What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google Redirect

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I'm trying to ask around for a windows xp cd


ComboFix 10-08-07.01 - User 08/08/2010 10:53:43.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.333 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\winlogon.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-07-08 to 2010-08-08 )))))))))))))))))))))))))))))))
.

2010-08-07 14:20 . 2010-08-07 14:20 ——– d—–w- c:\documents and settings\User\Application Data\Malwarebytes
2010-08-07 14:20 . 2010-08-07 14:20 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-07 14:20 . 2010-04-29 07:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-07 14:20 . 2010-08-07 14:20 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-07 14:20 . 2010-04-29 07:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-08-06 10:57 . 2010-08-07 00:45 ——– d—–w- c:\documents and settings\User\Application Data\Bitrix Security
2010-07-29 03:25 . 2010-07-29 03:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Driver Mender
2010-07-23 04:58 . 2010-07-23 04:58 1373536 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll
2010-07-23 04:58 . 2010-07-23 04:58 921440 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgemc.exe
2010-07-23 04:58 . 2010-07-23 04:58 1107296 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
2010-07-23 04:58 . 2010-07-23 04:58 4368224 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-07-12 06:40 . 2009-04-22 06:54 103552 —-a-r- c:\windows\system32\drivers\qscnusb.sys
2010-07-12 06:39 . 2010-07-29 01:48 ——– d—–w- c:\program files\PC Suite
2010-07-09 06:10 . 2010-07-09 06:10 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-09 06:10 . 2010-07-09 06:10 ——– d—–w- c:\program files\Java
2010-07-09 06:04 . 2010-07-09 06:04 1039712 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-07 11:20 . 2010-05-07 00:14 ——– d—–w- c:\program files\Graboid
2010-08-07 11:19 . 2010-05-03 12:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-08-07 11:19 . 2010-05-21 07:57 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-08-07 00:53 . 2010-01-13 10:12 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-07-30 02:54 . 2010-05-03 08:37 ——– d—–w- c:\documents and settings\All Users\Application Data\DivX
2010-07-29 23:03 . 2009-11-22 11:07 ——– d—–w- c:\documents and settings\User\Application Data\uTorrent
2010-07-29 13:02 . 2010-05-29 13:41 ——– d—–w- c:\documents and settings\User\Application Data\vlc
2010-07-29 10:54 . 2009-11-22 10:59 ——– d—–w- c:\program files\Red Alert 2 Yuri's Revenge
2010-07-27 08:08 . 2009-11-26 14:15 ——– d—–w- c:\documents and settings\User\Application Data\Skype
2010-07-27 08:00 . 2009-11-26 14:18 ——– d—–w- c:\documents and settings\User\Application Data\skypePM
2010-06-27 10:18 . 2009-11-11 02:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-22 07:01 . 2010-01-13 10:13 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-22 07:01 . 2010-06-22 07:01 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-06-22 06:59 . 2010-01-13 10:12 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-14 14:31 . 2009-11-10 08:01 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-03 00:28 . 2010-06-03 19:05 52224 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
2010-06-03 00:28 . 2010-06-03 19:05 101376 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
2010-06-01 03:06 . 2010-01-13 10:12 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-29 19:22 . 2010-05-29 19:22 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2aa3e78b-n\msvcp71.dll
2010-05-29 19:22 . 2010-05-29 19:22 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2aa3e78b-n\jmc.dll
2010-05-29 19:22 . 2010-05-29 19:22 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2aa3e78b-n\msvcr71.dll
2010-05-29 19:22 . 2010-05-29 19:22 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4625104a-n\decora-sse.dll
2010-05-29 19:22 . 2010-05-29 19:22 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4625104a-n\decora-d3d.dll
2010-05-19 15:19 . 2009-11-11 05:04 28264 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

——- Sigcheck ——-

[-] 2008-04-14 . 7A9B5F952FF7909588A4C4FDAE78AA00 . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2009-11-10 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-07 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-07 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-07 138008]
"RTHDCPL"="RTHDCPL.EXE" [2007-11-30 16858624]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-22 2065760]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\User\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-22 07:01 12536 —-a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [13/01/2010 6:13 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13/01/2010 6:12 PM 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13/01/2010 6:13 PM 243024]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [23/07/2010 12:57 PM 921952]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [5/03/2010 2:41 PM 308136]
S3 MobileAdapter;Mobile Adapter USB Modem and USB Serial;c:\windows\system32\drivers\qscnusb.sys [12/07/2010 2:40 PM 103552]
.
Contents of the 'Scheduled Tasks' folder

2010-08-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34]
.
.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-08 10:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-08-08 10:58:43
ComboFix-quarantined-files.txt 2010-08-08 02:58
ComboFix2.txt 2010-08-08 00:56

Pre-Run: 28,822,507,520 bytes free
Post-Run: 28,815,290,368 bytes free

- - End Of File - - 5DA2910AEC42DFED6829EE62D121E1B2
Post #17
I'm trying to ask around for a windows xp cd


ComboFix 10-08-07.01 - User 08/08/2010 10:53:43.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.333 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\winlogon.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-07-08 to 2010-08-08 )))))))))))))))))))))))))))))))
.

2010-08-07 14:20 . 2010-08-07 14:20 ——– d—–w- c:\documents and settings\User\Application Data\Malwarebytes
2010-08-07 14:20 . 2010-08-07 14:20 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-07 14:20 . 2010-04-29 07:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-07 14:20 . 2010-08-07 14:20 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-07 14:20 . 2010-04-29 07:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-08-06 10:57 . 2010-08-07 00:45 ——– d—–w- c:\documents and settings\User\Application Data\Bitrix Security
2010-07-29 03:25 . 2010-07-29 03:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Driver Mender
2010-07-23 04:58 . 2010-07-23 04:58 1373536 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll
2010-07-23 04:58 . 2010-07-23 04:58 921440 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgemc.exe
2010-07-23 04:58 . 2010-07-23 04:58 1107296 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll
2010-07-23 04:58 . 2010-07-23 04:58 4368224 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-07-12 06:40 . 2009-04-22 06:54 103552 —-a-r- c:\windows\system32\drivers\qscnusb.sys
2010-07-12 06:39 . 2010-07-29 01:48 ——– d—–w- c:\program files\PC Suite
2010-07-09 06:10 . 2010-07-09 06:10 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-09 06:10 . 2010-07-09 06:10 ——– d—–w- c:\program files\Java
2010-07-09 06:04 . 2010-07-09 06:04 1039712 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-07 11:20 . 2010-05-07 00:14 ——– d—–w- c:\program files\Graboid
2010-08-07 11:19 . 2010-05-03 12:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-08-07 11:19 . 2010-05-21 07:57 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-08-07 00:53 . 2010-01-13 10:12 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-07-30 02:54 . 2010-05-03 08:37 ——– d—–w- c:\documents and settings\All Users\Application Data\DivX
2010-07-29 23:03 . 2009-11-22 11:07 ——– d—–w- c:\documents and settings\User\Application Data\uTorrent
2010-07-29 13:02 . 2010-05-29 13:41 ——– d—–w- c:\documents and settings\User\Application Data\vlc
2010-07-29 10:54 . 2009-11-22 10:59 ——– d—–w- c:\program files\Red Alert 2 Yuri's Revenge
2010-07-27 08:08 . 2009-11-26 14:15 ——– d—–w- c:\documents and settings\User\Application Data\Skype
2010-07-27 08:00 . 2009-11-26 14:18 ——– d—–w- c:\documents and settings\User\Application Data\skypePM
2010-06-27 10:18 . 2009-11-11 02:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-22 07:01 . 2010-01-13 10:13 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-22 07:01 . 2010-06-22 07:01 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-06-22 06:59 . 2010-01-13 10:12 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-14 14:31 . 2009-11-10 08:01 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-03 00:28 . 2010-06-03 19:05 52224 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
2010-06-03 00:28 . 2010-06-03 19:05 101376 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
2010-06-01 03:06 . 2010-01-13 10:12 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-05-29 19:22 . 2010-05-29 19:22 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2aa3e78b-n\msvcp71.dll
2010-05-29 19:22 . 2010-05-29 19:22 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2aa3e78b-n\jmc.dll
2010-05-29 19:22 . 2010-05-29 19:22 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-2aa3e78b-n\msvcr71.dll
2010-05-29 19:22 . 2010-05-29 19:22 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4625104a-n\decora-sse.dll
2010-05-29 19:22 . 2010-05-29 19:22 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-4625104a-n\decora-d3d.dll
2010-05-19 15:19 . 2009-11-11 05:04 28264 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

——- Sigcheck ——-

[-] 2008-04-14 . 7A9B5F952FF7909588A4C4FDAE78AA00 . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2009-11-10 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-07 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-07 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-07 138008]
"RTHDCPL"="RTHDCPL.EXE" [2007-11-30 16858624]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-22 2065760]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\User\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-22 07:01 12536 —-a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [13/01/2010 6:13 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [13/01/2010 6:12 PM 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [13/01/2010 6:13 PM 243024]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [23/07/2010 12:57 PM 921952]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [5/03/2010 2:41 PM 308136]
S3 MobileAdapter;Mobile Adapter USB Modem and USB Serial;c:\windows\system32\drivers\qscnusb.sys [12/07/2010 2:40 PM 103552]
.
Contents of the 'Scheduled Tasks' folder

2010-08-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 04:34]
.
.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\vhvlcub6.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-08 10:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-08-08 10:58:43
ComboFix-quarantined-files.txt 2010-08-08 02:58
ComboFix2.txt 2010-08-08 00:56

Pre-Run: 28,822,507,520 bytes free
Post-Run: 28,815,290,368 bytes free

- - End Of File - - 5DA2910AEC42DFED6829EE62D121E1B2
Post #18
If anyone has a Windows XP computer, you can copy their winlogon.exe form that computer and copy it over to your c:\windows\system32\winlogon.exe

Is this something I should be really worried about, like should I postpone using internet banking and university log-in website until it's fixed??

I wouldn't use it for internet banking until you replace that infected file. I don't know what it's infected by.

After you replace the infected file be sure change all your passwords.

Make sure you do this now.

  • Click START run
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
Post #19
Ok, thanks Have uninstalled combofix. Do I need to find someone with a windows xp cd or can i copy something from their computer without it?
Post #20 last edited
It will be easier to copy it from their computer. Do you think you know how to do tthat? Getr a USB device like a thumb drive. Go to their c:\windows\system32\ and find winlogon.exe, copy winlogon.exe to your USB, take the USB and copy winlogon.exe to your c:\windows\system32\ let it overright the infected winlogon.exe.
Post #23
How do you find the "c:\windows\system32\" on their computer??? Also, if the computers at uni have windows xp can I copy it from them somehow or do I have to have someones permission or password or something??? Cheers
Post #24
Get a USB device like a thumb drive to copy the file to.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Double-click My Computer.
Open the Local Disk C:
Open Windows
Open System32
Look for winlogon.exe
Right Click on winlogon.exe and select Copy and copy it to the thumb drive.

Once you have it on the thumb drive, plug it into your computer, Double-click My Computer, open the thumb drive by double clicking the drive.
Find winlogon.exe
Right Click on winlogon.exe and select Copy
Minimize the window you have open

Double-click My Computer.
Open the Local Disk C:
Open Windows
Open System32

When you have the system32 folder open, Right Click on a open are and select Paste.
Allow it to overwrite the existing winlogon.exe file.
Post #25
Thanks heaps for your help, but I couldn't find anyone with xp on their computer and I have a report due friday so I just took my computer to the shop to get fixed. I really appriciate your help though.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI