IE8 Browser Redirects

First, thank you in advance for any help you can provide!! I am helping a friend who's machine was infested with viruses. McAfee had been disabled, and would only boot in safe mode. Having some experience, I set out to aid another buddy. Using Malwarebyes (free, regular and safemode scans) and Hitman Pro 3 (free) cleaned close to 200 items. These primarily included adware for my-search with several other trojans (I have all the logs). Machine came back to life with some coaching and is running seemingly well overall. Next step was to ensure his Windows was up-to-date as part of my friendly and free buddy service. This is where the issue surfaced. The windows update page gives me a "cannot be displayed" message in both IE8 and Firefox (installed after cleanup when IE would not connect). I have seen messages that the connection had been reset. Search engines have also been hijacked that have "windows update" in the address. Google, Bing and Yahoo all have the same behavior. Click on a link that has any combination of windows update in the address and you are taken to an obscure web search engine page or some other unrelated site. If I paste the address directly into the address bar it DOES go to the correct address. Except the windows update page which will show "page cannot be displayed". Hitman Pro and Malware bytes show clean, have checked IE DNS and proxy settings (unchecked), have disabled all add in's. Attached below is the requested DDS log taken just now. I will refrain from messing with anything else to maintain this baseline until you have a chance to respond. Again, thank you for your assistance, Dave ********************************************** DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 12:14:40.53 on Sun 06/20/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1704 [GMT -5:00] AV: Defense Center *On-access scanning enabled* (Outdated) {28e00e3b-806e-4533-925c-f4c3d79514b9} AV: Webroot Internet Security Essentials *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597} FW: Webroot Internet Security Essentials *enabled* {63671000-11A2-46DD-BADD-A084CABCDEAE} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Smart PDF Creator\sspdfagentd.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Documents and Settings\Beth\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://www.msn.com uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File TB: {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - No File TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [ArcSoft Connection Service] "c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe" mRun: [SmartSoft PDF Printer (demo) Agent] "c:\program files\smart pdf creator\sspdfagentd.exe" mRun: [SmartSoft PDF Printer (demo) virtual printer agent] "c:\program files\smart pdf creator\sspdfagentd.exe" mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [HitmanPro35] "c:\program files\hitman pro 3.5\HitmanPro35.exe" /scan:boot StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe IE: &Search IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL Trusted Zone: internet Trusted Zone: mcafee.com Trusted Zone: microsoft.com\update DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\beth\applic~1\mozilla\firefox\profiles\d0m3a7ib.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/ FF - plugin: c:\documents and settings\beth\application data\facebook\npfbplugin_1_0_3.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-4-14 385536] S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-6-14 79816] S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-6-14 35272] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2010-6-14 34248] S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2010-6-14 40552] S4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2010-6-14 203280] S4 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2010-6-14 359952] S4 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2010-6-14 144704] S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2010-6-14 606736] =============== Created Last 30 ================ 2010-06-19 20:12:45 12872 —-a-w- c:\windows\system32\bootdelete.exe 2010-06-19 20:08:52 0 d—–w- c:\program files\Hitman Pro 3.5 2010-06-19 19:34:28 411368 —-a-w- c:\windows\system32\deployJava1.dll 2010-06-19 19:24:07 0 d-sh–w- c:\documents and settings\beth\IECompatCache 2010-06-19 16:43:26 159744 —-a-w- c:\windows\system32\nvuenet.exe 2010-06-19 16:43:26 1556 —-a-w- c:\windows\system32\nvenet.nvu 2010-06-19 16:43:24 789 —-a-w- c:\windows\system32\nvsmb.nvu 2010-06-19 16:43:24 172032 —-a-w- c:\windows\system32\nvusmb.exe 2010-06-19 16:43:24 172032 —-a-w- c:\windows\system32\NVUNINST.EXE 2010-06-19 16:42:02 0 d—–w- C:\NVIDIA 2010-06-19 15:20:15 0 d—–w- c:\docume~1\beth\applic~1\Malwarebytes 2010-06-19 15:20:06 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-06-19 15:20:05 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-06-19 15:20:04 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-06-19 15:20:04 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-06-16 19:34:21 3059184 —-a-w- c:\program files\DMSetup-Serial.exe 2010-06-16 19:33:37 95568 —-a-w- c:\windows\system32\drivers\mfeapfk.sys 2010-06-15 03:00:26 1360 —-a-w- c:\windows\system32\Config.MPF 2010-06-15 02:35:51 23040 —-a-w- c:\windows\system32\psapi.dll 2010-06-15 02:32:58 79816 —-a-w- c:\windows\system32\drivers\mfeavfk.sys 2010-06-15 02:32:58 40552 —-a-w- c:\windows\system32\drivers\mfesmfk.sys 2010-06-15 02:32:58 35272 —-a-w- c:\windows\system32\drivers\mfebopk.sys 2010-06-15 02:32:52 120136 —-a-w- c:\windows\system32\drivers\Mpfp.sys 2010-06-15 02:32:27 0 d—–w- c:\program files\common files\McAfee 2010-06-15 02:32:26 0 d—–w- c:\program files\McAfee.com 2010-06-15 02:27:31 34248 —-a-w- c:\windows\system32\drivers\mferkdk.sys 2010-06-14 19:51:08 0 d–h–w- c:\windows\system32\GroupPolicy 2010-06-10 23:23:18 15944 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys 2010-06-10 23:22:44 0 d—–w- c:\docume~1\alluse~1\applic~1\Hitman Pro 2010-06-10 20:26:15 0 d—–w- c:\windows\McAfee.com 2010-06-10 05:07:19 0 d—–w- c:\docume~1\beth\applic~1\McAfee 2010-06-07 23:44:39 0 d—–w- c:\docume~1\beth\applic~1\W Photo Studio Viewer 2010-06-02 18:52:44 0 d—–w- c:\docume~1\beth\applic~1\KodakCredentialStore 2010-05-31 17:48:10 32656 —-a-w- c:\windows\system32\msonpmon.dll 2010-05-31 17:36:15 0 d—–w- c:\program files\Microsoft Visual Studio 8 2010-05-31 17:34:56 0 d—–w- c:\windows\SHELLNEW 2010-05-30 19:47:01 33280 -c–a-w- c:\windows\system32\dllcache\rundll32.exe 2010-05-30 19:47:01 33280 —-a-w- c:\windows\system32\rundll32.exe 2010-05-30 06:59:24 165376 —-a-w- c:\windows\system32\unrar.dll 2010-05-24 17:33:55 38 —-a-w- c:\windows\AviSplitter.INI ==================== Find3M ==================== 2010-05-30 21:36:11 87608 —-a-w- c:\docume~1\beth\applic~1\inst.exe 2010-05-30 21:36:11 47360 —-a-w- c:\docume~1\beth\applic~1\pcouffin.sys 2010-05-01 17:46:48 54469632 —-a-w- c:\program files\AVSVideoConverter.exe 2009-09-17 04:02:48 111616 —-a-w- c:\program files\BlankProfile_97_03_final.doc 2009-09-17 03:52:34 111616 —-a-w- c:\program files\Blank Profile_97_2003_2.doc 2009-01-07 22:52:38 12340814 —-a-w- c:\program files\ta08stdw.exe 2009-10-16 15:46:31 245760 –sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat 2009-09-01 18:11:06 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009082420090831\index.dat 2009-09-01 18:11:06 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009090120090902\index.dat ============= FINISH: 12:16:03.26 =============== ********************************

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.



Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Ensure all Firefox windows are closed.
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
• When prompted to run the scan, click Yes.
• It doesn't take long to run, once it is finished move onto the next step

Download TDSSKiller and save it to your Desktop.

• Make sure all other windows are closed and to let it run uninterrupted.
• Extract the file and run it.
• Reboot your machine and see if the infection is gone

LDTate,

Have completed all steps as instructed without issue.

#1 Cleared Java Cache
#2 Ran ATF cleaner including Firefox cleared
#3 Ran Combo fix and installed recovery console as instructed, logs attached below.
#4 Machine appears to be running normally without any browser redirects.
- Thank you!!

******************
ComboFix 10-06-20.01 - Beth 06/20/2010 15:27:22.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1692 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Webroot Internet Security Essentials *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}
FW: Webroot Internet Security Essentials *enabled* {63671000-11A2-46DD-BADD-A084CABCDEAE}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Beth\Application Data\inst.exe
c:\documents and settings\Beth\g2mdlhlpx.exe
c:\windows\system32\AutoRun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PRAGMAmcccrjipoq
——-\Legacy_PRAGMAnlqiemuicv
——-\Legacy_PRAGMAttbvwnxvcx
——-\Service_PRAGMAmcccrjipoq
——-\Service_PRAGMAnlqiemuicv
——-\Service_PRAGMAttbvwnxvcx


((((((((((((((((((((((((( Files Created from 2010-05-20 to 2010-06-20 )))))))))))))))))))))))))))))))
.

2010-06-20 04:24 . 2010-06-20 04:24 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-06-19 20:12 . 2010-06-19 20:12 12872 —-a-w- c:\windows\system32\bootdelete.exe
2010-06-19 20:08 . 2010-06-19 20:08 ——– d—–w- c:\program files\Hitman Pro 3.5
2010-06-19 19:48 . 2010-06-19 19:48 ——– d—–w- c:\program files\Common Files\Apple
2010-06-19 19:37 . 2010-06-19 19:37 53632 —-a-w- c:\documents and settings\Beth\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-19 19:36 . 2010-06-19 19:36 71680 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-06-19 19:35 . 2010-06-19 19:35 ——– d—–w- c:\program files\Common Files\Java
2010-06-19 19:34 . 2010-06-19 19:34 503808 —-a-w- c:\documents and settings\Beth\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5e04e9aa-n\msvcp71.dll
2010-06-19 19:34 . 2010-06-19 19:34 499712 —-a-w- c:\documents and settings\Beth\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5e04e9aa-n\jmc.dll
2010-06-19 19:34 . 2010-06-19 19:34 61440 —-a-w- c:\documents and settings\Beth\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7746b6df-n\decora-sse.dll
2010-06-19 19:34 . 2010-06-19 19:34 348160 —-a-w- c:\documents and settings\Beth\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5e04e9aa-n\msvcr71.dll
2010-06-19 19:34 . 2010-06-19 19:34 12800 —-a-w- c:\documents and settings\Beth\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7746b6df-n\decora-d3d.dll
2010-06-19 19:34 . 2010-04-12 22:29 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-06-19 19:27 . 2010-06-19 19:27 0 —-a-w- c:\windows\nsreg.dat
2010-06-19 19:27 . 2010-06-19 19:27 ——– d—–w- c:\documents and settings\Beth\Local Settings\Application Data\Mozilla
2010-06-19 19:24 . 2010-06-19 19:24 ——– d-sh–w- c:\documents and settings\Beth\IECompatCache
2010-06-19 16:43 . 2004-01-29 07:22 159744 —-a-w- c:\windows\system32\nvuenet.exe
2010-06-19 16:43 . 2004-06-24 23:57 172032 —-a-w- c:\windows\system32\nvusmb.exe
2010-06-19 16:43 . 2004-06-24 23:57 172032 —-a-w- c:\windows\system32\NVUNINST.EXE
2010-06-19 16:42 . 2010-06-19 16:42 ——– d—–w- C:\NVIDIA
2010-06-19 15:20 . 2010-06-19 15:20 ——– d—–w- c:\documents and settings\Beth\Application Data\Malwarebytes
2010-06-19 15:20 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-19 15:20 . 2010-06-19 15:20 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-19 15:20 . 2010-06-19 15:20 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-19 15:20 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-06-19 15:05 . 2010-06-19 15:05 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2010-06-19 15:05 . 2010-06-19 15:05 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2010-06-16 19:34 . 2010-06-17 02:22 3059184 —-a-w- c:\program files\DMSetup-Serial.exe
2010-06-16 19:33 . 2010-04-14 17:50 95568 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-06-15 02:35 . 2008-04-14 00:12 23040 —-a-w- c:\windows\system32\psapi.dll
2010-06-15 02:32 . 2010-02-17 21:52 79816 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-06-15 02:32 . 2010-02-17 21:52 40552 —-a-w- c:\windows\system32\drivers\mfesmfk.sys
2010-06-15 02:32 . 2010-02-17 21:52 35272 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-06-15 02:32 . 2009-07-16 17:32 120136 —-a-w- c:\windows\system32\drivers\Mpfp.sys
2010-06-15 02:32 . 2010-06-15 02:32 ——– d—–w- c:\program files\Common Files\McAfee
2010-06-15 02:32 . 2010-06-15 02:32 ——– d—–w- c:\program files\McAfee.com
2010-06-15 02:27 . 2010-02-17 21:52 34248 —-a-w- c:\windows\system32\drivers\mferkdk.sys
2010-06-14 22:08 . 2010-06-15 01:50 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-14 19:51 . 2010-06-14 19:51 ——– d–h–w- c:\windows\system32\GroupPolicy
2010-06-10 23:23 . 2010-06-20 16:56 15944 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-06-10 23:22 . 2010-06-19 20:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-06-10 20:26 . 2010-06-10 20:26 ——– d—–w- c:\windows\McAfee.com
2010-06-10 05:08 . 2010-06-10 05:07 300384 —-a-w- c:\documents and settings\Beth\Application Data\McAfee\Supportability\MVTLogs\Results\detect.dll
2010-06-10 05:07 . 2010-06-10 05:07 ——– d—–w- c:\documents and settings\Beth\Application Data\McAfee
2010-06-07 23:44 . 2010-06-08 00:07 ——– d—–w- c:\documents and settings\Beth\Application Data\W Photo Studio Viewer
2010-06-07 18:55 . 2010-06-07 18:55 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-06-07 06:25 . 2010-06-07 06:25 ——– d—–w- c:\documents and settings\Beth\Local Settings\Application Data\mnpbwmuac
2010-06-04 23:52 . 2010-06-04 23:52 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2010-06-02 18:52 . 2010-06-02 18:52 ——– d—–w- c:\documents and settings\Beth\Application Data\KodakCredentialStore
2010-05-31 17:48 . 2008-11-10 16:41 32656 —-a-w- c:\windows\system32\msonpmon.dll
2010-05-31 17:48 . 2006-10-27 00:56 33104 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-05-31 17:39 . 2010-05-31 17:39 ——– d—–w- c:\program files\Microsoft.NET
2010-05-31 17:36 . 2010-05-31 17:36 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2010-05-31 17:34 . 2010-05-31 17:40 ——– d—–w- c:\windows\SHELLNEW
2010-05-31 17:04 . 2010-05-31 17:04 ——– d—–r- C:\MSOCache
2010-05-30 19:47 . 2010-05-30 19:41 33280 -c–a-w- c:\windows\system32\dllcache\rundll32.exe
2010-05-30 19:47 . 2010-05-30 19:41 33280 —-a-w- c:\windows\system32\rundll32.exe
2010-05-30 06:59 . 2010-03-15 09:31 165376 —-a-w- c:\windows\system32\unrar.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-20 20:32 . 2009-09-05 19:24 720 —-a-w- c:\documents and settings\All Users\Application Data\ArcSoft\kodak-printcreations-22-080812-oem\acforall.dll
2010-06-20 19:41 . 2009-09-13 23:46 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-06-20 05:31 . 2009-10-09 15:06 ——– d—–w- c:\program files\Windows Media Connect 2
2010-06-20 03:11 . 2009-08-25 04:02 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-06-19 19:49 . 2009-09-05 19:48 ——– d—–w- c:\program files\QuickTime
2010-06-19 19:39 . 2009-08-25 04:05 ——– d—–w- c:\program files\Common Files\Adobe
2010-06-19 19:37 . 2009-08-25 04:05 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-06-19 19:34 . 2009-08-28 04:26 ——– d—–w- c:\program files\Java
2010-06-19 16:42 . 2009-09-05 19:22 ——– d—–w- c:\program files\Common Files\InstallShield
2010-06-15 04:12 . 2010-03-12 06:13 ——– d—–w- c:\program files\McAfee
2010-06-15 03:10 . 2010-02-13 07:32 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-06-14 02:02 . 2009-08-25 04:03 ——– d—–w- c:\program files\Google
2010-06-13 18:42 . 2009-11-24 02:16 ——– d—–w- c:\documents and settings\Beth\Application Data\HpUpdate
2010-06-07 00:15 . 2009-08-28 05:56 ——– d—–w- c:\documents and settings\Beth\Application Data\LimeWire
2010-06-06 01:30 . 2009-08-24 21:06 69232 —-a-w- c:\documents and settings\Beth\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-03 07:09 . 2009-09-17 00:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-02 19:02 . 2009-08-28 04:25 ——– d—–w- c:\program files\LimeWire
2010-06-01 18:57 . 2009-08-24 21:03 ——– d—–w- c:\documents and settings\All Users\Application Data\Webroot
2010-05-31 17:42 . 2009-09-07 06:47 ——– d—–w- c:\program files\MSBuild
2010-05-31 17:07 . 2009-08-24 22:15 ——– d—–w- c:\program files\Windows Messaging
2010-05-31 17:07 . 2009-08-24 20:55 ——– d—–w- c:\program files\microsoft frontpage
2010-05-30 21:44 . 2010-05-01 17:47 ——– d—–w- c:\program files\AVS4YOU
2010-05-30 21:44 . 2010-05-01 17:47 ——– d—–w- c:\program files\Common Files\AVSMedia
2010-05-30 21:36 . 2010-04-13 01:32 ——– d—–w- c:\program files\DVDFab 7
2010-05-30 21:36 . 2009-09-07 22:33 ——– d—–w- c:\documents and settings\Beth\Application Data\Vso
2010-05-30 21:36 . 2009-09-07 22:33 47360 —-a-w- c:\documents and settings\Beth\Application Data\pcouffin.sys
2010-05-30 21:36 . 2009-09-07 22:33 47360 —-a-w- c:\documents and settings\Beth\Application Data\pcouffin.sys
2010-05-30 21:10 . 2009-09-20 00:26 ——– d—–w- c:\program files\Smart PDF Creator
2010-05-30 20:32 . 2009-08-26 18:58 ——– d—–w- c:\program files\Citrix
2010-05-09 05:58 . 2010-05-09 05:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Trymedia
2010-05-04 22:16 . 2010-05-04 22:15 529960 —-a-w- c:\documents and settings\Beth\Application Data\E-centives\BSTIEPrintCtl1PM.dll
2010-05-04 22:15 . 2010-05-04 22:15 ——– d—–w- c:\documents and settings\Beth\Application Data\E-centives
2010-05-01 20:36 . 2010-05-01 20:36 ——– d—–w- c:\documents and settings\Beth\Application Data\Media Player Classic
2010-05-01 19:17 . 2010-05-01 19:17 ——– d—–w- c:\program files\XP Codec Pack
2010-05-01 17:53 . 2010-05-01 17:53 ——– d—–w- c:\documents and settings\Beth\Application Data\AVS4YOU
2010-05-01 17:53 . 2010-05-01 17:47 ——– d—–w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-05-01 17:46 . 2010-05-01 17:45 54469632 —-a-w- c:\program files\AVSVideoConverter.exe
2010-04-14 17:50 . 2010-04-14 17:50 385536 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2010-04-13 00:31 . 2009-09-07 22:33 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2010-04-12 12:20 . 2009-11-11 19:50 79488 —-a-w- c:\documents and settings\Beth\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-09-17 04:02 . 2009-09-17 04:02 111616 —-a-w- c:\program files\BlankProfile_97_03_final.doc
2009-09-17 03:52 . 2009-09-17 03:48 111616 —-a-w- c:\program files\Blank Profile_97_2003_2.doc
2009-01-07 22:52 . 2009-08-25 19:08 12340814 —-a-w- c:\program files\ta08stdw.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"SmartSoft PDF Printer (demo) Agent"="c:\program files\Smart PDF Creator\sspdfagentd.exe" [2007-10-22 94208]
"SmartSoft PDF Printer (demo) virtual printer agent"="c:\program files\Smart PDF Creator\sspdfagentd.exe" [2007-10-22 94208]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"HitmanPro35"="c:\program files\Hitman Pro 3.5\HitmanPro35.exe" [2010-06-19 5937984]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

S4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [6/14/2010 9:36 PM 203280]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-06-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-06-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-06-15 17:22]

2010-06-15 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2010-06-15 17:22]

2010-06-20 c:\windows\Tasks\User_Feed_Synchronization-{C9FDA944-2A41-4815-9B80-8E3758C12865}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
——- Supplementary Scan ——-
.
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: microsoft.com\update
FF - ProfilePath - c:\documents and settings\Beth\Application Data\Mozilla\Firefox\Profiles\d0m3a7ib.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - plugin: c:\documents and settings\Beth\Application Data\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)
HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
SafeBoot-klmdb.sys
SafeBoot-WRConsumerService
AddRemove-InterActual Player - c:\program files\InterActual\InterActual Player\inuninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-20 15:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(4060)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2010-06-20 15:36:35 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-20 20:36

Pre-Run: 190,846,382,080 bytes free
Post-Run: 190,757,388,288 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 1EAA1F1A838C36DB8C05EE46C2AF5F1F