What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Bredolab.fb Trojan

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm pretty new with all this computer stuff. I'm running Windows XP with service pack 3. The other day I was chatting with a friend on yahoo messenger/chat and this thing came up saying "is this you pic - and then it had a link". I thought the person I was talking/chatting with sent it to me since it came up as a message from them. I clicked on the link and it downloaded a Trojan on my computer(but I didn't know it yet). I later asked that person about it and they said they had gotten the same thing too and that they DIDN'T send it to me. That's when I realized something wasn't right and so I did a scan with Spyware Terminator but that didn't pick up anything. The person I was talking to said to get Spybot search and destroy. So, I downloaded Spybot search and destroy - ran a scan and it came up with this Bredolab.fb Trojan and under it had 7 files listed a few of which were registry files. When I clicked on the "Fix Selected Problems" a box came up saying it would delete all the files and I didn't want to do that being that there were registry files there, so I canceled out. As I was looking around about what to do on the internet I came across this Malawarebytes program. I downloaded the Malawarebytes and ran a scan and it picked up the Trojan. I liked this program better cuz it quarantined the files instead of just deleting them. And that's what I did, I had the Malawarebytes take care of the Trojan - or so I thought. When I did another Malawarebytes scan it told me "scan completed successfully. No malicious files were detected." So I thought my computer was clean. I decided to do another scan with the Spybot thinking it would come out clean now but it is still showing that Bredolab.fb Trojan but this time it only has 1 file listed under it that says - (SBI $708C5CB6) Data G:\Windows\mdll.dl - and when I click on "Fix Selected Problems" a box comes up saying it will delete the files, so I canceled out. I didn't want to delete this file because I thought those dll files were registry files and didn't want to mess up my computer but I want to get rid of this Trojan. Would it be alright for me to go ahead and let the Spybot delete this file? Will it mess up my computer if I let it delete this file? Or is there something else I should do? Please help! Thank you! Oh, most peoples hard drives are listed as C:\ but for some odd reason mine is G:\ I bought my computer used, so the person who had it before me must have set it up this way. Just in case you were wondering when I typed about that windows file - G:\Windows\mdll.dl - Ok, thanks again. ………………. :smack:
Post #2
Hi

Please do the following:



Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.



NEXT


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



NEXT


Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Thank you so much for replying and for your help. Below are the results of the scans you requested. I hope they are alright, some of the scans just started automatically after I downloaded them and opened them so I hope that was alright. I'm pretty new with this computer stuff and very new here on What the Tech. If for some reason they are not right, please let me know and I will try doing them again.

Here are the results from MBR Check ………

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000004c

Kernel Drivers (total 117):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7997000 \WINDOWS\system32\KDCOM.DLL
0xF78A7000 \WINDOWS\system32\BOOTVID.dll
0xF7497000 soayog.sys
0xF7448000 ACPI.sys
0xF7999000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7437000 pci.sys
0xF74A7000 isapnp.sys
0xF7A5F000 pciide.sys
0xF7717000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF74B7000 MountMgr.sys
0xF7418000 ftdisk.sys
0xF799D000 dmload.sys
0xF73F2000 dmio.sys
0xF771F000 PartMgr.sys
0xF74C7000 VolSnap.sys
0xF73DA000 atapi.sys
0xF74D7000 disk.sys
0xF74E7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF73BA000 fltmgr.sys
0xF73A8000 sr.sys
0xF74F7000 PxHelp20.sys
0xF7391000 KSecDD.sys
0xF7304000 Ntfs.sys
0xF72D7000 NDIS.sys
0xF72BD000 Mup.sys
0xF7667000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF719E000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xF718A000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7787000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF7166000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF778F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7148000 \SystemRoot\system32\DRIVERS\e1000325.sys
0xF7797000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7677000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF779F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF77A7000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7687000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7943000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF7134000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7697000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF7111000 \SystemRoot\system32\DRIVERS\ks.sys
0xF708B000 \SystemRoot\system32\drivers\smwdm.sys
0xF7067000 \SystemRoot\system32\drivers\portcls.sys
0xF76C7000 \SystemRoot\system32\drivers\drmk.sys
0xF79B3000 \SystemRoot\system32\drivers\aeaudio.sys
0xF7B9B000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF76D7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF794B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF7050000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF77AF000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7000000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7707000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF77B7000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF77BF000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF6FD0000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF7517000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF79B5000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF796B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7527000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7547000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79B7000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF79B9000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7B03000 \SystemRoot\System32\Drivers\Null.SYS
0xF79BB000 \SystemRoot\System32\Drivers\Beep.SYS
0xF77D7000 \SystemRoot\System32\drivers\vga.sys
0xF79BD000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF79BF000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF77DF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF77E7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7284000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEEE0D000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xEEDB4000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEED8C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xEED6A000 \SystemRoot\System32\drivers\afd.sys
0xF7567000 \SystemRoot\system32\DRIVERS\netbios.sys
0xEED47000 \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys
0xEED1C000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xEECAC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF7577000 \SystemRoot\System32\Drivers\Fips.SYS
0xEEC86000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF7587000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF75A7000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF77EF000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF792F000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF77F7000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF77FF000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF7933000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF75B7000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7807000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xEEC46000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79C3000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF6FC8000 \SystemRoot\System32\drivers\Dxapi.sys
0xF780F000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7B46000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF03F000 \SystemRoot\System32\ialmdev5.DLL
0xBF06B000 \SystemRoot\System32\ialmdd5.DLL
0xEEB4A000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xEE7F9000 \SystemRoot\system32\drivers\wdmaud.sys
0xEE86E000 \SystemRoot\system32\drivers\sysaudio.sys
0xEE2EE000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF799B000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xEE1A7000 \SystemRoot\system32\DRIVERS\srv.sys
0xF773F000 \??\G:\WINDOWS\system32\drivers\sp_prot.sys
0xEDD2E000 \SystemRoot\System32\Drivers\HTTP.sys
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xECF18000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 47):
0 System Idle Process
4 System
556 G:\WINDOWS\system32\smss.exe
620 csrss.exe
644 G:\WINDOWS\system32\winlogon.exe
696 G:\WINDOWS\system32\services.exe
708 G:\WINDOWS\system32\lsass.exe
864 G:\WINDOWS\system32\svchost.exe
944 svchost.exe
1036 G:\WINDOWS\system32\svchost.exe
1132 svchost.exe
1220 svchost.exe
1444 G:\WINDOWS\system32\spoolsv.exe
1580 G:\WINDOWS\explorer.exe
1744 G:\WINDOWS\system32\igfxtray.exe
1752 G:\WINDOWS\system32\hkcmd.exe
1760 G:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
1772 G:\Program Files\System Protect\SysProtect_Tray.exe
1804 G:\Program Files\Lexmark 5400 Series\lxctmon.exe
1840 G:\Program Files\Lexmark 5400 Series\ezprint.exe
1928 G:\Program Files\DivX\DivX Update\DivXUpdate.exe
1948 G:\Program Files\Common Files\Java\Java Update\jusched.exe
2028 G:\Program Files\Messenger\msmsgs.exe
2044 G:\WINDOWS\system32\ctfmon.exe
152 G:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
280 G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
404 G:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
448 G:\Program Files\OpenOffice.org 3\program\soffice.exe
460 G:\Program Files\OpenOffice.org 3\program\soffice.bin
488 svchost.exe
604 G:\WINDOWS\system32\inetsrv\inetinfo.exe
668 G:\Program Files\Java\jre6\bin\jqs.exe
888 G:\WINDOWS\system32\lxctcoms.exe
928 G:\Program Files\CDBurnerXP\NMSAccessU.exe
1504 G:\WINDOWS\system32\snmp.exe
1548 G:\Program Files\Spyware Terminator\sp_rsser.exe
2064 G:\Program Files\System Protect\SysProtect_srv.exe
2164 G:\WINDOWS\system32\svchost.exe
2920 G:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
1528 G:\Program Files\Online Vault\OnlineVault.exe
3764 G:\Program Files\Common Files\Real\Update_OB\realsched.exe
3280 G:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
1764 G:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
1788 G:\Program Files\Outlook Express\msimn.exe
320 G:\Program Files\Mozilla Firefox\firefox.exe
188 G:\Program Files\Mozilla Firefox\plugin-container.exe
4076 G:\Documents and Settings\Administrator\My Documents\Downloads\MBRCheck.exe

\\.\G: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: ST3500830A, Rev: 3.AAC

Size Device Name MBR Status
——————————————–
465 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!


Next are the results from DDS…………..


DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 21:26:10.23 on Sat 08/28/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.172 [GMT -4:00]


============== Running Processes ===============

G:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
G:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\WINDOWS\system32\igfxtray.exe
G:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
G:\Program Files\System Protect\SysProtect_Tray.exe
G:\Program Files\Lexmark 5400 Series\lxctmon.exe
G:\Program Files\Lexmark 5400 Series\ezprint.exe
G:\Program Files\DivX\DivX Update\DivXUpdate.exe
G:\Program Files\Common Files\Java\Java Update\jusched.exe
G:\Program Files\Messenger\msmsgs.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
G:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
G:\Program Files\OpenOffice.org 3\program\soffice.exe
G:\Program Files\OpenOffice.org 3\program\soffice.bin
svchost.exe
G:\WINDOWS\system32\inetsrv\inetinfo.exe
G:\Program Files\Java\jre6\bin\jqs.exe
G:\WINDOWS\system32\lxctcoms.exe
G:\Program Files\CDBurnerXP\NMSAccessU.exe
G:\WINDOWS\System32\snmp.exe
G:\Program Files\Spyware Terminator\sp_rsser.exe
G:\Program Files\System Protect\SysProtect_srv.exe
G:\WINDOWS\system32\svchost.exe -k imgsvc
G:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
G:\PROGRA~1\ONLINE~2\ONLINE~1.EXE
G:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
G:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
G:\Program Files\Outlook Express\msimn.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Mozilla Firefox\plugin-container.exe
G:\WINDOWS\system32\wscntfy.exe
G:\Program Files\Spyware Terminator\SpywareTerminator.exe
G:\Documents and Settings\Administrator\My Documents\Downloads\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.crawler.com/?tbid=60347
uSearch Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw;=%s&tbid;=60347
mSearchAssistant = hxxp://www.crawler.com/search/ie.aspx?tb_id=60347
mCustomizeSearch = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60347
uURLSearchHooks: N/A: {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - g:\progra~1\crawler\toolbar\ctbr.dll
BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - g:\program files\lexmark toolbar\toolband.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - g:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: : {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - g:\progra~1\crawler\toolbar\ctbr.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - g:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - g:\progra~1\spybot - search & destroy\SDHelper.dll
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - g:\program files\siber systems\ai roboform\roboform.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - g:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - g:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Crawler; Toolbar: {4b3803ea-5230-4dc3-a7fc-33638f3d3542} - g:\progra~1\crawler\toolbar\ctbr.dll
TB: &RoboForm;: {724d43a0-0d85-11d4-9908-00400523e39a} - g:\program files\siber systems\ai roboform\roboform.dll
TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - g:\program files\lexmark toolbar\toolband.dll
uRun: [SpywareTerminatorUpdate] "g:\program files\spyware terminator\SpywareTerminatorUpdate.exe"
uRun: [OnlineVault] "g:\program files\online vault\OnlineVault.exe" /startup
uRun: [MSMSGS] "g:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] g:\windows\system32\ctfmon.exe
uRun: [RoboForm] "g:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
uRun: [Microsoft Works Update Detection] ?\WkDetect.exe
uRun: [SpybotSD TeaTimer] g:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [IgfxTray] g:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] g:\windows\system32\hkcmd.exe
mRun: [SpywareTerminator] "g:\program files\spyware terminator\SpywareTerminatorShield.exe"
mRun: [SystemProtect] g:\program files\system protect\SysProtect_Tray.exe
mRun: [Adobe Reader Speed Launcher] "g:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "g:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [lxctmon.exe] "g:\program files\lexmark 5400 series\lxctmon.exe"
mRun: [Lexmark 5400 Series Fax Server] "g:\program files\lexmark 5400 series\fm3032.exe" /s
mRun: [EzPrint] "g:\program files\lexmark 5400 series\ezprint.exe"
mRun: [LXCTCATS] rundll32 g:\windows\system32\spool\drivers\w32x86\3\LXCTtime.dll,_RunDLLEntry@16
mRun: [TkBellExe] "g:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [DivXUpdate] "g:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "g:\program files\common files\java\java update\jusched.exe"
StartupFolder: g:\docume~1\admini~1\startm~1\programs\startup\openoffice.org 3.2.lnk - g:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: g:\docume~1\alluse~1\startm~1\programs\startup\microsoft works calendar reminders.lnk - g:\program files\common files\microsoft shared\works shared\wkcalrem.exe
mPolicies-explorer: NoResolveTrack = 1 (0x1)
IE: Crawler Search - tbr:iemenu
IE: Customize Menu - file://g:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://g:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://g:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://g:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - g:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - g:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - g:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FA32182A-EA44-4583-803B-AA827F0D4E06} - g:\progra~1\online~2\ONLINE~1.EXE
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - g:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - g:\progra~1\spybot - search & destroy\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1275797429265
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - g:\progra~1\crawler\toolbar\ctbr.dll
Notify: igfxcui - igfxsrvc.dll

================= FIREFOX ===================

FF - ProfilePath - g:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\avpujchl.default\
FF - component: g:\documents and settings\administrator\application data\mozilla\firefox\profiles\avpujchl.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\FFExternalAlert.dll
FF - component: g:\documents and settings\administrator\application data\mozilla\firefox\profiles\avpujchl.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\RadioWMPCore.dll
FF - component: g:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - component: g:\progra~1\crawler\firefox\components\xcomm.dll
FF - component: g:\progra~1\crawler\firefox\components\xshared.dll
FF - component: g:\progra~1\crawler\firefox\components\xsupport.dll
FF - component: g:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll
FF - plugin: g:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: g:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: g:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: g:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: g:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - HiddenExtension: Java Console: No Registry Reference - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - trueg:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
g:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
g:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
g:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
g:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
g:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
g:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
g:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
g:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
g:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
g:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
g:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
g:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
g:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
g:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
g:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
g:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
g:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
g:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
g:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
g:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
g:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
g:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
g:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
g:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 sp_rsdrv2;Spyware Terminator Driver 2;g:\windows\system32\drivers\sp_rsdrv2.sys [2010-6-5 142592]
R2 SP_Service;System Protect Deletion Prevention Service;g:\program files\system protect\SysProtect_srv.exe [2010-6-5 598528]
R3 sp_prot;System Protect Filter Driver;g:\windows\system32\drivers\sp_prot.sys [2010-6-5 12288]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;g:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 cpudrv;cpudrv;g:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
S3 DfSdkS;Defragmentation-Service;g:\program files\ashampoo\ashampoo winoptimizer 2010 advanced\DfSdkS.exe [2010-6-20 406016]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;g:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-08-25 03:35:00 0 d—–w- g:\docume~1\admini~1\applic~1\Malwarebytes
2010-08-25 03:34:45 38224 —-a-w- g:\windows\system32\drivers\mbamswissarmy.sys
2010-08-25 03:34:44 20952 —-a-w- g:\windows\system32\drivers\mbam.sys
2010-08-25 03:34:44 0 d—–w- g:\docume~1\alluse~1\applic~1\Malwarebytes
2010-08-25 03:34:43 0 d—–w- g:\program files\Malwarebytes' Anti-Malware
2010-08-23 07:35:43 0 d—–w- g:\program files\Spybot - Search & Destroy
2010-08-23 07:35:43 0 d—–w- g:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-08-23 03:54:23 2232 ——w- g:\windows\mdll.dl
2010-08-10 22:15:53 0 d—–w- g:\docume~1\admini~1\applic~1\Ashampoo
2010-08-10 22:13:39 0 d—–w- g:\docume~1\alluse~1\applic~1\ashampoo
2010-08-07 22:27:44 0 d—–w- g:\documents and settings\administrator\.gimp-2.6
2010-08-07 22:24:21 0 d—–w- g:\program files\GIMP-2.0
2010-08-05 07:03:39 0 d—–w- g:\program files\common files\DivX Shared
2010-08-05 07:01:05 0 d—–w- g:\program files\DivX
2010-08-05 07:00:34 0 d—–w- g:\docume~1\alluse~1\applic~1\DivX
2010-08-05 06:55:46 0 d—–w- g:\program files\common files\xing shared
2010-08-05 06:55:10 499712 ——w- g:\windows\system32\msvcp71.dll
2010-08-05 06:55:10 348160 ——w- g:\windows\system32\msvcr71.dll
2010-08-05 06:55:08 0 d—–w- g:\program files\common files\Real

==================== Find3M ====================

2010-07-17 09:00:04 423656 —-a-w- g:\windows\system32\deployJava1.dll
2010-07-13 00:33:34 72080 ——w- g:\documents and settings\administrator\g2mdlhlpx.exe
2010-06-30 12:31:35 149504 —-a-w- g:\windows\system32\schannel.dll
2010-06-24 12:15:28 832512 —-a-w- g:\windows\system32\wininet.dll
2010-06-24 12:15:26 78336 —-a-w- g:\windows\system32\ieencode.dll
2010-06-24 12:15:26 17408 ——w- g:\windows\system32\corpol.dll
2010-06-23 13:44:04 1851904 —-a-w- g:\windows\system32\win32k.sys
2010-06-20 20:42:43 61224 ——w- g:\documents and settings\administrator\GoToAssistDownloadHelper.exe
2010-06-17 14:03:00 80384 ——w- g:\windows\system32\iccvid.dll
2010-06-14 07:41:45 1172480 ——w- g:\windows\system32\msxml3.dll
2010-06-09 23:01:10 133616 ——w- g:\windows\system32\pxafs.dll
2010-06-09 23:01:10 126448 ——w- g:\windows\system32\pxinsi64.exe
2010-06-09 23:01:10 123888 ——w- g:\windows\system32\pxcpyi64.exe
2010-06-05 06:08:30 25480 ——w- g:\windows\system32\emptyregdb.dat

============= FINISH: 21:26:50.18 ===============



Next are the results from Attach……………………


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 6/5/2010 2:12:11 AM
System Uptime: 8/25/2010 1:02:24 AM (92 hours ago)

Motherboard: Dell Computer Corp. | | 0U1325
Processor: Intel® Pentium® 4 CPU 3.00GHz | Microprocessor | 2992/800mhz

==== Disk Partitions =========================

C: is Removable
D: is CDROM ()
G: is FIXED (NTFS) - 104 GiB total, 70.882 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Description: Microcode Update Device
Device ID: ROOT\SYSTEM\0001
Manufacturer: (Standard system devices)
Name: Microcode Update Device
PNP Device ID: ROOT\SYSTEM\0001
Service: update

==== System Restore Points ===================

RP1: 6/5/2010 2:13:45 AM - System Checkpoint
RP2: 6/6/2010 1:02:03 AM - Software Distribution Service 3.0
RP3: 6/6/2010 1:17:33 AM - Software Distribution Service 3.0
RP4: 6/6/2010 1:31:50 AM - Software Distribution Service 3.0
RP5: 6/6/2010 2:03:04 AM - Software Distribution Service 3.0
RP6: 6/6/2010 2:06:16 AM - Software Distribution Service 3.0
RP7: 6/6/2010 2:14:23 AM - Software Distribution Service 3.0
RP8: 6/6/2010 2:28:22 AM - Software Distribution Service 3.0
RP9: 6/6/2010 2:29:30 AM - Software Distribution Service 3.0
RP10: 6/6/2010 3:00:12 AM - Software Distribution Service 3.0
RP11: 6/6/2010 5:14:08 PM - Software Distribution Service 3.0
RP12: 6/7/2010 6:03:29 PM - System Checkpoint
RP13: 6/7/2010 7:22:38 PM - Installed Java™ 6 Update 20
RP14: 6/7/2010 7:23:11 PM - Installed Java Runtime Environment
RP15: 6/8/2010 8:02:04 PM - System Checkpoint
RP16: 6/9/2010 8:14:07 PM - System Checkpoint
RP17: 6/10/2010 2:43:43 AM - Installed Adobe Reader 9.3.
RP18: 6/10/2010 4:14:08 AM - Software Distribution Service 3.0
RP19: 6/11/2010 5:09:38 PM - System Checkpoint
RP20: 6/12/2010 6:53:32 PM - Printer Driver Fax Lexmark 5400 Series Printer Installed
RP21: 6/13/2010 7:22:31 PM - System Checkpoint
RP22: 6/14/2010 7:49:20 PM - System Checkpoint
RP23: 6/15/2010 9:38:41 PM - System Checkpoint
RP24: 6/16/2010 10:03:34 PM - System Checkpoint
RP25: 6/17/2010 10:22:49 PM - System Checkpoint
RP26: 6/18/2010 10:49:28 PM - System Checkpoint
RP27: 6/20/2010 3:04:46 AM - System Checkpoint
RP28: 6/21/2010 3:36:36 PM - System Checkpoint
RP29: 6/21/2010 6:51:55 PM - Installed Microsoft Picture It! Publishing 2001
RP30: 6/22/2010 8:14:23 PM - System Checkpoint
RP31: 6/23/2010 2:08:12 PM - Spyware Terminator - restore point
RP32: 6/24/2010 5:05:19 PM - System Checkpoint
RP33: 6/25/2010 7:47:54 PM - System Checkpoint
RP34: 6/26/2010 7:52:29 PM - System Checkpoint
RP35: 6/27/2010 8:10:58 PM - System Checkpoint
RP36: 6/28/2010 8:14:25 PM - System Checkpoint
RP37: 6/29/2010 2:18:01 AM - Installed OpenOffice.org 3.2
RP38: 6/29/2010 3:51:27 AM - Spyware Terminator - restore point
RP39: 6/30/2010 6:52:13 PM - System Checkpoint
RP40: 7/1/2010 7:29:45 PM - Spyware Terminator - restore point
RP41: 7/2/2010 8:09:27 PM - System Checkpoint
RP42: 7/3/2010 8:51:16 PM - System Checkpoint
RP43: 7/4/2010 9:32:15 PM - System Checkpoint
RP44: 7/5/2010 10:36:23 PM - System Checkpoint
RP45: 7/6/2010 10:55:00 PM - System Checkpoint
RP46: 7/7/2010 11:44:50 PM - System Checkpoint
RP47: 7/9/2010 12:14:46 AM - System Checkpoint
RP48: 7/10/2010 1:46:21 AM - System Checkpoint
RP49: 7/11/2010 2:00:25 AM - System Checkpoint
RP50: 7/12/2010 12:02:51 PM - System Checkpoint
RP51: 7/13/2010 1:17:22 PM - System Checkpoint
RP52: 7/14/2010 3:15:19 AM - Software Distribution Service 3.0
RP53: 7/15/2010 9:35:52 AM - System Checkpoint
RP54: 7/16/2010 6:00:40 PM - System Checkpoint
RP55: 7/17/2010 6:10:49 PM - System Checkpoint
RP56: 7/18/2010 6:51:32 PM - System Checkpoint
RP57: 7/19/2010 7:01:15 PM - System Checkpoint
RP58: 7/20/2010 7:42:58 PM - System Checkpoint
RP59: 7/21/2010 9:10:01 PM - System Checkpoint
RP60: 7/22/2010 10:02:30 PM - System Checkpoint
RP61: 7/23/2010 10:21:58 PM - System Checkpoint
RP62: 7/24/2010 11:14:23 PM - System Checkpoint
RP63: 7/26/2010 1:38:42 AM - System Checkpoint
RP64: 7/27/2010 1:55:09 AM - System Checkpoint
RP65: 7/28/2010 2:36:21 AM - System Checkpoint
RP66: 7/29/2010 3:21:29 PM - System Checkpoint
RP67: 7/30/2010 4:30:31 PM - System Checkpoint
RP68: 7/31/2010 5:35:38 PM - System Checkpoint
RP69: 8/1/2010 6:49:44 PM - System Checkpoint
RP70: 8/2/2010 9:24:25 PM - System Checkpoint
RP71: 8/3/2010 12:00:14 AM - Software Distribution Service 3.0
RP72: 8/3/2010 1:24:33 AM - Software Distribution Service 3.0
RP73: 8/3/2010 8:41:43 AM - Software Distribution Service 3.0
RP74: 8/3/2010 9:29:37 AM - Software Distribution Service 3.0
RP75: 8/3/2010 9:52:25 AM - Software Distribution Service 3.0
RP76: 8/4/2010 1:49:17 PM - System Checkpoint
RP77: 8/5/2010 1:53:09 PM - System Checkpoint
RP78: 8/6/2010 2:57:56 PM - System Checkpoint
RP79: 8/7/2010 6:19:58 PM - System Checkpoint
RP80: 8/8/2010 6:41:12 PM - System Checkpoint
RP81: 8/9/2010 9:11:34 PM - System Checkpoint
RP82: 8/10/2010 9:38:50 PM - System Checkpoint
RP83: 8/11/2010 4:02:33 AM - Installed Java™ 6 Update 21
RP84: 8/12/2010 12:00:21 AM - Software Distribution Service 3.0
RP85: 8/12/2010 2:41:36 PM - Software Distribution Service 3.0
RP86: 8/12/2010 2:52:40 PM - Software Distribution Service 3.0
RP87: 8/13/2010 7:54:46 PM - System Checkpoint
RP88: 8/15/2010 1:38:12 PM - System Checkpoint
RP89: 8/16/2010 1:52:37 PM - System Checkpoint
RP90: 8/17/2010 1:58:35 PM - System Checkpoint
RP91: 8/18/2010 2:30:37 PM - System Checkpoint
RP92: 8/19/2010 3:28:35 PM - System Checkpoint
RP93: 8/20/2010 4:23:32 PM - System Checkpoint
RP94: 8/21/2010 8:11:29 PM - System Checkpoint
RP95: 8/22/2010 11:45:45 PM - System Checkpoint
RP96: 8/23/2010 1:42:38 AM - Spyware Terminator - restore point
RP97: 8/24/2010 2:49:27 AM - System Checkpoint
RP98: 8/25/2010 3:10:43 AM - System Checkpoint
RP99: 8/26/2010 3:49:29 AM - System Checkpoint
RP100: 8/27/2010 3:54:28 AM - System Checkpoint
RP101: 8/28/2010 8:24:50 AM - System Checkpoint

==== Installed Programs ======================

ABBYY FineReader 6.0 Sprint
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.4
AI RoboForm (All Users)
Ashampoo Burning Studio 6 FREE
Ashampoo WinOptimizer 2010 Advanced
CCleaner
CDBurnerXP
Coupon Printer for Windows
Crawler Toolbar with Web Security Guard
DivX Setup
GIMP 2.6.10
GoToMeeting 4.5.0.457
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB981793)
Intel® Extreme Graphics 2 Driver
Intel® PRO Network Adapters and Drivers
Java Auto Updater
Java™ 6 Update 21
Lexmark 5400 Series
Lexmark Toolbar
Malwarebytes' Anti-Malware
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Picture It! Publishing 2001
Mozilla Firefox (3.6.8)
Online Vault
OpenOffice.org 3.2
RealPlayer
RealUpgrade 1.0
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953155)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB970483)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976323)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Shockwave
SoundMAX
Spybot - Search & Destroy
Spyware Terminator
System Protect
System Requirements Lab for Intel
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB980182)
VC80CRTRedist - 8.0.50727.4053
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

8/25/2010 1:06:05 AM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/25/2010 1:06:04 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
8/25/2010 1:03:38 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde
8/25/2010 1:02:57 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

==== End Of File ===========================



And finally the results from Gmer ………………

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-28 22:29:07
Windows 5.1.2600 Service Pack 3
Running: ppkqvinh.exe; Driver: G:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\axroafob.sys


—- System - GMER 1.0.15 —-

SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwClose [0xEED4888E]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateFile [0xEED480EC]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateKey [0xEED47DCE]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwCreateSection [0xEED49938]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwDeleteKey [0xEED47ED8]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwDeleteValueKey [0xEED47FC2]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwLoadDriver [0xEED48BBC]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwOpenFile [0xEED483F4]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwSetInformationFile [0xEED48526]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwSetValueKey [0xEED47BFC]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwTerminateProcess [0xEED48B04]
SSDT \??\G:\WINDOWS\system32\drivers\sp_rsdrv2.sys ZwWriteFile [0xEED4870C]

—- Kernel code sections - GMER 1.0.15 —-

? soayog.sys The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text G:\Program Files\Mozilla Firefox\plugin-container.exe[188] USER32.dll!TrackPopupMenu 7E46531E 5 Bytes JMP 1044721D G:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text G:\Program Files\Mozilla Firefox\firefox.exe[320] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 G:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text G:\Program Files\Spybot - Search & Destroy\SpybotSD.exe[1764] kernel32.dll!CreateThread + 1A 7C8106F1 4 Bytes CALL 031BA939 G:\Program Files\Spybot - Search & Destroy\Plugins\Chai.dll

—- EOF - GMER 1.0.15 —-



Thank you very much again! …………………… :notworthy:
Post #4
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #5
I clicked the link to download ComboFix and it did download. When I clicked on the ComboFix download the only option it gave me was to "run" so I clicked that. It didn't give me an option as to where to download it to (ex. desktop) so if I have the ComboFix, I have no idea where its at in my computer. It ran and installed the Microsoft Recovery and then ran for a little while after that. I saved the ComboFix Log to my desktop. Should I try to download the ComboFix again? Or do you think it is somewhere in my computer and how do I find out where the ComboFix is in my computer and should I have it on my desktop? I read in your last post, it says not to download ComboFix again, if there is a problem to let you know, so I wanted to check with you before I did or didn't do anything with it. Also, it put another Internet Explorer icon on my desktop but I've been using FireFox (I read somewhere that FireFox is safer to use than Internet Explorer) and I like it better. Can I delete the (duplicate) Internet Explorer icon it put on my desktop?

Here is the report/log from ComboFix (I hope this is right) ……………….

ComboFix 10-08-28.01 - Administrator 08/29/2010 0:22.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.374 [GMT -4:00]
Running from: g:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

g:\documents and settings\Administrator\g2mdlhlpx.exe
g:\documents and settings\Administrator\GoToAssistDownloadHelper.exe
g:\windows\mdll.dl
g:\windows\system32\Cache

.
((((((((((((((((((((((((( Files Created from 2010-07-28 to 2010-08-29 )))))))))))))))))))))))))))))))
.

2010-08-25 03:35 . 2010-08-25 03:35 ——– d—–w- g:\documents and settings\Administrator\Application Data\Malwarebytes
2010-08-25 03:34 . 2010-04-29 19:39 38224 —-a-w- g:\windows\system32\drivers\mbamswissarmy.sys
2010-08-25 03:34 . 2010-08-25 03:34 ——– d—–w- g:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-25 03:34 . 2010-04-29 19:39 20952 —-a-w- g:\windows\system32\drivers\mbam.sys
2010-08-25 03:34 . 2010-08-25 03:34 ——– d—–w- g:\program files\Malwarebytes' Anti-Malware
2010-08-23 07:35 . 2010-08-28 20:10 ——– d—–w- g:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-23 07:35 . 2010-08-23 07:38 ——– d—–w- g:\program files\Spybot - Search & Destroy
2010-08-11 08:03 . 2010-08-11 08:03 ——– d—–w- g:\program files\Common Files\Java
2010-08-10 22:15 . 2010-08-10 22:15 ——– d—–w- g:\documents and settings\Administrator\Application Data\Ashampoo
2010-08-10 22:13 . 2010-08-10 22:13 ——– d—–w- g:\documents and settings\All Users\Application Data\ashampoo
2010-08-10 22:13 . 2010-08-10 22:13 ——– d—–w- g:\documents and settings\Administrator\Local Settings\Application Data\ashampoo
2010-08-08 06:38 . 2010-08-08 06:38 503808 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3357182e-n\msvcp71.dll
2010-08-08 06:38 . 2010-08-08 06:38 499712 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3357182e-n\jmc.dll
2010-08-08 06:38 . 2010-08-08 06:38 348160 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3357182e-n\msvcr71.dll
2010-08-08 06:37 . 2010-08-08 06:37 61440 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-1314d2f3-n\decora-sse.dll
2010-08-08 06:37 . 2010-08-08 06:37 12800 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-1314d2f3-n\decora-d3d.dll
2010-08-07 22:27 . 2010-08-07 22:28 ——– d—–w- g:\documents and settings\Administrator\.gimp-2.6
2010-08-07 22:24 . 2010-08-07 22:26 ——– d—–w- g:\program files\GIMP-2.0
2010-08-05 07:05 . 2010-08-05 07:05 57344 ——w- g:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-08-05 07:05 . 2010-08-05 07:00 1062184 ——w- g:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll
2010-08-05 07:05 . 2010-08-05 07:00 895256 ——w- g:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe
2010-08-05 07:05 . 2010-08-05 07:05 56765 ——w- g:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-08-05 07:05 . 2010-08-05 07:05 56997 ——w- g:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe
2010-08-05 07:05 . 2010-08-05 07:05 53600 ——w- g:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe
2010-08-05 07:05 . 2010-08-05 07:05 57715 ——w- g:\documents and settings\All Users\Application Data\DivX\Player\Uninstaller.exe
2010-08-05 07:03 . 2010-08-05 07:03 57409 ——w- g:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe
2010-08-05 07:03 . 2010-08-05 07:03 52963 ——w- g:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-08-05 07:03 . 2010-08-05 07:03 54073 ——w- g:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe
2010-08-05 07:03 . 2010-08-05 07:03 ——– d—–w- g:\program files\Common Files\DivX Shared
2010-08-05 07:03 . 2010-08-05 07:03 56969 ——w- g:\documents and settings\All Users\Application Data\DivX\ASPEncoder\Uninstaller.exe
2010-08-05 07:01 . 2010-08-05 07:05 ——– d—–w- g:\program files\DivX
2010-08-05 07:00 . 2010-08-05 07:05 ——– d—–w- g:\documents and settings\All Users\Application Data\DivX
2010-08-05 06:56 . 2010-08-05 06:56 49152 ——w- g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-08-05 06:56 . 2010-08-05 06:56 45056 ——w- g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-08-05 06:56 . 2010-08-05 06:56 45056 ——w- g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-08-05 06:56 . 2010-08-05 06:56 45056 ——w- g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-08-05 06:56 . 2010-08-05 06:56 45056 ——w- g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-08-05 03:59 . 2010-06-22 00:29 52224 ——w- g:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\FFExternalAlert.dll
2010-08-05 03:59 . 2010-06-22 00:29 101376 ——w- g:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\RadioWMPCore.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-29 01:24 . 2010-06-05 08:09 ——– d—–w- g:\documents and settings\Administrator\Application Data\Spyware Terminator
2010-08-28 10:24 . 2010-06-21 22:51 ——– d—–w- g:\program files\Microsoft Picture It! PhotoPub
2010-08-28 10:12 . 2010-06-12 22:55 ——– d—–w- g:\program files\lx_cats
2010-08-28 08:03 . 2010-06-05 08:13 ——– d—–w- g:\program files\WinClamAVShield
2010-08-28 06:05 . 2010-06-29 06:24 1 —-a-w- g:\documents and settings\Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-08-27 20:48 . 2010-06-05 08:09 ——– d—–w- g:\documents and settings\All Users\Application Data\Spyware Terminator
2010-08-27 06:16 . 2010-06-21 06:26 ——– d—–w- g:\program files\CCleaner
2010-08-23 15:03 . 2010-06-05 08:09 ——– d—–w- g:\program files\Spyware Terminator
2010-08-11 08:03 . 2010-06-07 23:22 ——– d—–w- g:\program files\Java
2010-08-10 22:13 . 2010-06-20 08:37 ——– d—–w- g:\program files\Ashampoo
2010-08-05 07:04 . 2010-08-05 07:04 ——– d—–w- g:\documents and settings\Administrator\Application Data\DivX
2010-08-05 07:04 . 2010-08-05 07:04 84054 ——w- g:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe
2010-08-05 07:04 . 2010-08-05 07:04 57054 ——w- g:\documents and settings\All Users\Application Data\DivX\DSDesktopComponents\Uninstaller.exe
2010-08-05 07:04 . 2010-08-05 07:04 54166 ——w- g:\documents and settings\All Users\Application Data\DivX\DSAVCDecoder\Uninstaller.exe
2010-08-05 07:04 . 2010-08-05 07:04 57532 ——w- g:\documents and settings\All Users\Application Data\DivX\DSASPDecoder\Uninstaller.exe
2010-08-05 07:04 . 2010-08-05 07:04 56458 ——w- g:\documents and settings\All Users\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-08-05 07:04 . 2010-08-05 07:04 54174 ——w- g:\documents and settings\All Users\Application Data\DivX\DSAACDecoder\Uninstaller.exe
2010-08-05 07:04 . 2010-08-05 07:04 54153 ——w- g:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe
2010-08-05 07:04 . 2010-08-05 07:04 54128 ——w- g:\documents and settings\All Users\Application Data\DivX\Converter\Uninstaller.exe
2010-08-05 07:04 . 2010-08-05 07:04 54644 ——w- g:\documents and settings\All Users\Application Data\DivX\TranscodeEngine\Uninstaller.exe
2010-08-05 07:04 . 2010-08-05 07:04 54101 ——w- g:\documents and settings\All Users\Application Data\DivX\MPEG2Plugin\Uninstaller.exe
2010-08-05 06:56 . 2010-08-05 06:56 40960 ——w- g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-08-05 06:56 . 2010-08-05 06:56 341600 ——w- g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-08-05 06:56 . 2010-08-05 06:56 308808 ——w- g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-08-05 06:56 . 2010-08-05 06:56 14848 ——w- g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-08-05 06:56 . 2010-08-05 06:55 ——– d—–w- g:\program files\Common Files\Real
2010-08-05 06:55 . 2010-08-05 06:55 ——– d—–w- g:\program files\Real
2010-08-05 06:55 . 2010-08-05 06:55 ——– d—–w- g:\program files\Common Files\xing shared
2010-08-05 06:55 . 2010-08-05 06:55 348160 ——w- g:\windows\system32\msvcr71.dll
2010-08-05 06:55 . 2010-08-05 06:55 499712 ——w- g:\windows\system32\msvcp71.dll
2010-07-17 09:00 . 2010-06-07 23:23 423656 —-a-w- g:\windows\system32\deployJava1.dll
2010-07-13 00:34 . 2010-07-13 00:34 ——– d—–w- g:\program files\Citrix
2010-07-05 20:56 . 2010-06-12 22:51 ——– d—–w- g:\program files\Abbyy FineReader 6.0 Sprint
2010-07-01 23:29 . 2010-06-25 00:49 ——– d—–w- g:\program files\CDBurnerXP
2010-06-30 12:31 . 2004-08-12 08:27 149504 —-a-w- g:\windows\system32\schannel.dll
2010-06-29 06:58 . 2010-06-05 05:12 70720 ——w- g:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-24 12:15 . 2004-08-12 08:33 832512 —-a-w- g:\windows\system32\wininet.dll
2010-06-24 12:15 . 2010-06-06 06:20 78336 —-a-w- g:\windows\system32\ieencode.dll
2010-06-24 12:15 . 2010-06-06 06:20 17408 ——w- g:\windows\system32\corpol.dll
2010-06-23 13:44 . 2004-08-12 08:33 1851904 —-a-w- g:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-12 08:30 354304 —-a-w- g:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-12 08:19 80384 ——w- g:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2010-06-05 04:33 744448 —-a-w- g:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2010-06-06 05:22 1172480 ——w- g:\windows\system32\msxml3.dll
2010-06-10 06:41 . 2010-06-10 06:41 86016 ——w- g:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-06-09 23:01 . 2010-08-05 07:04 9200 ——w- g:\windows\system32\drivers\cdralw2k.sys
2010-06-09 23:01 . 2010-08-05 07:04 9072 ——w- g:\windows\system32\drivers\cdr4_xp.sys
2010-06-09 23:01 . 2010-08-05 07:04 45648 ——w- g:\windows\system32\drivers\PxHelp20.sys
2010-06-09 23:01 . 2010-08-05 07:04 133616 ——w- g:\windows\system32\pxafs.dll
2010-06-09 23:01 . 2010-08-05 07:04 126448 ——w- g:\windows\system32\pxinsi64.exe
2010-06-09 23:01 . 2010-08-05 07:04 123888 ——w- g:\windows\system32\pxcpyi64.exe
2010-06-08 00:57 . 2010-06-08 00:57 84480 ——w- g:\documents and settings\Administrator\Application Data\SystemRequirementsLab\srlproxy_intel_4.1.66.0A.dll
2010-06-07 23:23 . 2010-06-07 23:23 503808 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7cbd808b-n\msvcp71.dll
2010-06-07 23:23 . 2010-06-07 23:23 499712 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7cbd808b-n\jmc.dll
2010-06-07 23:23 . 2010-06-07 23:23 348160 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7cbd808b-n\msvcr71.dll
2010-06-07 23:23 . 2010-06-07 23:23 61440 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-60c94ec5-n\decora-sse.dll
2010-06-07 23:23 . 2010-06-07 23:23 12800 ——w- g:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-60c94ec5-n\decora-d3d.dll
2010-06-06 06:42 . 2010-06-05 04:35 87263 ——w- g:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-06-05 09:23 . 2010-06-05 09:23 0 ——w- g:\windows\nsreg.dat
2010-06-05 08:21 . 2010-06-05 08:21 12288 ——w- g:\windows\system32\drivers\sp_prot.sys
2010-06-05 08:09 . 2010-06-05 08:09 6144 ——w- g:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2010-06-05 08:09 . 2010-06-05 08:09 5632 ——w- g:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2010-06-05 08:09 . 2010-06-05 08:09 142592 ——w- g:\windows\system32\drivers\sp_rsdrv2.sys
2010-06-05 06:08 . 2010-06-05 04:32 25480 ——w- g:\windows\system32\emptyregdb.dat
2010-06-05 05:31 . 2010-06-05 05:31 444 ——w- g:\windows\system32\d3d8caps.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Update Detection"="?\WkDetect.exe" [?]
"SpywareTerminatorUpdate"="g:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-06-05 3037696]
"OnlineVault"="g:\program files\Online Vault\OnlineVault.exe" [2010-05-28 2459136]
"RoboForm"="g:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-07-03 160328]
"SpybotSD TeaTimer"="g:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="g:\windows\system32\igfxtray.exe" [2006-05-25 155648]
"HotKeysCmds"="g:\windows\system32\hkcmd.exe" [2006-05-25 126976]
"SpywareTerminator"="g:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-06-05 2176512]
"SystemProtect"="g:\program files\System Protect\SysProtect_Tray.exe" [2010-06-05 1223680]
"Adobe Reader Speed Launcher"="g:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="g:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"lxctmon.exe"="g:\program files\Lexmark 5400 Series\lxctmon.exe" [2007-03-19 291760]
"Lexmark 5400 Series Fax Server"="g:\program files\Lexmark 5400 Series\fm3032.exe" [2007-03-19 304048]
"EzPrint"="g:\program files\Lexmark 5400 Series\ezprint.exe" [2007-03-19 82864]
"LXCTCATS"="g:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 106496]
"TkBellExe"="g:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-08-05 202256]
"DivXUpdate"="g:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"SunJavaUpdateSched"="g:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

g:\documents and settings\Administrator\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - g:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]

g:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - g:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-6-29 24633]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"g:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"g:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"g:\\WINDOWS\\system32\\lxctcoms.exe"=

R1 sp_rsdrv2;Spyware Terminator Driver 2;g:\windows\system32\drivers\sp_rsdrv2.sys [6/5/2010 4:09 AM 142592]
R2 SP_Service;System Protect Deletion Prevention Service;g:\program files\System Protect\SysProtect_srv.exe [6/5/2010 4:21 AM 598528]
R3 sp_prot;System Protect Filter Driver;g:\windows\system32\drivers\sp_prot.sys [6/5/2010 4:21 AM 12288]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;g:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S3 cpudrv;cpudrv;g:\program files\SystemRequirementsLab\cpudrv.sys [12/18/2009 10:58 AM 11336]
S3 DfSdkS;Defragmentation-Service;g:\program files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\DfSdkS.exe [6/20/2010 4:53 AM 406016]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;g:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

— Other Services/Drivers In Memory —

*NewlyCreated* - AXROAFOB
*Deregistered* - axroafob
.
Contents of the 'Scheduled Tasks' folder

2010-08-27 g:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-789336058-308236825-682003330-500.job
- g:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]

2010-08-27 g:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-789336058-308236825-682003330-500.job
- g:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 07:02]

2010-08-25 g:\windows\Tasks\WGASetup.job
- g:\windows\system32\KB905474\wgasetup.exe [2010-06-06 02:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.crawler.com/?tbid=60347
IE: Crawler Search - tbr:iemenu
IE: Customize Menu - file://g:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://g:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://g:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://g:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: {{FA32182A-EA44-4583-803B-AA827F0D4E06} - g:\progra~1\ONLINE~2\ONLINE~1.EXE
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - g:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - g:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\
FF - component: g:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\FFExternalAlert.dll
FF - component: g:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\RadioWMPCore.dll
FF - component: g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - component: g:\progra~1\Crawler\firefox\components\xcomm.dll
FF - component: g:\progra~1\Crawler\firefox\components\xshared.dll
FF - component: g:\progra~1\Crawler\firefox\components\xsupport.dll
FF - component: g:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: g:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: g:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: g:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: g:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: g:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - trueg:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
g:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
g:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
g:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
g:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
g:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
g:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-{7E265513-8CDA-4631-B696-F40D983F3B07}_is1 - g:\program files\CDBurnerXP\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-29 00:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCTCATS = rundll32 g:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-08-29 00:28:57
ComboFix-quarantined-files.txt 2010-08-29 04:28

Pre-Run: 76,043,169,792 bytes free
Post-Run: 76,051,116,032 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
g:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 8A5B87606AAF729EB3D9FB31CE8324E5
Post #6
Hi

ComboFix is running from your downloads folder

g:\documents and settings\Administrator\My Documents\Downloads\ComboFix.exe

change your setting in FireFox so you control where the downloads go



In FireFox

  • Tools -> Options -> Main tab
  • Set to "Always ask me where to Save the files".


Leave it where it is for now, we will clean it up when we are done,



Please do the following:

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

**Vista/Win7 users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #7
Hello again,

I updated and ran the MalawareBytes scan and nothing showed up on it. Included below are the scan results. However, when I ran it a few days ago it did find somethings and I'm going to include that scan also (just so you can see what it found before). It placed those things in quarantine and that's where they are now. Should I delete those?

Here is the results of the Malawarebytes scan I just did today ……………..

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4504

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

8/29/2010 11:24:50 PM
mbam-log-2010-08-29 (23-24-50).txt

Scan type: Quick scan
Objects scanned: 124657
Time elapsed: 5 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Here are the results of the Malawarebytes scan I did a few days ago with the Trojan(s) it found and quarantined…………….

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4473

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

8/25/2010 12:59:19 AM
mbam-log-2010-08-25 (00-59-19).txt

Scan type: Full scan (G:\|)
Objects scanned: 171384
Time elapsed: 30 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java developer script browse (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java developer script browse (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\java developer script browse (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
G:\WINDOWS\jusched.exe (Trojan.Agent) -> Quarantined and deleted successfully.
G:\Documents and Settings\Administrator\My Documents\Downloads\PIC675799074533-JPG-www.facebook.com.exe (Trojan.Agent) -> Quarantined and deleted successfully.
G:\WINDOWS\wintybrd.png (Malware.Trace) -> Quarantined and deleted successfully.
G:\WINDOWS\wintybrdf.jpg (Malware.Trace) -> Quarantined and deleted successfully.


I am working on the next thing you asked me to do which is the Kapersky (sp?) thing and will send the results as soon as I'm finished.

Thank you so very much again for all your help. I really appreciate taking the time to help me. ……… :notworthy:
Post #8
Hi again, Every time I click on the link for that Kapersky thing and the web page opens, after a few seconds a "unresponsive script" error pops up. If I click continue it does it again after a few more seconds. If I click cancel then the page freezes and seems to take forever before I can do anything on my computer again. Do you have any suggestions??? Thanks again
Post #9
Ok, I think I got it to work. I clicked on "Accept" as soon as the page opened but then I got some other error saying something about java and the internet connection. I'm not sure I can't remember exactly what it said. Any way, I was using FireFox but I decided to open Internet Explorer and try it from there. It seems to be working so far. Thanks again!
Post #10
Hello again, Ok, the Kapersky scan ran (it took a pretty long time) and the results are below…………… I don't remember seeing this virus before on any of the Spyware Terminator, Spybot or Malawarebytes programs but I think I have a program called I hate Keyloggers somewhere on my computer, I just didn't open it or set it up or anything like that. ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Monday, August 30, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, August 30, 2010 03:17:41 Records in database: 4167804 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ G:\ Scan statistics: Objects scanned: 57241 Threats found: 1 Infected objects found: 1 Suspicious objects found: 0 Scan duration: 02:05:36 File name / Threat / Threats count G:\Documents and Settings\Administrator\My Documents\Downloads\i-hate-keyloggers.zip Infected: not-a-virus:Monitor.Win32.KeyLogger.w 1 Selected area has been scanned. Thanks so much again
Post #11
Hi

It's not infected, Kaspersky is just alerting to it's presence

It's in your Downloads folder, you can delete it if you don't wish to use it.

How is the computer running now?

Are there any outstanding issues.

There doesn't appear to be any remaining malware on your computer, so we can clean up our tools:

Please do the following:

You can delete the MBRCheck, DDS and GMER logs and programs from your desktop.


NEXT

Follow these steps to uninstall Combofix

  • Make sure your security programs are totally disabled.
  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]



If there are any logs/tools remaining > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them     Then consider a password keeper, to keep all your passwords safe.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

  • Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    It's normal after running TFC cleaner that the PC will be slower to boot the first time.

  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #12 last edited
Hello, Well, just a little bit ago when my Spyware Terminator program ran and when it ran last night it came up with a few things….. it keeps saying virus detected and coming up with these "Heuristics.Broken.Executable : g:\System Volume Information\_restore{ and a bunch of numbers .exe and it has a threat ranking 3 red boxes out of 5. But when I run the Malawarebytes scan and Spybot scans they don't show anything. Do you happen to have any idea what's going on? Sorry it took a while to get back to you, I ran all of those scans a few times so I could be sure of the out-comes. And a couple other things real quick, those items (trojan) that are quarantined in the Spyware Terminator and in the Malawarebytes should I just leave them there (in Quarantine) or should I try and delete them? Should I also delete the combofix log and kapersky log too? And, I know you said to remove the Combofix but should I keep that on my computer in case I have problems again down the road, or should I get rid of it for now and if I would need it later, get it back then, if instructed? That "I hate keyloggers" program, do I have to undownload it somehow or do I just delete it/send it to the recycle bin? Its zipped. Also, thank you very much for the extra info about keeping my computer safer. I was in the process of trying to back up my computer before I was infected but I was having some problems. I tried using the back up that was on my computer (i guess with windows) but it would only back up to my hard drive it wouldn't let me put it on a disc. I tried getting a burner program and tried using the back up on that so I could burn it onto DVD's and/or CD's but when I would put in a disc - say I put in a DVD I would get an error saying something like there was to much information and the disk couldn't hold that much, instead of being able to put in a DVD and it would burn what information it could and then let me put in another DVD and continue with burning the information. I know you suggested a back up program(I believe it was called something like ERUNT) but do you happen to have some directions as to how to use the back up program or some kind of guidance for that? Thank you very much again!!!!!
Post #13
Hi the detection was in an old system restore point which would have been removed using the combofix /uninstall command, which is why you need to remove it, it is not a program you should be using on your own as many things can go wrong if used incorrectly. You can remove the items in quarantine, but they wont harm your computer if left there. Just right click and delete that zipped program if you no longer need it. ERUNT is just a registry backup only and is used in emergency situations if the computer wont boot. There are many backup programs out there, I use Acronis myself and I back up to an external harddrive. I suggest posting a new topic in our windows forum, the techs there have more knowledge than I as to the best way to achieve what you need. good luck
Post #14
Hi,

Ok, great. Thanks again so much for all your help, I really do appreciate everything you've done and the time you've taken to help me. The computer seems to be running GREAT!! …… :woot:

Thanks again so much and take care! ………………. :notworthy:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI