What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

dds.scr opens in notepad

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
ComboFix 2nd run log

ComboFix 10-08-22.07 - Robearz 08/23/2010 12:48:34.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1385 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Robearz\Desktop\CFScript.txt
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Endpoint Protection *disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.

((((((((((((((((((((((((( Files Created from 2010-07-23 to 2010-08-23 )))))))))))))))))))))))))))))))
.

2010-08-14 03:20 . 2010-08-14 03:20 ——– d—–w- c:\program files\QuickTime
2010-08-14 03:07 . 2010-08-14 03:07 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Adobe
2010-08-14 03:06 . 2010-08-14 03:06 ——– d—–w- c:\documents and settings\Robearz\Application Data\Wireshark
2010-08-14 02:37 . 2010-08-14 02:37 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\Malwarebytes
2010-08-14 00:13 . 2010-08-14 00:13 ——– d—–w- c:\documents and settings\Robearz\Application Data\Malwarebytes
2010-08-14 00:13 . 2010-08-14 00:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-14 00:13 . 2010-04-29 22:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-14 00:13 . 2010-08-14 00:13 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-14 00:13 . 2010-04-29 22:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-08-13 22:56 . 2010-08-14 02:44 1927 —-a-w- c:\documents and settings\Robearz\Application Data\iolo\restore.bat
2010-08-13 22:28 . 2010-08-13 22:28 ——– d-sh–w- c:\documents and settings\Robearz\IECompatCache
2010-08-10 16:52 . 2010-08-10 16:52 ——– d-sh–w- c:\documents and settings\AllOfUs\IECompatCache
2010-08-10 16:20 . 2010-08-10 16:20 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\Helios
2010-08-08 04:33 . 2010-08-08 04:34 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\vlc
2010-08-06 00:16 . 2010-08-06 00:16 ——– d-sh–w- c:\documents and settings\AllOfUs\PrivacIE
2010-08-05 21:17 . 2010-08-05 21:17 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\ABBYY
2010-08-05 21:04 . 2010-08-05 21:04 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\ABBYY
2010-08-05 21:04 . 2010-08-05 21:04 ——– d—–w- c:\documents and settings\Robearz\Application Data\EPSON
2010-08-05 20:59 . 2010-08-17 05:11 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\EPSON
2010-08-05 20:45 . 2010-08-05 20:45 ——– d—–w- C:\EPSONREG
2010-08-05 20:34 . 2010-08-05 21:04 ——– d—–w- c:\program files\ABBYY FineReader 6.0 Sprint
2010-08-05 20:30 . 2006-08-25 00:00 9216 —-a-w- c:\windows\system32\escdev.dll
2010-08-05 20:30 . 2007-11-29 07:00 73216 —-a-w- c:\windows\system32\eswia7c.dll
2010-08-05 20:30 . 2007-10-18 07:00 65793 —-a-w- c:\windows\system32\esfw7c.bin
2010-08-05 20:30 . 2007-10-18 07:00 221184 —-a-w- c:\windows\system32\esint7c.dll
2010-08-05 20:30 . 2006-03-10 07:00 3584 —-a-w- c:\windows\system32\eswiaml.dll
2010-08-05 07:28 . 2010-08-23 17:33 518 —-a-w- c:\documents and settings\Robearz\Application Data\iolo\Registry\Last\restore.bat
2010-08-05 00:36 . 2010-08-05 01:55 ——– d—–w- c:\windows\system32\NtmsData
2010-08-04 04:26 . 2010-08-04 04:26 ——– d—–w- c:\documents and settings\Robearz\Application Data\Helios
2010-08-04 04:26 . 2010-08-04 04:26 ——– d—–w- c:\program files\TextPad 5
2010-08-04 02:29 . 2010-08-04 02:29 ——– d—–w- c:\documents and settings\Robearz\Application Data\Leadertech
2010-08-04 02:20 . 2010-08-04 02:21 ——– d—–w- c:\program files\EPSON Print CD
2010-08-04 02:20 . 2006-04-18 11:00 102400 —-a-w- c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE
2010-08-04 02:20 . 2010-08-04 02:20 ——– d—–w- c:\documents and settings\All Users\Application Data\EPSON
2010-08-04 02:19 . 2010-08-05 20:31 ——– d—–w- c:\program files\EPSON
2010-08-02 21:04 . 2010-08-02 21:04 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Opera
2010-08-02 21:02 . 2010-08-02 21:02 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Mozilla
2010-08-02 20:42 . 2010-08-02 20:42 ——– d—–w- c:\documents and settings\Robearz\Application Data\InstallShield
2010-08-02 20:23 . 2010-08-02 20:23 70432 —-a-w- c:\documents and settings\Robearz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-02 20:23 . 2010-08-02 21:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Qwest
2010-08-02 20:23 . 2010-08-02 20:23 ——– d—–w- c:\windows\XSxS
2010-08-02 20:23 . 2010-08-02 20:23 ——– d—–w- c:\program files\Xenocode
2010-08-02 20:23 . 2010-08-02 20:23 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Xenocode
2010-07-31 01:43 . 2010-07-31 01:43 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\FileOpen
2010-07-31 01:24 . 2010-07-31 01:45 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Adobe
2010-07-31 00:47 . 2010-05-24 00:50 73216 —-a-w- c:\documents and settings\AllOfUs\Application Data\Mozilla\Firefox\Profiles\dn2zuyev.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
2010-07-31 00:47 . 2010-04-18 21:33 307200 —-a-w- c:\documents and settings\AllOfUs\Application Data\Mozilla\Firefox\Profiles\dn2zuyev.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\psftp.exe
2010-07-31 00:47 . 2010-04-18 21:33 172032 —-a-w- c:\documents and settings\AllOfUs\Application Data\Mozilla\Firefox\Profiles\dn2zuyev.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\puttygen.exe
2010-07-31 00:26 . 2010-07-31 00:26 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Math workpad
2010-07-31 00:15 . 2010-07-31 00:15 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Spirograph
2010-07-30 06:01 . 2010-07-30 06:01 ——– d-sh–w- c:\documents and settings\Robearz\PrivacIE
2010-07-30 05:01 . 2007-10-23 16:27 110592 —-a-w- c:\documents and settings\AllOfUs\Application Data\U3\temp\cleanup.exe
2010-07-30 04:53 . 2010-07-31 00:26 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Opera
2010-07-30 04:16 . 2010-07-30 04:16 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Mozilla
2010-07-30 04:15 . 2008-05-02 17:41 3493888 —ha-w- c:\documents and settings\AllOfUs\Application Data\U3\temp\Launchpad Removal.exe
2010-07-30 04:15 . 2010-08-20 06:01 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\U3
2010-07-30 00:25 . 2010-07-30 00:25 70432 —-a-w- c:\documents and settings\AllOfUs\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-30 00:22 . 2010-08-06 22:54 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\Apple Computer
2010-07-30 00:22 . 2010-07-30 00:25 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Apple Computer
2010-07-30 00:22 . 2010-07-30 00:22 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\iolo
2010-07-30 00:08 . 2007-10-23 16:27 110592 —-a-w- c:\documents and settings\Robearz\Application Data\U3\temp\cleanup.exe
2010-07-30 00:06 . 2008-05-02 17:41 3493888 —ha-w- c:\documents and settings\Robearz\Application Data\U3\temp\Launchpad Removal.exe
2010-07-30 00:06 . 2010-07-30 00:06 ——– d—–w- c:\documents and settings\Robearz\Application Data\Apple Computer
2010-07-30 00:06 . 2010-07-30 00:06 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Apple Computer
2010-07-30 00:06 . 2010-08-23 17:03 ——– d—–w- c:\documents and settings\Robearz\Application Data\U3
2010-07-30 00:06 . 2010-08-13 22:56 ——– d—–w- c:\documents and settings\Robearz\Application Data\iolo
2010-07-29 23:29 . 2010-07-29 23:29 ——– d—–w- c:\program files\iPod
2010-07-29 23:14 . 2010-07-29 23:15 3782822 —-a-w- c:\temp\ConvertHelperSetup.exe
2010-07-29 23:14 . 2010-07-29 23:14 ——– d—–w- c:\program files\ConvertHelper
2010-07-29 23:10 . 2010-07-29 23:10 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-23 19:29 . 2010-02-17 08:05 ——– d—–w- c:\documents and settings\NetworkService\Application Data\VMware
2010-08-23 19:29 . 2010-01-15 02:44 ——– d—–w- c:\documents and settings\All Users\Application Data\VMware
2010-08-23 19:22 . 2010-06-29 01:21 845688 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-08-14 03:14 . 2008-07-29 03:01 ——– d—–w- c:\program files\Opera
2010-08-14 03:07 . 2009-04-22 06:35 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-08-12 06:59 . 2008-07-23 03:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-07 22:20 . 2010-04-16 16:08 ——– d—–w- c:\program files\Wireshark
2010-08-07 22:20 . 2010-04-16 16:09 ——– d—–w- c:\program files\WinPcap
2010-08-05 20:33 . 2008-07-23 00:17 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-05 20:33 . 2008-07-23 00:15 ——– d—–w- c:\program files\Common Files\InstallShield
2010-08-02 21:09 . 2010-02-17 17:57 ——– d—–w- c:\program files\Qwest
2010-07-29 23:30 . 2010-07-01 05:34 ——– d—–w- c:\program files\iTunes
2010-07-29 23:29 . 2008-08-05 01:19 ——– d—–w- c:\program files\Common Files\Apple
2010-07-23 06:08 . 2010-01-12 23:37 ——– d—–w- c:\documents and settings\All Users\Application Data\TestOut
2010-07-18 04:54 . 2010-07-18 04:54 160272 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2010-07-18 00:14 . 2010-03-07 04:53 ——– d—–w- c:\program files\Sophos
2010-07-15 20:18 . 2010-07-30 00:21 53632 —-a-w- c:\documents and settings\AllOfUs\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-15 20:18 . 2010-07-30 00:05 53632 —-a-w- c:\documents and settings\Robearz\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-12 04:44 . 2010-03-30 01:28 ——– d—–w- c:\program files\VideoLan
2010-07-12 04:27 . 2008-08-02 14:31 ——– d—–w- c:\documents and settings\All Users\Application Data\iolo
2010-07-06 22:16 . 2009-12-11 18:28 94384 —-a-w- c:\windows\system32\IncContxMenu.dll
2010-07-06 22:16 . 2009-12-11 18:28 2319536 —-a-w- c:\windows\system32\Incinerator.dll
2010-07-01 05:27 . 2010-07-01 05:27 ——– d—–w- c:\program files\Bonjour
2010-06-30 12:31 . 2004-08-04 04:56 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-25 17:07 . 2010-06-25 17:07 281104 —-a-w- c:\windows\system32\wpcap.dll
2010-06-25 17:07 . 2010-06-25 17:07 100880 —-a-w- c:\windows\system32\Packet.dll
2010-06-25 17:07 . 2010-06-25 17:07 35088 —-a-w- c:\windows\system32\drivers\npf.sys
2010-06-25 17:03 . 2010-06-25 17:03 53299 —-a-w- c:\windows\system32\pthreadVC.dll
2010-06-24 12:22 . 2004-08-04 04:56 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-04 03:17 1851904 —-a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 03:14 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 04:56 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2008-07-22 23:14 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 04:56 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-06-03 02:59 . 2007-06-19 22:08 161920 —-a-w- c:\windows\system32\drivers\WpsHelper.sys
2010-05-28 11:04 . 2010-05-28 11:04 14896 —-a-w- c:\windows\system32\drivers\psi_mf.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2010-07-04 398568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-01 115560]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"nwiz"="nwiz.exe" [2006-07-20 1519616]
"ScreenPrint32"="c:\program files\ScreenPrint32 v3\ScreenPrint32.exe" [2003-05-16 446464]
"SkyTel"="SkyTel.EXE" [2006-05-17 2879488]
"SystemGuardAlerter"="c:\program files\iolo\System Mechanic\SystemGuardAlerter.exe" [2010-07-06 522928]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2010-01-23 129584]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-05 16061440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"EEventManager"="c:\program files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 102400]

c:\documents and settings\AllOfUs\Start Menu\Programs\Startup\
Windows Explorer.lnk - c:\windows\explorer.exe [2004-8-3 1033728]

c:\documents and settings\Robearz\Start Menu\Programs\Startup\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2010-5-28 911920]
Windows Explorer.lnk - c:\windows\explorer.exe [2004-8-3 1033728]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
LaunchU3.exe.lnk - c:\windows\Installer\{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}\_294823.exe [2010-1-14 22486]
PHOTOfunSTUDIO -viewer-.lnk.disabled [2008-12-25 1736]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rootrepeal.sys]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ArcSoft Connection Service"=c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"KONICA MINOLTA magicolor 2400W STD"=c:\windows\system32\MSTMON_S.EXE STARTUP
"quickcare"=c:\program files\Qwest\Quickcare\bin\sprtcmd.exe /P QuickCare

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=
"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Cybered\\Algebra Equation Solver\\AEqSolvr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\TestOut\\Orbis\\Legacy\\LegacyXEng.exe"=
"c:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [12/11/2009 11:28 AM 711352]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [12/11/2009 11:28 AM 711352]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6/25/2010 10:07 AM 35088]
R2 OrbisClient.Services;LabSim Configuration and Security;c:\program files\TestOut\Orbis\OrbisClient.Services.exe [6/14/2010 2:13 PM 14336]
R2 sprtlisten;SupportSoft Listener Service;c:\program files\Common Files\SupportSoft\bin\sprtlisten.exe [1/8/2008 12:02 PM 1213728]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [1/22/2010 10:14 PM 70704]
R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [1/22/2010 9:00 PM 563760]
S2 DirMngr;DirMngr;c:\program files\GNU\GnuPG\dirmngr.exe [5/29/2010 3:11 AM 242176]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [5/29/2007 11:55 AM 23888]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\8.tmp –> c:\windows\system32\8.tmp [?]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr73.sys [7/22/2008 5:14 PM 247808]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [5/28/2010 4:04 AM 14896]
S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2/16/2010 5:28 PM 38976]

— Other Services/Drivers In Memory —

*Deregistered* - EraserUtilDrv11010
*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2010-08-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 19:34]

2010-08-20 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-23 22:31]

2010-08-18 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2008-07-23 22:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.blinkpro.com/
mWindow Title = spybot ie custom title all users ie tweaks
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files\VMware\VMware Workstation\vsocklib.dll
FF - ProfilePath - c:\documents and settings\Robearz\Application Data\Mozilla\Firefox\Profiles\3bosuaej.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.blinkpro.com/|http://www.google.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\Mozilla Firefox\defaults\profile\user.js - user_pref("capability.policy.policynames", "allowclipboard");
c:\program files\Mozilla Firefox\defaults\profile\user.js - user_pref("capability.policy.allowclipboard.sites", "http://www.mozilla.org http://www.myway.com http://webmail.myway.com");
c:\program files\Mozilla Firefox\defaults\profile\user.js - user_pref("capability.policy.allowclipboard.Clipboard.cutcopy", "allAccess");
c:\program files\Mozilla Firefox\defaults\profile\user.js - user_pref("capability.policy.allowclipboard.Clipboard.paste", "allAccess");.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-23 12:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\8.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2912)
c:\windows\system32\WININET.dll
c:\program files\iolo\Common\Lib\sguard.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-08-23 12:58:46
ComboFix-quarantined-files.txt 2010-08-23 19:58

Pre-Run: 66,971,090,944 bytes free
Post-Run: 66,956,058,624 bytes free

- - End Of File - - CBCEA4C05DB7D3EE4A1F5B3B381BE031
Post #18
NEXT POST: Kaspersky log Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4467 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 8/23/2010 1:38:28 PM mbam-log-2010-08-23 (13-38-28).txt Scan type: Quick scan Objects scanned: 148148 Time elapsed: 10 minute(s), 40 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #19
——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Monday, August 23, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, August 23, 2010 14:43:11 Records in database: 4138022 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 75198 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 02:25:13 No threats found. Scanned area is clean. Selected area has been scanned.
Post #21
Computer is operating 'normally'. Thanks very much for your help. I was running the browser inside 'sandboxie' when Symantec logged the threat. Is it possible that the suspected infection occurred inside the sandbox and that my OS was not impacted? I've read that some infections are able to cross from inside a sandbox to the os. Thanks again.
Post #22
yes, it does appear as though the threat was contained. I suppose it is possible to cross through to an OS depending on the infection but I cannot be certain of that as i have not tested it.

just some housekeeping to do now

please do the following;

You can delete the MBRCheck, DDS and GMER folders from your desktop.


NEXT

Follow these steps to uninstall Combofix
Make sure your security programs are totally disabled.
Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.


[external image: Posted Image]



If there are any logs/tools remaining > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  • Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/

    This will ensure your computer has always the latest security updates available installed on your computer.


  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.


  • DownloadTFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    • It's normal after running TFC cleaner that the PC will be slower to boot the first time.


  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Greento go
    • Yellow for caution
    • Red to stop
    • WOT has an addon available for both Firefox and IE


  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
  • Think Prevention.
  • PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI