files\STOPzilla!
2010-05-26 17:09 . 2010-05-26 17:09 ——– d—–w- c:\program files\Trend Micro
2010-05-26 04:10 . 2010-05-26 04:10 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\WINDOWS
2010-05-26 04:10 . 2010-05-26 04:10 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\UserData
2010-05-26 04:10 . 2010-05-26 04:10 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\PrivacIE
2010-05-26 04:05 . 2010-05-26 04:05 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\IETldCache
2010-05-26 04:05 . 2010-05-26 04:05 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\IECompatCache
2010-05-26 04:05 . 2010-05-26 04:05 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\EurekaLog
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\EPSON
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Dropbox
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\CoreFTP
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\BitTorrent
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\AVGTOOLBAR
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\ATI
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Apple Computer
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Alien Skin
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Ahead
2010-05-26 03:52 . 2010-05-26 03:52 ——– d—–w- c:\windows\system32\wbem\Repository
2010-05-26 03:50 . 2010-05-26 03:50 ——– d—–w- c:\documents and settings\a\Local Settings\Application Data\Yahoo!
2010-05-26 03:48 . 2010-05-26 03:48 ——– d—–w- c:\documents and settings\Administrator\IETldCache
2010-05-26 03:47 . 2010-05-26 03:49 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2010-05-26 03:47 . 2010-05-26 03:50 ——– d-s—w- c:\documents and settings\Administrator
2010-05-26 03:42 . 2010-05-26 03:42 ——– d—–w- c:\documents and settings\HelpAssistant\IETldCache
2010-05-26 03:42 . 2010-05-26 03:42 ——– d—–w- c:\documents and settings\HelpAssistant\IECompatCache
2010-05-26 03:35 . 2010-05-26 03:50 ——– d-s—w- c:\documents and settings\HelpAssistant
2010-05-25 22:22 . 2010-05-25 23:46 ——– d—–w- c:\documents and settings\a\Application Data\Dropbox
2010-05-15 00:51 . 2010-05-15 00:51 ——– d—–w- c:\documents and settings\a\Local Settings\Application Data\Starfield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-01 22:14 . 2008-12-26 23:48 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-01 18:30 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\uTorrent
2010-06-01 18:01 . 2008-12-28 18:15 ——– d—–w- c:\documents and settings\a\Application Data\uTorrent
2010-05-27 23:00 . 2009-04-18 11:07 ——– d—–w- c:\documents and settings\a\Application Data\CoreFTP
2010-05-26 20:06 . 2010-03-25 19:33 ——– d—–r- c:\program files\Skype
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\YouSendIt
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Yahoo!
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\XemiComputers
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Vso
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\U3
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Symantec
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\skypePM
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Skype
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Nero
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\NCH Swift Sound
2010-05-07 20:30 . 2010-03-25 19:33 ——– d—–w- c:\documents and settings\a\Application Data\Skype
2010-05-07 07:08 . 2010-03-25 19:36 ——– d—–w- c:\documents and settings\a\Application Data\skypePM
2010-04-29 18:47 . 2010-04-29 18:47 ——– d—–w- c:\documents and settings\a\Application Data\XemiComputers
2010-04-29 18:46 . 2010-04-29 18:46 ——– d—–w- c:\program files\XemiComputers
2010-04-09 21:07 . 2009-03-13 21:21 ——– d—–w- c:\documents and settings\All Users\Application Data\CraigsPal
2010-03-26 00:45 . 2010-03-26 00:45 33848 —-a-w- c:\windows\system32\drivers\nchssvad.sys
2010-03-25 19:36 . 2010-03-25 19:36 56 —ha-w- c:\windows\system32\ezsidmv.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Auto EPSON Stylus CX5400 on IRENE"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE" [2003-05-27 99840]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-09-23 1243088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UseDesktopIniCache"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-07 22:13 87352 —-a-w- c:\windows\system32\LMIinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ColorVisionStartup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ColorVisionStartup.lnk
backup=c:\windows\pss\ColorVisionStartup.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^IDW Logging Tool.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\IDW Logging Tool.lnk
backup=c:\windows\pss\IDW Logging Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2010-04-02 12:24 624056 —-a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Active Desktop Calendar]
2008-12-25 18:33 4480512 —-a-w- c:\program files\XemiComputers\Active Desktop Calendar\ADC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 09:57 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-10-09 18:28 139264 —-a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX5400]
2003-05-27 04:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2G1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX5400 (Copy 1)]
2003-05-27 04:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2G1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX5400 (from IRENE)]
2003-05-27 04:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2G1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-27 07:47 31016 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\laserjet 4 (from IRENE)]
2003-05-27 04:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2G1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2008-07-25 01:46 63048 —-a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 –sh–w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 23:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-11-04 18:30 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-07-02 23:02 16377344 —-a-r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 18:02 26100520 —-a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 19:17 61440 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"9695:TCP"= 9695:TCP:*:Disabled:Services
"9696:TCP"= 9696:TCP:*:Disabled:Services
"2271:TCP"= 2271:TCP:Services
"3042:TCP"= 3042:TCP:Services

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/1/2010 12:25 PM 164048]
R2 ASTSRV;Nalpeiron Licensing Service;c:\windows\system32\ASTSRV.EXE [1/16/2009 12:40 PM 57344]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/1/2010 12:25 PM 19024]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 6:46 PM 12856]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
uInternet Settings,ProxyOverride = *.local
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
FF - ProfilePath - c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\
FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
FF - component: c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-SwiftToDoListLite - c:\program files\Swift To-Do List\Swift To-Do List Lite.exe
MSConfigStartUp-YouSendIt - c:\program files\YouSendIt\Express\YouSendIt.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-01 15:55
Windows 5.1.2600 Service Pack 2, v.2135 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(792)
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll

- - - - - - - > 'lsass.exe'(848)
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
c:\windows\system32\dssenh.dll
.
Completion time: 2010-06-01 15:58:03
ComboFix-quarantined-files.txt 2010-06-01 22:58

Pre-Run: 297,790,660,608 bytes free
Post-Run: 297,762,119,680 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - A0DE25E7A3E3A2333CA0956CCCAD3D75

HIJACK THIS FILE
ComboFix 10-06-01.01 - a 06/01/2010 15:48:05.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3071.2684 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\a\Application Data\inst.exe
c:\documents and settings\HelpAssistant.PAYMAN\Application Data\inst.exe

.
original MBR restored successfully !
.
((((((((((((((((((((((((( Files Created from 2010-05-01 to 2010-06-01 )))))))))))))))))))))))))))))))
.

2010-06-01 21:05 . 2010-04-29 22:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-01 21:05 . 2010-04-29 22:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-06-01 21:05 . 2010-06-01 21:05 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-01 20:50 . 2009-10-08 18:31 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-06-01 20:50 . 2009-10-08 18:31 767952 —-a-w- c:\windows\BDTSupport.dll
2010-06-01 20:50 . 2009-10-02 21:19 1152470 —-a-w- c:\windows\UDB.zip
2010-06-01 20:50 . 2008-11-26 19:08 131 —-a-w- c:\windows\IDB.zip
2010-06-01 20:50 . 2009-10-08 18:31 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-06-01 20:50 . 2009-10-08 18:31 1636304 —-a-w- c:\windows\PCTBDCore.dll
2010-06-01 20:50 . 2009-09-24 15:55 229304 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-06-01 20:50 . 2009-10-06 23:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-06-01 20:50 . 2009-09-23 23:10 207280 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-06-01 20:49 . 2009-09-03 16:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-06-01 20:49 . 2010-06-01 20:51 ——– d—–w- c:\program files\Common Files\PC Tools
2010-06-01 20:49 . 2010-06-01 20:52 ——– d—–w- c:\program files\Spyware Doctor
2010-06-01 20:49 . 2010-06-01 20:49 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-06-01 20:49 . 2010-06-01 20:49 ——– d—–w- c:\documents and settings\a\Application Data\PC Tools
2010-06-01 19:25 . 2010-05-06 20:39 164048 —-a-w- c:\windows\system32\drivers\aswSP.sys
2010-06-01 19:25 . 2010-05-06 20:33 19024 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-06-01 19:25 . 2010-05-06 20:34 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2010-06-01 19:25 . 2010-05-06 20:39 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2010-06-01 19:25 . 2010-05-06 20:33 100432 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2010-06-01 19:25 . 2010-05-06 20:33 94800 —-a-w- c:\windows\system32\drivers\aswmon.sys
2010-06-01 19:25 . 2010-05-06 20:33 28880 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2010-06-01 19:25 . 2010-05-06 20:59 38848 —-a-w- c:\windows\system32\avastSS.scr
2010-06-01 19:25 . 2010-05-06 20:59 165032 —-a-w- c:\windows\system32\aswBoot.exe
2010-06-01 19:25 . 2010-06-01 19:25 ——– d—–w- c:\program files\Alwil Software
2010-06-01 19:25 . 2010-06-01 19:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-06-01 18:31 . 2010-06-01 18:31 ——– d—–w- c:\documents and settings\a\Local Settings\Application Data\Threat Expert
2010-06-01 18:30 . 2010-06-01 18:30 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\PC Tools
2010-06-01 17:17 . 2010-06-01 17:17 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Malwarebytes
2010-06-01 16:39 . 2010-06-01 16:39 ——– d—–w- c:\documents and settings\a\Application Data\Malwarebytes
2010-06-01 16:39 . 2010-06-01 16:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-01 16:00 . 2010-06-01 17:17 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\AVG7
2010-06-01 15:56 . 2010-06-01 15:56 ——– d—–w- c:\documents and settings\LocalService\Application Data\AVG7
2010-06-01 15:50 . 2010-06-01 16:27 ——– d—–w- c:\documents and settings\a\Application Data\AVG7
2010-06-01 15:50 . 2010-06-01 17:43 ——– d—–w- c:\documents and settings\All Users\Application Data\avg7
2010-05-28 20:31 . 2010-06-01 22:16 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\QuickScan
2010-05-28 20:31 . 2010-05-19 00:21 868456 —-a-w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-28 20:31 . 2010-05-19 00:21 702120 —-a-w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-27 23:32 . 2010-06-01 21:16 ——– d—–w- c:\documents and settings\a\Application Data\QuickScan
2010-05-27 23:32 . 2010-05-19 00:21 702120 —-a-w- c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-27 23:32 . 2010-05-19 00:21 868456 —-a-w- c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-27 23:16 . 2010-05-27 23:16 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\STOPzilla!
2010-05-27 23:08 . 2010-05-27 23:08 ——– d—–w- c:\program files\Common Files\iS3
2010-05-27 23:08 . 2010-06-01 22:54 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-05-27 23:08 . 2010-06-01 20:40 ——– d—–w- c:\documents and settings\All Users\Application Data\ZILLAbar
2010-05-27 23:01 . 2010-05-27 23:01 ——– d—–w- c:\documents and settings\a\Application Data\STOPzilla!
2010-05-27 23:01 . 2010-06-01 17:18 ——– d—–w- c:\program files\STOPzilla!
2010-05-26 17:09 . 2010-05-26 17:09 ——– d—–w- c:\program files\Trend Micro
2010-05-26 04:10 . 2010-05-26 04:10 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\WINDOWS
2010-05-26 04:10 . 2010-05-26 04:10 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\UserData
2010-05-26 04:10 . 2010-05-26 04:10 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\PrivacIE
2010-05-26 04:05 . 2010-05-26 04:05 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\IETldCache
2010-05-26 04:05 . 2010-05-26 04:05 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\IECompatCache
2010-05-26 04:05 . 2010-05-26 04:05 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\EurekaLog
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\EPSON
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Dropbox
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\CoreFTP
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\BitTorrent
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\AVGTOOLBAR
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\ATI
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Apple Computer
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Alien Skin
2010-05-26 03:58 . 2010-05-26 03:58 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Ahead
2010-05-26 03:52 . 2010-05-26 03:52 ——– d—–w- c:\windows\system32\wbem\Repository
2010-05-26 03:50 . 2010-05-26 03:50 ——– d—–w- c:\documents and settings\a\Local Settings\Application Data\Yahoo!
2010-05-26 03:48 . 2010-05-26 03:48 ——– d—–w- c:\documents and settings\Administrator\IETldCache
2010-05-26 03:47 . 2010-05-26 03:49 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2010-05-26 03:47 . 2010-05-26 03:50 ——– d-s—w- c:\documents and settings\Administrator
2010-05-26 03:42 . 2010-05-26 03:42 ——– d—–w- c:\documents and settings\HelpAssistant\IETldCache
2010-05-26 03:42 . 2010-05-26 03:42 ——– d—–w- c:\documents and settings\HelpAssistant\IECompatCache
2010-05-26 03:35 . 2010-05-26 03:50 ——– d-s—w- c:\documents and settings\HelpAssistant
2010-05-25 22:22 . 2010-05-25 23:46 ——– d—–w- c:\documents and settings\a\Application Data\Dropbox
2010-05-15 00:51 . 2010-05-15 00:51 ——– d—–w- c:\documents and settings\a\Local Settings\Application Data\Starfield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-01 22:14 . 2008-12-26 23:48 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-01 18:30 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\uTorrent
2010-06-01 18:01 . 2008-12-28 18:15 ——– d—–w- c:\documents and settings\a\Application Data\uTorrent
2010-05-27 23:00 . 2009-04-18 11:07 ——– d—–w- c:\documents and settings\a\Application Data\CoreFTP
2010-05-26 20:06 . 2010-03-25 19:33 ——– d—–r- c:\program files\Skype
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\YouSendIt
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Yahoo!
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\XemiComputers
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Vso
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\U3
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Symantec
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\skypePM
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Skype
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\Nero
2010-05-26 03:59 . 2010-05-26 03:59 ——– d—–w- c:\documents and settings\HelpAssistant.PAYMAN\Application Data\NCH Swift Sound
2010-05-07 20:30 . 2010-03-25 19:33 ——– d—–w- c:\documents and settings\a\Application Data\Skype
2010-05-07 07:08 . 2010-03-25 19:36 ——– d—–w- c:\documents and settings\a\Application Data\skypePM
2010-04-29 18:47 . 2010-04-29 18:47 ——– d—–w- c:\documents and settings\a\Application Data\XemiComputers
2010-04-29 18:46 . 2010-04-29 18:46 ——– d—–w- c:\program files\XemiComputers
2010-04-09 21:07 . 2009-03-13 21:21 ——– d—–w- c:\documents and settings\All Users\Application Data\CraigsPal
2010-03-26 00:45 . 2010-03-26 00:45 33848 —-a-w- c:\windows\system32\drivers\nchssvad.sys
2010-03-25 19:36 . 2010-03-25 19:36 56 —ha-w- c:\windows\system32\ezsidmv.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Auto EPSON Stylus CX5400 on IRENE"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE" [2003-05-27 99840]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-09-23 1243088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UseDesktopIniCache"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-07 22:13 87352 —-a-w- c:\windows\system32\LMIinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ColorVisionStartup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ColorVisionStartup.lnk
backup=c:\windows\pss\ColorVisionStartup.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^IDW Logging Tool.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\IDW Logging Tool.lnk
backup=c:\windows\pss\IDW Logging Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2010-04-02 12:24 624056 —-a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Active Desktop Calendar]
2008-12-25 18:33 4480512 —-a-w- c:\program files\XemiComputers\Active Desktop Calendar\ADC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17 952768 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 09:57 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2006-10-09 18:28 139264 —-a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX5400]
2003-05-27 04:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2G1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX5400 (Copy 1)]
2003-05-27 04:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2G1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX5400 (from IRENE)]
2003-05-27 04:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2G1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-27 07:47 31016 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\laserjet 4 (from IRENE)]
2003-05-27 04:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2G1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2008-07-25 01:46 63048 —-a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 –sh–w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 23:40 155648 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-11-04 18:30 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-07-02 23:02 16377344 —-a-r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 18:02 26100520 —-a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 19:17 61440 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"9695:TCP"= 9695:TCP:*:Disabled:Services
"9696:TCP"= 9696:TCP:*:Disabled:Services
"2271:TCP"= 2271:TCP:Services
"3042:TCP"= 3042:TCP:Services

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/1/2010 12:25 PM 164048]
R2 ASTSRV;Nalpeiron Licensing Service;c:\windows\system32\ASTSRV.EXE [1/16/2009 12:40 PM 57344]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/1/2010 12:25 PM 19024]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 6:46 PM 12856]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
uInternet Settings,ProxyOverride = *.local
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
FF - ProfilePath - c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\
FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
FF - component: c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\n2bvr1zx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-SwiftToDoListLite - c:\program files\Swift To-Do List\Swift To-Do List Lite.exe
MSConfigStartUp-YouSendIt - c:\program files\YouSendIt\Express\YouSendIt.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-01 15:55
Windows 5.1.2600 Service Pack 2, v.2135 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(792)
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LMIinit.dll

- - - - - - - > 'lsass.exe'(848)
c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
c:\windows\system32\dssenh.dll
.
Completion time: 2010-06-01 15:58:03
ComboFix-quarantined-files.txt 2010-06-01 22:58

Pre-Run: 297,790,660,608 bytes free
Post-Run: 297,762,119,680 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - A0DE25E7A3E3A2333CA0956CCCAD3D75


Thank you for your help.
Post #2 last edited
Sorry I'm a little confused with this statement

I have a virus which redirects google and slows firefox and computer. Computer will freeze and I have to shut it down. I followed instructions on another forum with LDTate and downloaded and used ATF Cleaner and then Combo Fix



Are you presently working with LDTate on another forum with an open topic, or are you stating he assisted you two years ago with a topic?

If the topic is still open, then you need to finish the topic with LDTate - advise me and we will close this topic.

If the topic you are referring to was two years old, then this is considered a new topic and I will assist you


If this is a new topic - follow the following instructions;

If it is an ongoing topic in another forum - disregard these instructions and follow the instructions from LDTate in the other forum:

Following two sets of instructions can be very hazardous to your computer:





Please download HelpAsst_mebroot_fix.exe and save it to your desktop.
Close out all other open programs and windows.
Double click the file to run it and follow any prompts.
If the tool detects an mbr infection, please allow it to run mbr -f and shutdown your computer.
Upon restarting, please wait about 5 minutes, click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !
When it completes, a log will open.
Please post the contents of that log.


*In the event the tool does not detect an mbr infection and completes, click Start>Run and type the following bolded command, then hit Enter.

mbr -f

Now, please do the Start>Run>mbr -f command a second time.
Now shut down the computer (do not restart, but shut it down), wait a few minutes then start it back up.
Give it about 5 minutes, then click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !
When it completes, a log will open.
Please post the contents of that log.

**Important note to Dell users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended).

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI