What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected with something that keeps running

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Hello LastPaladin :),

Please make sure you have rebooted after using the USBNoRisk before continuing below.

Please download ComboFix© by sUBs from one of the links below and save it to your desktop.

Link 1
Link 2

Do not mouse click on ComboFix while it is running. That may cause it to stall. ComboFix is a powerful tool and must not be used without supervision.

Install Recovery Console and run ComboFix
  • Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily when running ComboFix. They will interfere and may cause unexpected results.
  • If you need help to disable your protection programs see here and here.
  • Double click on ComboFix.exe and follow the prompts.
  • As part of its process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. You will be asked to install it if it is not present in your computer. Click Yes to proceed.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    Note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.
  • Once the Microsoft Windows Recovery Console is installed using ComboFix, click on Yes to continue scanning for malware.
  • When finished, a log will be produced as C:\ComboFix.txt. Please post this log in your next reply.
  • If you lose Internet connection after running ComboFix, right click on the network icon at the system tray and select Repair, or you can reboot the computer.
  • Enable back your security softwares as soon as you completed the ComboFix steps.
A detailed step by step tutorial to run ComboFix can be found here if you need help.

——————–

Please post back:
1. the ComboFix log
2. how is your computer?
Post #32
1.

ComboFix 10-07-11.03 - Compaq_Owner 07/11/2010 16:04:41.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.373 [GMT -10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\SET62D.tmp
c:\windows\xpsp1hfm.log

.
((((((((((((((((((((((((( Files Created from 2010-06-12 to 2010-07-12 )))))))))))))))))))))))))))))))
.

2010-07-11 04:57 . 2006-08-02 01:02 49152 —-a-w- c:\windows\system32\ChCfg.exe
2010-07-11 04:54 . 2006-12-09 01:20 10528768 —-a-w- c:\windows\system32\RTLCPL.exe
2010-07-11 04:54 . 2006-10-18 12:53 147456 —-a-w- c:\windows\system32\RtlCPAPI.dll
2010-07-11 04:46 . 2010-07-11 04:46 ——– d—–w- C:\73246e4cf8242ff25c686977
2010-07-11 04:46 . 2010-07-11 04:59 ——– d—–w- C:\f6ba085bfc86d26cd2d6b2a4f7663f
2010-07-11 04:40 . 2010-07-11 04:40 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Windows Search
2010-07-11 00:26 . 2010-07-11 03:33 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Tracing
2010-07-11 00:23 . 2010-07-11 00:53 ——– d—–w- c:\program files\Microsoft Silverlight
2010-07-11 00:22 . 2010-07-11 00:22 ——– d—–w- c:\program files\Microsoft Office Outlook Connector
2010-07-11 00:18 . 2006-11-29 23:06 3426072 —-a-w- c:\windows\system32\d3dx9_32.dll
2010-07-11 00:18 . 2010-07-11 00:18 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2010-07-11 00:15 . 2010-07-11 03:17 ——– d—–w- c:\program files\Microsoft
2010-07-11 00:15 . 2010-07-11 00:15 ——– d—–w- c:\program files\Windows Live SkyDrive
2010-07-11 00:14 . 2010-07-11 00:19 ——– d—–w- c:\program files\Windows Live
2010-07-10 23:56 . 2010-07-10 23:56 ——– d—–w- c:\program files\Common Files\Windows Live
2010-07-10 22:14 . 2010-07-10 22:14 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\Identities
2010-07-10 22:13 . 2010-07-10 22:13 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Windows Desktop Search
2010-07-10 22:12 . 2010-07-10 23:06 ——– d—–w- c:\program files\Windows Desktop Search
2010-07-10 22:12 . 2010-07-10 22:12 ——– d—–w- c:\windows\system32\GroupPolicy
2010-07-10 22:11 . 2008-03-07 17:02 29696 ——w- c:\windows\system32\dllcache\mimefilt.dll
2010-07-10 22:11 . 2008-03-07 17:02 98304 ——w- c:\windows\system32\dllcache\nlhtml.dll
2010-07-10 22:11 . 2008-03-07 17:02 192000 ——w- c:\windows\system32\dllcache\offfilt.dll
2010-07-10 22:09 . 2010-07-10 22:09 ——– d—–w- c:\program files\Windows Media Connect 2
2010-07-10 22:05 . 2010-07-10 22:07 ——– d—–w- c:\windows\system32\drivers\UMDF
2010-07-10 22:05 . 2010-07-10 22:05 ——– d—–w- c:\windows\system32\LogFiles
2010-07-10 21:33 . 2003-04-04 04:57 5183 —-a-w- c:\windows\system32\drivers\usbu2a.sys
2010-07-10 21:33 . 2010-07-11 04:36 ——– d—–w- C:\USBStorage
2010-07-10 21:30 . 2010-07-10 21:30 ——– d—–w- c:\documents and settings\COMPAQ~1~005\LOCALS~1
2010-07-10 21:30 . 2010-07-10 21:30 ——– d—–w- c:\documents and settings\COMPAQ~1~005
2010-07-10 20:24 . 2006-01-27 02:35 68096 ——w- c:\windows\system32\agrsmdel.exe
2010-07-10 19:57 . 2008-06-28 00:54 110592 ——w- c:\windows\system32\TVMode.dll
2010-07-10 19:57 . 2008-06-28 00:55 65536 ——w- c:\windows\system32\SiSHook.dll
2010-07-10 19:57 . 2008-06-28 00:53 135168 ——w- c:\windows\system32\SiSApCom.dll
2010-07-10 19:57 . 2008-06-28 00:54 262144 —-a-w- c:\windows\system32\sistray.exe
2010-07-10 19:57 . 2008-06-28 00:55 53248 —-a-w- c:\windows\system32\SiSPower.dll
2010-07-10 19:57 . 2008-06-28 00:53 12288 —-a-w- c:\windows\InstFunc.dll
2010-07-10 19:57 . 2006-04-28 19:56 49152 —-a-w- c:\windows\InstFunc.exe
2010-07-10 19:52 . 2010-07-10 19:52 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-07-10 19:27 . 2010-07-10 19:27 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\PC_Drivers_Headquarters
2010-07-10 19:27 . 2010-07-11 00:24 40784 —-a-w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-08 19:45 . 2009-08-07 05:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2010-07-07 08:30 . 2010-07-07 08:29 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-06 19:24 . 2010-07-11 09:46 ——– d—–w- C:\USBNoRisk
2010-07-04 09:08 . 2010-07-04 09:08 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2010-07-04 08:57 . 2010-07-04 08:57 ——– d—–w- c:\windows\system32\scripting
2010-07-04 08:57 . 2010-07-04 08:57 ——– d—–w- c:\windows\system32\en
2010-07-04 08:57 . 2010-07-04 08:57 ——– d—–w- c:\windows\system32\bits
2010-07-04 08:30 . 2010-07-04 08:30 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\WinBatch
2010-07-03 21:50 . 2010-07-03 21:50 ——– d—–w- c:\program files\ESET
2010-07-03 17:13 . 2010-07-03 17:13 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2010-07-03 17:13 . 2010-07-03 17:13 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-07-03 17:11 . 2010-07-03 17:22 ——– d—–w- c:\windows\system32\drivers\NIS
2010-07-03 17:11 . 2010-07-03 17:11 ——– d—–w- c:\program files\Norton Internet Security
2010-07-03 16:40 . 2010-07-03 16:40 ——– d—–w- c:\documents and settings\All Users\Application Data\PCSettings
2010-07-03 16:16 . 2010-07-03 16:16 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Tific
2010-07-03 09:53 . 2010-07-03 09:53 ——– d—–w- C:\_OTL
2010-07-03 09:04 . 2010-07-03 09:04 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\AdobeUM
2010-07-03 09:04 . 2010-07-03 09:04 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\Adobe
2010-07-02 15:17 . 2010-07-02 15:17 ——– d—–w- c:\program files\ERUNT
2010-07-01 09:20 . 2010-07-01 09:20 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Malwarebytes
2010-07-01 09:20 . 2010-04-30 01:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-01 09:20 . 2010-07-01 09:20 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-01 09:19 . 2010-04-30 01:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-07-01 09:19 . 2010-07-01 17:27 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-29 20:50 . 2010-06-29 21:08 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\DivX
2010-06-29 20:49 . 2010-06-09 23:01 9200 ——w- c:\windows\system32\drivers\cdralw2k.sys
2010-06-29 20:49 . 2010-06-09 23:01 9072 ——w- c:\windows\system32\drivers\cdr4_xp.sys
2010-06-29 20:49 . 2010-06-09 23:01 133616 ——w- c:\windows\system32\pxafs.dll
2010-06-29 20:49 . 2010-06-09 23:01 126448 ——w- c:\windows\system32\pxinsi64.exe
2010-06-29 20:49 . 2010-06-09 23:01 123888 ——w- c:\windows\system32\pxcpyi64.exe
2010-06-28 20:43 . 2010-06-28 20:43 ——– d-sh–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\IECompatCache
2010-06-28 20:38 . 2010-06-28 20:38 ——– d-sh–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\PrivacIE
2010-06-28 20:35 . 2010-06-28 20:35 ——– d-sh–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\IETldCache
2010-06-28 20:28 . 2010-05-06 10:41 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2010-06-28 20:28 . 2010-05-06 10:41 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-06-28 20:28 . 2010-05-06 10:41 599040 ——w- c:\windows\system32\dllcache\msfeeds.dll
2010-06-28 20:28 . 2010-05-06 10:41 247808 ——w- c:\windows\system32\dllcache\ieproxy.dll
2010-06-28 20:28 . 2010-05-06 10:41 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2010-06-28 20:28 . 2010-05-06 10:41 11076096 ——w- c:\windows\system32\dllcache\ieframe.dll
2010-06-28 20:28 . 2010-05-06 10:41 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-28 20:24 . 2010-04-16 11:43 41984 ——w- c:\windows\system32\dllcache\iecompat.dll
2010-06-28 20:00 . 2010-06-28 20:36 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Norton Utilities 14
2010-06-28 19:23 . 2010-06-28 19:23 ——– d—–w- c:\program files\NortonInstaller
2010-06-28 19:07 . 2004-08-04 10:56 21504 —-a-w- c:\windows\system32\drivers\hidserv.dll
2010-06-28 10:25 . 2008-04-14 00:12 397056 ——w- c:\windows\system32\s3gnb.dll
2010-06-28 10:24 . 2008-04-14 00:11 37376 ——w- c:\windows\system32\l2gpstore.dll
2010-06-28 10:23 . 2008-04-13 18:36 43008 ——w- c:\windows\system32\drivers\amdagp.sys
2010-06-28 10:22 . 2009-12-31 16:50 353792 ——w- c:\windows\system32\dllcache\srv.sys
2010-06-28 10:22 . 2010-06-28 10:23 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Yahoo!
2010-06-28 10:22 . 2010-02-24 13:11 455680 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2010-06-28 10:22 . 2009-11-27 16:07 8704 ——w- c:\windows\system32\dllcache\tsbyuv.dll
2010-06-28 10:21 . 2010-01-29 15:01 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2010-06-28 10:21 . 2010-01-29 15:01 691712 ——w- c:\windows\system32\dllcache\inetcomm.dll
2010-06-28 10:19 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\drivers\bthport.sys
2010-06-28 10:19 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\dllcache\bthport.sys
2010-06-28 10:19 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2010-06-28 10:18 . 2010-02-05 18:27 1291776 ——w- c:\windows\system32\dllcache\quartz.dll
2010-06-28 10:18 . 2008-10-15 16:34 337408 ——w- c:\windows\system32\dllcache\netapi32.dll
2010-06-28 10:18 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-06-28 10:18 . 2008-04-21 12:08 215552 ——w- c:\windows\system32\dllcache\wordpad.exe
2010-06-28 09:51 . 2009-05-13 01:12 26144 —-a-w- c:\windows\system32\spupdsvc.exe
2010-06-28 06:39 . 2010-06-28 06:39 ——– d-sh–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\UserData
2010-06-28 06:38 . 2010-06-28 06:38 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\PreCast
2010-06-28 06:38 . 2010-03-05 14:37 65536 ——w- c:\windows\system32\dllcache\asycfilt.dll
2010-06-28 06:34 . 2005-05-14 12:50 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Symantec
2010-06-28 06:34 . 2005-05-14 12:47 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\InterMute
2010-06-28 06:34 . 2005-05-14 12:42 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\SampleView
2010-06-28 06:34 . 2005-05-14 12:28 ——– d—–w- c:\windows\system32\config\systemprofile\WINDOWS
2010-06-28 06:34 . 2005-05-14 12:28 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Apple Computer
2010-06-28 06:28 . 2008-04-14 00:11 21504 —-a-w- c:\windows\system32\hidserv.dll
2010-06-28 06:28 . 2001-08-17 23:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2010-06-28 06:28 . 2001-08-17 23:48 12160 —-a-w- c:\windows\system32\dllcache\mouhid.sys
2010-06-28 06:28 . 2008-04-13 18:45 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2010-06-28 05:50 . 2010-07-11 09:47 ——– d-sh–r- c:\windows\system32\dllcache
2010-06-27 21:31 . 2010-06-27 21:31 ——– d—–w- c:\documents and settings\Compaq_Owner\Application Data\Tific
2010-06-27 21:31 . 2010-06-27 21:31 ——– d—–w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Symantec
2010-06-26 23:22 . 2010-06-26 23:22 ——– d—–w- c:\program files\Windows Sidebar
2010-06-26 22:50 . 2010-07-03 16:40 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-06-26 22:47 . 2010-07-03 17:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-06-26 20:59 . 2010-06-26 20:59 ——– d—–w- c:\documents and settings\Compaq_Owner\Application Data\Norton Utilities 14
2010-06-26 20:55 . 2010-06-26 20:55 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton Installer
2010-06-26 20:53 . 2010-07-12 01:42 ——– d—–w- c:\program files\Norton Utilities 14
2010-06-26 20:51 . 2010-06-26 20:52 ——– d—–w- c:\documents and settings\Compaq_Owner\Application Data\Download Manager
2010-06-26 08:51 . 2010-06-26 13:38 ——– d—–w- C:\e10946a8e70c4d3cdb21
2010-06-20 23:48 . 2010-06-20 23:48 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-12 01:51 . 2009-10-07 22:26 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-07-11 04:55 . 2009-10-25 17:53 ——– d—–w- c:\program files\Realtek AC97
2010-07-10 22:27 . 2005-05-14 12:26 ——– d—–w- c:\program files\Microsoft.NET
2010-07-10 20:18 . 2008-08-26 10:19 ——– d—–w- c:\program files\Microsoft IntelliPoint
2010-07-10 19:58 . 2009-01-10 00:49 ——– d—–w- c:\program files\SiS VGA Utilities V3.85
2010-07-10 19:57 . 2008-08-26 10:35 ——– d—–w- c:\program files\sisagp
2010-07-10 19:57 . 2005-05-14 12:09 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-08 21:06 . 2010-05-04 18:19 57344 —-a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-07-08 21:06 . 2010-03-18 04:27 ——– d—–w- c:\documents and settings\All Users\Application Data\DivX
2010-07-08 21:06 . 2010-07-08 21:06 84054 —-a-w- c:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe
2010-07-08 21:06 . 2007-03-21 04:07 ——– d—–w- c:\program files\DivX
2010-07-08 21:06 . 2010-07-08 21:06 54153 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe
2010-07-08 21:04 . 2010-03-18 04:33 1062184 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll
2010-07-08 21:02 . 2010-03-18 04:33 895256 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe
2010-07-07 20:03 . 2005-09-23 22:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-07 08:34 . 2005-05-14 12:04 ——– d—–w- c:\program files\Common Files\Java
2010-07-07 08:31 . 2010-07-07 08:31 503808 —-a-w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1d0a6f61-n\msvcp71.dll
2010-07-07 08:31 . 2010-07-07 08:31 499712 —-a-w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1d0a6f61-n\jmc.dll
2010-07-07 08:31 . 2010-07-07 08:31 12800 —-a-w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3f4e57be-n\decora-d3d.dll
2010-07-07 08:31 . 2010-07-07 08:31 61440 —-a-w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3f4e57be-n\decora-sse.dll
2010-07-07 08:31 . 2010-07-07 08:31 348160 —-a-w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1d0a6f61-n\msvcr71.dll
2010-07-04 09:00 . 2005-01-27 05:13 83187 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-07-04 09:00 . 2010-07-04 09:00 45056 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2010-07-04 09:00 . 2010-07-04 09:00 44032 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2010-07-03 17:24 . 2005-05-14 12:49 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-07-03 17:13 . 2005-05-14 12:49 ——– d—–w- c:\program files\Symantec
2010-07-03 17:13 . 2010-07-03 17:13 805 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-07-03 17:13 . 2010-07-03 17:13 7443 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-06-29 20:50 . 2010-06-29 20:50 56765 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-06-29 20:50 . 2010-06-29 20:50 56997 —-a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe
2010-06-29 20:50 . 2010-06-29 20:50 53600 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe
2010-06-29 20:50 . 2010-06-29 20:50 57715 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Player\Uninstaller.exe
2010-06-29 20:49 . 2010-06-29 20:49 57054 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DSDesktopComponents\Uninstaller.exe
2010-06-29 20:49 . 2010-06-29 20:49 54166 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DSAVCDecoder\Uninstaller.exe
2010-06-29 20:49 . 2010-06-29 20:49 57532 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DSASPDecoder\Uninstaller.exe
2010-06-29 20:49 . 2010-06-29 20:49 56458 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-06-29 20:49 . 2010-06-29 20:49 54174 —-a-w- c:\documents and settings\All Users\Application Data\DivX\DSAACDecoder\Uninstaller.exe
2010-06-29 20:48 . 2010-06-29 20:48 54128 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Converter\Uninstaller.exe
2010-06-29 20:48 . 2010-06-29 20:48 54644 —-a-w- c:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe
2010-06-29 20:48 . 2010-06-29 20:48 57409 —-a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe
2010-06-29 20:48 . 2010-06-29 20:48 54101 —-a-w- c:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe
2010-06-29 20:48 . 2010-03-18 04:32 52963 —-a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-06-29 20:48 . 2010-06-29 20:48 54073 —-a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe
2010-06-29 20:48 . 2009-12-24 08:29 ——– d—–w- c:\program files\Common Files\DivX Shared
2010-06-29 20:48 . 2010-06-29 20:48 56969 —-a-w- c:\documents and settings\All Users\Application Data\DivX\ASPEncoder\Uninstaller.exe
2010-06-29 10:21 . 2008-09-20 21:30 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-06-28 19:14 . 2005-05-14 12:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2010-06-28 19:08 . 2010-06-28 19:08 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2010-06-28 19:08 . 2010-06-28 19:08 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-06-28 18:57 . 2008-03-15 22:48 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-06-28 10:32 . 2008-03-15 22:56 ——– d—–w- c:\program files\CA Yahoo! Anti-Spy
2010-06-28 06:38 . 2005-05-14 12:37 ——– d—–w- c:\program files\Easy Internet signup
2010-06-28 06:36 . 2010-06-28 06:36 1852 –sha-r- c:\windows\system32\drivers\103C_HP_CPC_PX807AA-ABA SR1575CL NA530_YC_0Pres_QCNH523_E53NAheRED2_47_ISalmon_SASUSTek Computer INC._V1.04_B3.15_T051019_WXH2_L409_M896_J200_7AMD_8Athlon 64_92.41_#050908_N10390900_Z11C1048C_G10396330.MRK
2010-06-24 14:56 . 2009-10-11 01:57 ——– d—–w- c:\program files\CCleaner
2010-06-23 15:31 . 2009-10-17 00:27 ——– d—–w- c:\program files\Defraggler
2010-06-20 06:41 . 2010-01-15 02:00 ——– d—–w- c:\program files\Lexmark 5600-6600 Series
2010-06-06 03:21 . 2010-06-06 03:21 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\DivX
2010-05-19 08:16 . 2010-03-08 04:44 ——– d—–w- c:\program files\McAfee Security Scan
2010-05-17 15:32 . 2010-04-29 19:15 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\E5E962481DE05DDC6421D0AE2F15A524
2010-05-17 15:31 . 2010-05-11 20:09 ——– d—–w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\E5E962481DE05DDC6421D0AE2F15A524
2010-05-14 19:04 . 2010-05-14 19:04 ——– d—–w- c:\program files\Windows Defender
2010-05-07 20:41 . 2010-05-07 20:41 39424 —-a-w- c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.004\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-06 10:41 . 2004-08-04 11:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2004-08-04 12:00 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-04-27 18:40 . 2005-01-26 16:03 45648 ——w- c:\windows\system32\drivers\pxhelp20.sys
2010-04-20 05:51 . 2004-08-04 12:00 285696 —-a-w- c:\windows\system32\atmfd.dll
2010-04-17 10:04 . 2010-04-17 10:04 306032 —-a-w- c:\windows\WLXPGSS.SCR
2010-04-17 08:12 . 2010-04-17 08:12 48464 —-a-w- c:\windows\system32\sirenacm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NortonUtilities"="c:\program files\Norton Utilities 14\nu.exe" [2010-06-28 4105576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-05-14 98304]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-05-14 180269]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SiSPower"="SiSPower.dll" [2008-06-28 53248]
"USBDetector"="c:\usbstorage\USBDetector.exe" [2003-04-01 53248]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
PreCast Monitor.lnk - c:\program files\Ocucom\PreCast\tmon.exe [2008-2-12 1811120]
Utility Tray.lnk - c:\windows\system32\sistray.exe [2010-7-10 262144]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
backup=c:\windows\pss\hp psc 2000 Series.lnkCommon Startup
backupExtension=Common Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-17 08:12 3872080 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\regcmdcons]
1999-11-07 07:11 27136 —-a-w- c:\hp\bin\cloaker.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Compaq Connections\\6750491\\Program\\Compaq Connections.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1107000.00C\symds.sys [7/3/2010 7:20 AM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1107000.00C\symefa.sys [7/3/2010 7:20 AM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\BASHDefs\20100619.001\BHDrvx86.sys [6/19/2010 12:46 AM 691248]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1107000.00C\cchpx86.sys [7/3/2010 7:19 AM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1107000.00C\ironx86.sys [7/3/2010 7:20 AM 116784]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe [7/3/2010 7:19 AM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [7/3/2010 7:16 AM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\IPSDefs\20100709.001\IDSXpx86.sys [7/9/2010 10:13 PM 331640]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
.
Contents of the 'Scheduled Tasks' folder

2010-07-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 22:34]

2010-06-21 c:\windows\Tasks\Defraggler Volume C Task.job
- c:\program files\Defraggler\df.exe [2010-06-18 18:47]

2010-06-28 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Easy Internet signup\HPSdpApp.exe [2005-03-04 01:04]

2010-07-10 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2170 series272A572217594EBCF1CEE215E352B92AD073FDE4131995486.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 03:56]

2008-11-26 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2170 series272A572217594EBCF1CEE215E352B92AD073FDE4219755942.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 03:56]

2010-07-10 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2170 series272A572217594EBCF1CEE215E352B92AD073FDE4230934797.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 03:56]

2009-04-11 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2170 series272A572217594EBCF1CEE215E352B92AD073FDE4231462530.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 03:56]

2010-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 08:29]

2010-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 08:29]

2010-01-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-01-01 04:10]

2010-07-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-01-01 04:10]

2010-07-10 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 05:20]

2010-07-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1737049430-1430350790-2627329290-1009.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 08:09]

2010-07-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1737049430-1430350790-2627329290-1009.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 08:09]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{FA010552-4A27-4cb1-A1BB-3E2D697F1639} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-11 16:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.7.0.12\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2010-07-11 16:25:43
ComboFix-quarantined-files.txt 2010-07-12 02:25

Pre-Run: 139,898,777,600 bytes free
Post-Run: 139,838,849,024 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 260EE835BF7DDE876478ED15AE022278

_____________________________________________________



2. It seems okay so far……but I still think I'm going to wait 3 days. It's the only way to be SURE.
Post #33 last edited
Hello LastPaladin :),

A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use. Do not mouse click on ComboFix while it is running. That may cause it to stall.

Run ComboFix script
  • Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily when running ComboFix. They will interfere and may cause unexpected results.
  • If you need help to disable your protection programs see here and here.
  • Open Notepad. Copy and paste the following text into it:
    Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcxMonitor"=-

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  • Save it as CFScript.txt at the desktop. Make sure the Save as type: is All Files (*.*).

    [external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, a log will be produced as C:\ComboFix.txt. Copy and paste the contents of the log in your next reply.
  • If you lose Internet connection after running ComboFix, right click on the network icon at the system tray and select Repair, or you can reboot the computer.
  • Enable back your security softwares as soon as you completed the ComboFix steps.
——————–

Please post back:
1. the ComboFix log
2. computer doing OK?
Post #34 last edited
2. Presumebly you found something in the previous log that indicated that the nasty program just went dormant/was hiding/etc. Good thing I was waiting the 3 days to declare victory. (Man, this panel of judges is vicious.) :smack: Hopefully this got it, but I'm still re-starting the count-down at 3 days. :pullhair: EDIT BTW, I've run "CA Yahoo! Anti-Spy" after the both runs of Combofix and it found (and supposedly removed): 1. WinSpywareProtect————–Listed as: Rogue Security 2. WinAntiVirusPro 2006———–Listed as: Rogue Security 3. Bifrost——————————–Listed as: Backdoor Could Combofix be loading these onto my computer or the websites I've visited?

Attachments:

Post #35
Hello LastPaladin :),

Presumebly you found something in the previous log that indicated that the nasty program just went dormant/was hiding/etc. Good thing I was waiting the 3 days to declare victory. (Man, this panel of judges is vicious.)

It was something that requires removing, but has nothing to do with your problem.

For Antispyware program, my choice is MBAM, and ComboFix is safe.

the websites I've visited?

Most likely you get infected that way. You should be more careful when surfing. I will have recommendations for you later.

Please do not install any programs during the cleaning process and try to limit your internet access too. My efforts for you would go to waste if you continuously infect yourself as soon as finishing some steps I requested you to perform.

If your autoplay issue did not reoccur by now, I would say it is already solved. Please post a new OTL log.

——————–

I want you to update MBAM and run a scan.
  • Open MBAM and click on the Update tab, then Check for Updates.
  • When completed, go to back to the Scanner tab and select Perform full scan. Click Scan.
  • Leave the default options as it is and click on Start Scan.
  • If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process.
  • When done, you will be prompted. Click OK, then click on Show Results.
  • Check (tick) all items except items in the C:\System Volume Information folder and click on Remove Selected.
  • After it has removed the items, a log in Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware. If you receive an (Error Loading) error on reboot, please reboot a second time . It is normal for this error to occur once and does not need to be reported unless it returns on future reboots.

——————–

Please post back:
1. new OTL log
2. the MBAM report
Post #36
On the plus (and minus) side, the site were I probably got infected with most of this stuff was closed down (eliminated) by Justice 2 weeks ago. Sadly I will have to open (and read) a book if I'm going to limit my internet access. Fortunately my friend is starting a new Traveller campaign soon (OLD Traveller where you can die in character generation) so I can read some of those. The only programs I have downloaded were the Microsoft upgrades to get to SP3 (from the Microsoft site) since my friend said they were going to stop supporting SP2 soon (today?). And those were done near the beginning of the month, not too recently. I'll wait until we're done here to install/download anything else. I REALLY don't want to waste your efforts. Ummmm, I have 2 MBAM reports attached. The 24_51 is before I cleaned and the 25_07 is after. I know you said not to remove anything from the "C:\System Volume Information", but it only found 2 things, both of which were in there. And one was a Backdoor.

Attachments:

Post #37
Hello LastPaladin :),

Windows updates during a malware removal process is not a good idea as it may interfere with the procedures that we need to go through.

——————–

Your Adobe Reader is outdated. Older versions have security vulnerabilities that can be exploited.

Please update your Adobe Reader to the latest.
It is important that you uninstall any previous versions by using Add/Remove Programs in your Control Panel before installing a newer version. Please uninstall:

Adobe Reader 6.0.1

  • Go to the Adobe download page. Click here.
  • If your OS is not the same as stated, click on Different language or operating system? link.
    • Under the Select an operating system title, click on Select an OS… box and choose the OS that you have.
    • Change the language if you want by clicking on English below the Select a language title.
    • Press Continue.
    • Uncheck (untick) Free McAfee Security Scan (optional).
    • Click the Download now button after selecting the latest version.
    • Allow if prompted and save the file to a convenient location.
    • Run the downloaded file to continue with the installation.
  • If your OS is the same, uncheck (untick) Free McAfee Security Scan (optional).
  • Click Download to proceed. Allow if prompted and save the file to a convenient location.
  • Run the downloaded file to continue with the installation.
——————–

Your Java Runtime Environment is outdated. Older versions have security vulnerabilities that can be exploited.

Please update JRE to the latest.
It is important that you uninstall any previous versions by using Add/Remove Programs in your Control Panel before installing a newer version. Please uninstall:

J2SE Runtime Environment 5.0

  • Go to the Java SE download page. Click here.
  • Look for JDK 6 Update 21 (JDK or JRE). Click the Download JRE button to the right.
  • Select Windows from the drop-down list for Platform.
  • Check I agree to the Java SE Runtime Environment 6u21 with JavaFX 1 License Agreement after reading it, and click Continue >>. The page will refresh.
  • Under the Windows Offline Installation title, click on the link which says jre-6u21-windows-i586.exe and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Then, from your desktop, double click on the download to install the newest version. Reboot your computer.
——————–

Do an online scan with Kaspersky Online Scanner.
Please be patient as scanning will take quite some time. If you have problem running the scan, you might want to disable any real time protection that you have.
  • Click here to go to Kaspersky Online Scanner page.
  • Read through the requirements and privacy statement and click on the Accept button.
  • Download and installation of the scanner and virus definitions will begin. If prompted to install from Kaspersky, please proceed.
  • When the downloads have finished, click on Settings on the lower left of the window.
  • Make sure all these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
    • Archives
    • Mail databases
  • Click on My Computer under Scan tab to start scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place as KasperskyScan.txt. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Post the contents of that report in your reply.
——————–

Please post back:
1. the Kaspersky online scan result
2. ready to declare that the autoplay problem is gone?
Post #39
Hello LastPaladin :),

BTW, was that a new Virus/Malware, or just something that hasn't been around for a while?

It has something to do with your system settings that must have somehow got corrupted. It could be malware, or not, that messed it up. Regardless, we manage to solve your problem.

——————–

Congratulations, you are All Clear to go. Glad to hear everything is good and running :). If you have any more problems, please let me know.

Now we need to clear out the programs we have been using to clean up your computer. They are not suitable for general malware removal and could cause damage if used inappropriately.
  • Go to Start > Run…. Copy and paste the following text into the white box:
    ComboFix /uninstall
    Click OK.
  • Run OTL by double clicking on OTL.exe. Click on CleanUp, proceed to reboot if prompted.
  • Delete the GMER (4lzbrrut.exe), VEW, folderlook.bat, USBNoRisk and RegQuery files on your desktop.
  • Delete any logs on the desktop.
Some tips to help you stay clean and safe:

1. Keep your Windows up to date. Enable Automatic Updates to always update the latest security patches from Microsoft, or you can download from the Microsoft website. Otherwise, your computer will be vulnerable to new exploits or malwares.

2. Purge System Restore. A recovery feature will only be useful if it is clean from malwares. See Windows XP System Restore Guide for some detail explanations.

3. Update your Antivirus program regularly, it is a must for constant protection against viruses. Please keep only one AV installed.

4. Install Malwarebytes' Anti-Malware if you haven't and use it occasionally. It is a new and powerful anti-malware tool, totally free but for real-time protection you will have to pay a small one-time fee.

5. Install WinPatrol, a great protection program that helps you monitor for unwanted files or applications.

6. Use a hosts file to block the access of bad sites from your computer. Get yourself a MVPS Hosts for this purpose.

7. Install Web of Trust (WOT). WOT keeps you from dangerous websites with warnings and blockings.

8. Protect your computer from removable or USB drive infections with Panda USB Vaccine, an effective method to prevent malware from spreading.

9. Keep all your softwares updated. Visit Secunia Software Inspector to find out if any updates required.

10. If you have been a victim of malware before, Stand Up and Be Counted —> Malware Complaints <— where you can make difference!

11. Also look up How to prevent malware: By miekiemoes and So how did I get infected in the first place? By Tony Klein.

Stay safe.

If you have been helped and wish to donate to support this volunteer site, go to Donations For What The Tech.
Post #40
Thanks for all your help (and your patience). I will definitely remember this site and tell anyone about it if they have any problems with their computers.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI