What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Possible Virus/Trojan...Cannot connect to internet

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello everyone: I am trying to fix my cousins laptop, which seems to be infected by a virus/trojan. The problems begin when he went to tvshack.cc to watch tv shows online. He did not have any antivirus software or MBAM installed previously to being infected. I was able to install MBAM and AVG through safe mode for him and scanned and removed any detected viruses/trojans. When the cpu is first started it runs extremely slow, so i checked task manager and the physical memory usage is at 77% or somewhere around that. The computer is connected to the internet but will not allow me to surf the net. I am, however, able to download updates for MBAM and AVG, but not SUPERantiSpyware. The cpu says that it is connected to internet, but something is blocking it from being able to surf the net. Below is the DDS log. I have also attached the attach.zip and MBAM logs of the threats that were removed. I also ran GMER but was unable to get a log because the laptop kept restarting during the scan. I tried scanning it multiple times but was unsuccessful. I hope someone can help me fix his problem. THANKS! DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 20:34:59.21 on Tue 09/14/2010 Internet Explorer: 8.0.6001.18943 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.958.270 [GMT -5:00] SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\rundll32.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Application Updater\ApplicationUpdater.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe C:\Program Files\AVG\AVG9\avgam.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Search Settings\SearchSettings.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\Program Files\AVG\AVG9\avgtray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\system32\taskeng.exe C:\Users\Mignesh\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://google.com/ uInternet Settings,ProxyServer = http=127.0.0.1:6092 uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll uURLSearchHooks: SearchSettings Class: {e312764e-7706-43f1-8dab-fcdd2b1e416d} - c:\program files\search settings\SearchSettings.dll uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: SearchSettings Class: {e312764e-7706-43f1-8dab-fcdd2b1e416d} - c:\program files\search settings\SearchSettings.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SearchSettings] c:\program files\search settings\SearchSettings.exe mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dll Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll AppInit_DLLs: avgrsstx.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll Hosts: 127.0.0.1 www.spywareinfo.com ============= SERVICES / DRIVERS =============== R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-9-5 52872] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-9-5 216400] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-9-5 29584] R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-9-5 243024] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656] R2 Application Updater;Application Updater;c:\program files\application updater\ApplicationUpdater.exe [2010-1-8 380928] R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-9-5 308136] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-7-5 1153368] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-19 135664] S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-9-5 431432] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232] =============== Created Last 30 ================ 2010-09-14 23:52:53 0 d—–w- c:\users\mignesh\appdata\roaming\AVG9 2010-09-06 05:46:14 0 d—–w- c:\users\mignesh\DoctorWeb 2010-09-06 04:37:21 0 d—–w- c:\users\mignesh\appdata\roaming\SUPERAntiSpyware.com 2010-09-06 04:37:21 0 d—–w- c:\programdata\SUPERAntiSpyware.com 2010-09-06 04:37:07 0 d—–w- c:\program files\SUPERAntiSpyware 2010-09-06 01:52:02 0 d–h–w- C:\$AVG 2010-09-06 00:54:01 0 d—–w- c:\windows\system32\eu-ES 2010-09-06 00:54:01 0 d—–w- c:\windows\system32\ca-ES 2010-09-06 00:53:59 0 d—–w- c:\windows\system32\vi-VN 2010-09-06 00:24:37 0 d—–w- c:\windows\system32\EventProviders 2010-09-06 00:13:29 0 d—–w- c:\programdata\Office Genuine Advantage 2010-09-05 23:32:33 0 d—–w- c:\users\mignesh\appdata\roaming\IObit 2010-09-05 23:32:33 0 d—–w- c:\program files\IObit 2010-09-05 22:57:04 52872 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2010-09-05 22:57:04 12536 —-a-w- c:\windows\system32\avgrsstx.dll 2010-09-05 22:57:01 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2010-09-05 22:57:00 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2010-09-05 22:56:55 0 d—–w- c:\windows\system32\drivers\Avg 2010-09-05 22:56:50 0 d—–w- c:\programdata\AVG Security Toolbar 2010-09-05 22:53:45 0 d—–w- c:\program files\AVG 2010-09-05 22:53:26 0 d—–w- c:\programdata\avg9 2010-09-05 22:48:02 0 d—–w- c:\users\mignesh\appdata\roaming\Malwarebytes 2010-09-05 22:47:55 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-09-05 22:47:51 0 d—–w- c:\programdata\Malwarebytes 2010-09-05 22:47:50 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-09-05 22:47:50 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-09-04 18:24:21 0 d-sh–w- c:\users\mignesh\.COMMgr 2010-09-04 18:24:01 0 d—–w- c:\users\mignesh\appdata\roaming\B1AA70B0751AB96B8967FCA05B3C2BDD 2010-09-04 18:13:32 0 d—–w- c:\program files\common files\PX Storage Engine 2010-09-04 18:12:48 0 d—–w- c:\program files\common files\DivX Shared 2010-09-04 18:10:20 0 d—–w- c:\program files\DivX 2010-09-04 18:09:51 0 d—–w- c:\programdata\DivX ==================== Find3M ==================== 2010-09-15 01:17:49 42685 —-a-w- c:\programdata\nvModes.dat 2010-09-06 01:03:51 86016 —-a-w- c:\windows\inf\infstor.dat 2010-09-06 01:03:51 51200 —-a-w- c:\windows\inf\infpub.dat 2010-09-06 01:03:51 143360 —-a-w- c:\windows\inf\infstrng.dat 2010-09-06 00:53:43 665600 —-a-w- c:\windows\inf\drvindex.dat 2010-09-06 00:44:31 37665 —-a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont 2010-06-28 08:00:00 108032 —-a-w- c:\windows\system32\ff_vfw.dll 2010-06-26 06:05:49 916480 —-a-w- c:\windows\system32\wininet.dll 2010-06-26 06:02:15 71680 —-a-w- c:\windows\system32\iesetup.dll 2010-06-26 06:02:15 109056 —-a-w- c:\windows\system32\iesysprep.dll 2010-06-26 04:25:02 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2010-06-21 13:37:03 2037760 —-a-w- c:\windows\system32\win32k.sys 2010-06-18 17:31:29 36864 —-a-w- c:\windows\system32\rtutils.dll 2008-01-21 02:43:21 174 –sha-w- c:\program files\desktop.ini 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2010-05-24 01:52:42 16384 –sha-w- c:\windows\temp\cookies\index.dat 2010-05-24 01:52:43 32768 –sha-w- c:\windows\temp\history\history.ie5\index.dat 2010-05-24 01:52:42 32768 –sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat ============= FINISH: 20:37:03.17 ===============

Attachments:

Post #2
Hello and welcome to WhatTheTech. Please follow these guidelines while we work on your PC:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instructions I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
🖼Click to load external image (Posted Image) Please download Rootkit Unhooker and save it on your desktop.
  • Disable your security programs
  • Double click RKUnhookerLE.exe to run it
  • Click the Report tab, then click Scan
  • Check Drivers, Stealth Code, Files, and Code Hooks
  • Uncheck the rest, then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished then go File > Save Report
  • Save the report somewhere you can find it. Click Close
  • Copy the entire contents of the report and paste it in your next reply.
Note - You may get this warning it is ok, just ignore it:

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Please include the following in your next post:
  • Rootkit Unhooker log
Post #3 last edited
Thank you for the quick response. When I was running the rootkit unhooker scan it failed right about at the end. The error log said it is exception code: 0x0000005, Instruction address: 0x00434884, attempt to read at address: 0x0c6d0000. I do not know how long it normally takes the scan to finish but it was 2 hours in my case. Should I try to run it in safe mode? Are there any other options to help with this thing? Thanks for the help.
Post #4
🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:
  • Make sure that your security software is disabled
  • Uncheck the box next to "Files" this time also
  • If you still can't run it, try in the Safe Mode
Please include the following in your next post:
  • GMER log
Post #6
syxxpac316:

🖼Click to load external image (Posted Image) You have IObit Advanced System Care installed. IObit has been accused of stealing and incorporating Malwarebytes AntiMalware's proprietary database and intellectual property into their software. More information is available HERE and HERE. I strongly recommend that you unistall it.

🖼Click to load external image (Posted Image) P2P - I see you have P2P software (BitTorrent) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to malware infections. Please see this post for more information. I recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs. If you choose to keep these applications, please do not use them until our fixes at WTT are complete.

🖼Click to load external image (Posted Image) Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • If you have trouble, stop and post back. Do not try to repeatedly run comboFix!
  • When finished, it will produce a report for you.
.
Please include the following in your next post:
  • ComboFix log
Post #7
Thank you for the help. I did everything that was instructed in the previous post. I removed IObit advanced system care and BitTorrent. I also disabled all antivirus and anti-spyware applications that were running before I scanned using ComboFix. Below is the log from the ComboFix scan. Thanks for all the help.



ComboFix 10-09-17.04 - Mignesh 09/19/2010 16:12:26.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.958.324 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Search Settings
c:\program files\Search Settings\SeARchsettings.dll
c:\program files\Search Settings\SearchSettings.exe
c:\program files\Search Settings\SearchSettingsRes409.dll
c:\users\Mignesh\.COMMgr
c:\users\Mignesh\AppData\Local\{3A64C5F5-821D-4BDE-800C-A2C2D89DA532}
c:\users\Mignesh\AppData\Local\{3A64C5F5-821D-4BDE-800C-A2C2D89DA532}\chrome.manifest
c:\users\Mignesh\AppData\Local\{3A64C5F5-821D-4BDE-800C-A2C2D89DA532}\chrome\content\_cfg.js
c:\users\Mignesh\AppData\Local\{3A64C5F5-821D-4BDE-800C-A2C2D89DA532}\chrome\content\overlay.xul
c:\users\Mignesh\AppData\Local\{3A64C5F5-821D-4BDE-800C-A2C2D89DA532}\install.rdf
c:\users\Mignesh\AppData\Local\Windows Server
c:\users\Mignesh\AppData\Local\Windows Server\hlp.dat
c:\users\Mignesh\AppData\Local\Windows Server\server.dat

.
((((((((((((((((((((((((( Files Created from 2010-08-19 to 2010-09-19 )))))))))))))))))))))))))))))))
.

2010-09-19 21:24 . 2010-09-19 21:24 ——– d—–w- c:\users\Shrina Patel\AppData\Local\temp
2010-09-19 21:24 . 2010-09-19 21:24 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-09-17 06:01 . 2010-09-17 06:01 ——– d—–w- c:\program files\Windows Portable Devices
2010-09-17 03:44 . 2009-09-10 02:00 92672 —-a-w- c:\windows\system32\UIAnimation.dll
2010-09-17 03:44 . 2009-09-10 02:01 3023360 —-a-w- c:\windows\system32\UIRibbon.dll
2010-09-17 03:44 . 2009-09-10 02:00 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll
2010-09-17 03:41 . 2009-10-01 01:02 30208 —-a-w- c:\windows\system32\WPDShextAutoplay.exe
2010-09-17 03:41 . 2009-10-01 01:02 31232 —-a-w- c:\windows\system32\BthMtpContextHandler.dll
2010-09-17 03:41 . 2009-10-01 01:01 81920 —-a-w- c:\windows\system32\wpdbusenum.dll
2010-09-17 03:41 . 2009-10-01 01:01 60928 —-a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2010-09-17 03:41 . 2009-10-01 01:02 2537472 —-a-w- c:\windows\system32\wpdshext.dll
2010-09-17 03:41 . 2009-10-01 01:02 334848 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2010-09-17 03:41 . 2009-10-01 01:02 87552 —-a-w- c:\windows\system32\WPDShServiceObj.dll
2010-09-17 03:41 . 2009-10-01 01:01 546816 —-a-w- c:\windows\system32\wpd_ci.dll
2010-09-17 03:41 . 2009-10-01 01:01 160256 —-a-w- c:\windows\system32\PortableDeviceTypes.dll
2010-09-17 03:41 . 2009-10-01 01:01 350208 —-a-w- c:\windows\system32\WPDSp.dll
2010-09-17 03:41 . 2009-10-01 01:01 196608 —-a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2010-09-17 03:41 . 2009-10-01 01:01 100864 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2010-09-17 03:39 . 2009-10-08 21:08 234496 —-a-w- c:\windows\system32\oleacc.dll
2010-09-17 03:39 . 2009-10-08 21:07 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2010-09-17 03:39 . 2009-10-08 21:08 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll
2010-09-17 03:21 . 2010-09-17 03:21 ——– d-sh–w- c:\windows\system32\%APPDATA%
2010-09-15 00:16 . 2010-04-16 16:46 502272 —-a-w- c:\windows\system32\usp10.dll
2010-09-15 00:16 . 2010-03-05 14:01 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-09-15 00:16 . 2010-08-17 14:11 128000 —-a-w- c:\windows\system32\spoolsv.exe
2010-09-15 00:16 . 2010-04-05 17:02 317952 —-a-w- c:\windows\system32\MP4SDECD.DLL
2010-09-15 00:16 . 2010-05-27 20:08 739328 —-a-w- c:\windows\system32\inetcomm.dll
2010-09-15 00:14 . 2010-01-06 15:39 1696256 —-a-w- c:\windows\system32\gameux.dll
2010-09-15 00:14 . 2010-04-16 16:43 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2010-09-15 00:14 . 2010-04-16 14:39 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-09-14 23:52 . 2010-09-14 23:52 ——– d—–w- c:\users\Mignesh\AppData\Roaming\AVG9
2010-09-06 05:46 . 2010-09-06 06:02 ——– d—–w- c:\users\Mignesh\DoctorWeb
2010-09-06 04:37 . 2010-09-06 04:37 63488 —-a-w- c:\users\Mignesh\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-06 04:37 . 2010-09-06 04:37 52224 —-a-w- c:\users\Mignesh\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-06 04:37 . 2010-09-06 04:37 117760 —-a-w- c:\users\Mignesh\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-06 04:37 . 2010-09-06 04:37 ——– d—–w- c:\users\Mignesh\AppData\Roaming\SUPERAntiSpyware.com
2010-09-06 04:37 . 2010-09-06 04:37 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2010-09-06 04:37 . 2010-09-06 04:37 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-09-06 01:52 . 2010-09-06 01:52 ——– d—–w- C:\$AVG
2010-09-06 00:54 . 2010-09-06 00:56 ——– d—–w- c:\windows\system32\ca-ES
2010-09-06 00:54 . 2010-09-06 00:56 ——– d—–w- c:\windows\system32\eu-ES
2010-09-06 00:53 . 2010-09-06 00:55 ——– d—–w- c:\windows\system32\vi-VN
2010-09-06 00:24 . 2010-09-06 00:24 ——– d—–w- c:\windows\system32\EventProviders
2010-09-06 00:13 . 2010-09-06 00:13 ——– d—–w- c:\programdata\Office Genuine Advantage
2010-09-05 23:32 . 2010-09-05 23:32 ——– d—–w- c:\users\Mignesh\AppData\Roaming\IObit
2010-09-05 23:32 . 2010-09-05 23:32 ——– d—–w- c:\program files\IObit
2010-09-05 22:57 . 2010-09-05 22:57 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-09-05 22:57 . 2010-09-05 22:57 52872 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-09-05 22:57 . 2010-09-05 22:57 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-09-05 22:57 . 2010-09-05 22:57 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-09-05 22:56 . 2010-09-05 22:57 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-09-05 22:56 . 2010-09-19 20:58 ——– d—–w- c:\windows\system32\drivers\Avg
2010-09-05 22:56 . 2010-09-05 22:56 ——– d—–w- c:\programdata\AVG Security Toolbar
2010-09-05 22:53 . 2010-09-05 22:53 ——– d—–w- c:\program files\AVG
2010-09-05 22:53 . 2010-09-05 22:53 ——– d—–w- c:\programdata\avg9
2010-09-05 22:48 . 2010-09-05 22:48 ——– d—–w- c:\users\Mignesh\AppData\Roaming\Malwarebytes
2010-09-05 22:47 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-05 22:47 . 2010-09-05 22:47 ——– d—–w- c:\programdata\Malwarebytes
2010-09-05 22:47 . 2010-09-05 22:47 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-05 22:47 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-05 22:29 . 2010-09-05 22:29 2838 —-a-w- c:\users\Mignesh\AppData\Local\uwuriwesozomufa.dll
2010-09-04 18:32 . 2010-09-04 18:32 2838 —-a-w- c:\users\Mignesh\AppData\Local\ekekoxev.dll
2010-09-04 18:24 . 2010-09-04 18:24 ——– d—–w- c:\users\Mignesh\AppData\Roaming\B1AA70B0751AB96B8967FCA05B3C2BDD
2010-09-04 18:16 . 2010-09-04 18:16 57344 —-a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-09-04 18:14 . 2010-09-04 18:10 185640 —-a-w- c:\programdata\DivX\Setup\finishPlugin.dll
2010-09-04 18:14 . 2010-09-04 18:09 1062184 —-a-w- c:\programdata\DivX\Setup\Resource.dll
2010-09-04 18:14 . 2010-09-04 18:14 56765 —-a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-09-04 18:14 . 2010-09-04 18:09 850200 —-a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-09-04 18:14 . 2010-09-04 18:14 56997 —-a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-09-04 18:14 . 2010-09-04 18:14 57691 —-a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-09-04 18:14 . 2010-09-04 18:14 53600 —-a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-09-04 18:12 . 2010-09-04 18:12 54073 —-a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-09-04 18:12 . 2010-09-04 18:12 ——– d—–w- c:\program files\Common Files\DivX Shared
2010-09-04 18:12 . 2010-09-04 18:12 56969 —-a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-09-04 18:12 . 2010-09-05 22:28 0 —-a-w- c:\users\Mignesh\AppData\Local\Wfifurejadanap.bin
2010-09-04 18:12 . 2010-09-04 18:12 120 —-a-w- c:\users\Mignesh\AppData\Local\Xhojuy.dat
2010-09-04 18:10 . 2010-09-04 18:14 ——– d—–w- c:\program files\DivX
2010-09-04 18:09 . 2010-09-04 18:09 144696 —-a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-09-04 18:09 . 2010-09-04 18:14 ——– d—–w- c:\programdata\DivX
2010-09-04 18:09 . 2010-09-05 23:12 ——– d—–w- c:\users\Mignesh\AppData\Local\ajbnaoump

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-19 20:51 . 2010-05-19 17:21 42685 —-a-w- c:\programdata\nvModes.dat
2010-09-17 06:01 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2010-09-17 06:01 . 2010-09-17 06:01 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-09-17 03:37 . 2010-05-26 22:55 ——– d—–w- c:\programdata\Microsoft Help
2010-09-17 03:27 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-09-06 01:12 . 2010-05-19 17:21 ——– d—–w- c:\programdata\NVIDIA
2010-09-06 00:57 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Calendar
2010-09-06 00:57 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Sidebar
2010-09-06 00:57 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Journal
2010-09-06 00:57 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Collaboration
2010-09-06 00:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Photo Gallery
2010-09-06 00:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Defender
2010-09-05 22:55 . 2010-07-05 21:15 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-09-04 18:14 . 2010-05-22 23:48 ——– d—–w- c:\users\Mignesh\AppData\Roaming\DivX
2010-09-04 18:12 . 2010-05-19 23:45 ——– d—–w- c:\program files\Google
2010-09-04 01:12 . 2010-05-17 19:51 680 —-a-w- c:\users\Mignesh\AppData\Local\d3d9caps.dat
2010-08-29 20:33 . 2010-06-16 21:50 ——– d—–w- c:\program files\LimeWire
2010-08-11 21:57 . 2010-05-17 19:51 100432 —-a-w- c:\users\Mignesh\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-11 08:14 . 2010-08-11 08:14 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-08-11 08:07 . 2010-05-26 23:01 ——– d—–w- c:\program files\Microsoft Works
2010-08-08 18:17 . 2010-08-08 18:17 ——– d—–w- c:\program files\Microsoft
2010-08-08 18:17 . 2010-08-08 18:16 ——– d—–w- c:\program files\Windows Live
2010-08-08 18:16 . 2010-08-08 18:16 ——– d—–w- c:\program files\Windows Live SkyDrive
2010-08-08 18:12 . 2010-08-08 18:12 ——– d—–w- c:\program files\Common Files\Windows Live
2010-06-28 08:00 . 2010-07-05 20:47 108032 —-a-w- c:\windows\system32\ff_vfw.dll
2010-06-26 06:05 . 2010-09-06 00:03 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-09-06 00:03 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-09-06 00:03 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-09-06 00:03 133632 —-a-w- c:\windows\system32\ieUnatt.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-06-30 2102600]

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-06-30 19:23 2102600 —-a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 21:50 1197448 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-06-30 2102600]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-06-30 2102600]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-17 3872080]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-08-25 2424560]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-19 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-20 1316136]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-03 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-03 92704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-09-05 2065760]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-20 135664]
R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [2010-06-30 431432]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 Normandy;Normandy SR2; [x]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2010-09-05 52872]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2010-09-05 216400]
S1 AvgTdiX;AVG Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2010-09-05 243024]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2010-01-08 380928]
S2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-09-05 308136]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-20 03:11]

2010-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-20 03:11]

2010-09-19 c:\windows\Tasks\User_Feed_Synchronization-{811831D9-272E-4264-81D7-06F9CD07AF39}.job
- c:\windows\system32\msfeedssync.exe [2010-09-06 04:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
uInternet Settings,ProxyServer = http=127.0.0.1:6092
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-19 16:24
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-09-19 16:31:10
ComboFix-quarantined-files.txt 2010-09-19 21:31

Pre-Run: 464,576,364,544 bytes free
Post-Run: 463,665,885,184 bytes free

- - End Of File - - D4B906B0A96615AB115DCFA65C47342F
Post #8
syxxpac316:

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above http://

http://forums.whatthetech.com/index.php?showtopic=114580
Collect::
c:\users\Mignesh\AppData\Local\uwuriwesozomufa.dll
c:\users\Mignesh\AppData\Local\ekekoxev.dll
c:\users\Mignesh\AppData\Local\Xhojuy.dat
File::
c:\users\Mignesh\AppData\Local\Wfifurejadanap.bin
Folder::
c:\users\Mignesh\AppData\Local\ajbnaoump
DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:6092
DirLook::
c:\users\Mignesh\AppData\Roaming\B1AA70B0751AB96B8967FCA05B3C2BDD

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM
  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Please include the following in your next post:
  • ComboFix log
  • MBAM log
Post #9
Once again thanks for the help. I did everything that was listed on the previous post. I am now able to browse on the internet. I am not sure if we are completely done, but it is a great start. Below are the ComboFix and MBAM logs. Thanks as usual.


ComboFix 10-09-19.01 - Mignesh 09/19/2010 21:16:48.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.958.136 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Mignesh\Desktop\CFScript.txt
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\users\Mignesh\AppData\Local\Wfifurejadanap.bin"

file zipped: c:\users\Mignesh\AppData\Local\ekekoxev.dll
file zipped: c:\users\Mignesh\AppData\Local\uwuriwesozomufa.dll
file zipped: c:\users\Mignesh\AppData\Local\Xhojuy.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Mignesh\AppData\Local\ajbnaoump

.
((((((((((((((((((((((((( Files Created from 2010-08-20 to 2010-09-20 )))))))))))))))))))))))))))))))
.

2010-09-20 02:28 . 2010-09-20 02:28 ——– d—–w- c:\users\Shrina Patel\AppData\Local\temp
2010-09-20 02:28 . 2010-09-20 02:28 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-09-20 02:28 . 2010-09-20 02:28 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-09-20 02:28 . 2010-09-20 02:28 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2010-09-20 02:12 . 2010-09-20 02:14 ——– d—–w- C:\32788R22FWJFW
2010-09-17 06:01 . 2010-09-17 06:01 ——– d—–w- c:\program files\Windows Portable Devices
2010-09-17 03:44 . 2009-09-10 02:00 92672 —-a-w- c:\windows\system32\UIAnimation.dll
2010-09-17 03:44 . 2009-09-10 02:01 3023360 —-a-w- c:\windows\system32\UIRibbon.dll
2010-09-17 03:44 . 2009-09-10 02:00 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll
2010-09-17 03:41 . 2009-10-01 01:02 30208 —-a-w- c:\windows\system32\WPDShextAutoplay.exe
2010-09-17 03:41 . 2009-10-01 01:02 31232 —-a-w- c:\windows\system32\BthMtpContextHandler.dll
2010-09-17 03:41 . 2009-10-01 01:01 81920 —-a-w- c:\windows\system32\wpdbusenum.dll
2010-09-17 03:41 . 2009-10-01 01:01 60928 —-a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2010-09-17 03:41 . 2009-10-01 01:02 2537472 —-a-w- c:\windows\system32\wpdshext.dll
2010-09-17 03:41 . 2009-10-01 01:02 334848 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2010-09-17 03:41 . 2009-10-01 01:02 87552 —-a-w- c:\windows\system32\WPDShServiceObj.dll
2010-09-17 03:41 . 2009-10-01 01:01 546816 —-a-w- c:\windows\system32\wpd_ci.dll
2010-09-17 03:41 . 2009-10-01 01:01 160256 —-a-w- c:\windows\system32\PortableDeviceTypes.dll
2010-09-17 03:41 . 2009-10-01 01:01 350208 —-a-w- c:\windows\system32\WPDSp.dll
2010-09-17 03:41 . 2009-10-01 01:01 196608 —-a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2010-09-17 03:41 . 2009-10-01 01:01 100864 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2010-09-17 03:39 . 2009-10-08 21:08 234496 —-a-w- c:\windows\system32\oleacc.dll
2010-09-17 03:39 . 2009-10-08 21:07 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2010-09-17 03:39 . 2009-10-08 21:08 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll
2010-09-17 03:21 . 2010-09-17 03:21 ——– d-sh–w- c:\windows\system32\%APPDATA%
2010-09-15 00:16 . 2010-04-16 16:46 502272 —-a-w- c:\windows\system32\usp10.dll
2010-09-15 00:16 . 2010-03-05 14:01 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-09-15 00:16 . 2010-08-17 14:11 128000 —-a-w- c:\windows\system32\spoolsv.exe
2010-09-15 00:16 . 2010-04-05 17:02 317952 —-a-w- c:\windows\system32\MP4SDECD.DLL
2010-09-15 00:16 . 2010-05-27 20:08 739328 —-a-w- c:\windows\system32\inetcomm.dll
2010-09-15 00:14 . 2010-01-06 15:39 1696256 —-a-w- c:\windows\system32\gameux.dll
2010-09-15 00:14 . 2010-04-16 16:43 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2010-09-15 00:14 . 2010-04-16 14:39 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-09-14 23:52 . 2010-09-14 23:52 ——– d—–w- c:\users\Mignesh\AppData\Roaming\AVG9
2010-09-06 05:46 . 2010-09-06 06:02 ——– d—–w- c:\users\Mignesh\DoctorWeb
2010-09-06 04:37 . 2010-09-06 04:37 63488 —-a-w- c:\users\Mignesh\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-06 04:37 . 2010-09-06 04:37 52224 —-a-w- c:\users\Mignesh\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-06 04:37 . 2010-09-06 04:37 117760 —-a-w- c:\users\Mignesh\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-06 04:37 . 2010-09-06 04:37 ——– d—–w- c:\users\Mignesh\AppData\Roaming\SUPERAntiSpyware.com
2010-09-06 04:37 . 2010-09-06 04:37 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2010-09-06 04:37 . 2010-09-06 04:37 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-09-06 01:52 . 2010-09-06 01:52 ——– d—–w- C:\$AVG
2010-09-06 00:54 . 2010-09-06 00:56 ——– d—–w- c:\windows\system32\ca-ES
2010-09-06 00:54 . 2010-09-06 00:56 ——– d—–w- c:\windows\system32\eu-ES
2010-09-06 00:53 . 2010-09-06 00:55 ——– d—–w- c:\windows\system32\vi-VN
2010-09-06 00:24 . 2010-09-06 00:24 ——– d—–w- c:\windows\system32\EventProviders
2010-09-06 00:13 . 2010-09-06 00:13 ——– d—–w- c:\programdata\Office Genuine Advantage
2010-09-05 23:32 . 2010-09-05 23:32 ——– d—–w- c:\users\Mignesh\AppData\Roaming\IObit
2010-09-05 23:32 . 2010-09-05 23:32 ——– d—–w- c:\program files\IObit
2010-09-05 22:57 . 2010-09-05 22:57 12536 —-a-w- c:\windows\system32\avgrsstx.dll
2010-09-05 22:57 . 2010-09-05 22:57 52872 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-09-05 22:57 . 2010-09-05 22:57 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-09-05 22:57 . 2010-09-05 22:57 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-09-05 22:56 . 2010-09-05 22:57 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-09-05 22:56 . 2010-09-20 02:05 ——– d—–w- c:\windows\system32\drivers\Avg
2010-09-05 22:56 . 2010-09-05 22:56 ——– d—–w- c:\programdata\AVG Security Toolbar
2010-09-05 22:53 . 2010-09-05 22:53 ——– d—–w- c:\program files\AVG
2010-09-05 22:53 . 2010-09-05 22:53 ——– d—–w- c:\programdata\avg9
2010-09-05 22:48 . 2010-09-05 22:48 ——– d—–w- c:\users\Mignesh\AppData\Roaming\Malwarebytes
2010-09-05 22:47 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-05 22:47 . 2010-09-05 22:47 ——– d—–w- c:\programdata\Malwarebytes
2010-09-05 22:47 . 2010-09-05 22:47 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-05 22:47 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-05 22:29 . 2010-09-05 22:29 2838 —-a-w- c:\users\Mignesh\AppData\Local\uwuriwesozomufa.dll
2010-09-04 18:32 . 2010-09-04 18:32 2838 —-a-w- c:\users\Mignesh\AppData\Local\ekekoxev.dll
2010-09-04 18:24 . 2010-09-04 18:24 ——– d—–w- c:\users\Mignesh\AppData\Roaming\B1AA70B0751AB96B8967FCA05B3C2BDD
2010-09-04 18:16 . 2010-09-04 18:16 57344 —-a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-09-04 18:14 . 2010-09-04 18:10 185640 —-a-w- c:\programdata\DivX\Setup\finishPlugin.dll
2010-09-04 18:14 . 2010-09-04 18:09 1062184 —-a-w- c:\programdata\DivX\Setup\Resource.dll
2010-09-04 18:14 . 2010-09-04 18:14 56765 —-a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-09-04 18:14 . 2010-09-04 18:09 850200 —-a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-09-04 18:14 . 2010-09-04 18:14 56997 —-a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-09-04 18:14 . 2010-09-04 18:14 57691 —-a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-09-04 18:14 . 2010-09-04 18:14 53600 —-a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-09-04 18:12 . 2010-09-04 18:12 54073 —-a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-09-04 18:12 . 2010-09-04 18:12 ——– d—–w- c:\program files\Common Files\DivX Shared
2010-09-04 18:12 . 2010-09-04 18:12 56969 —-a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-09-04 18:12 . 2010-09-05 22:28 0 —-a-w- c:\users\Mignesh\AppData\Local\Wfifurejadanap.bin
2010-09-04 18:12 . 2010-09-04 18:12 120 —-a-w- c:\users\Mignesh\AppData\Local\Xhojuy.dat
2010-09-04 18:10 . 2010-09-04 18:14 ——– d—–w- c:\program files\DivX
2010-09-04 18:09 . 2010-09-04 18:09 144696 —-a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-09-04 18:09 . 2010-09-04 18:14 ——– d—–w- c:\programdata\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-19 20:51 . 2010-05-19 17:21 42685 —-a-w- c:\programdata\nvModes.dat
2010-09-17 06:01 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2010-09-17 06:01 . 2010-09-17 06:01 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-09-17 03:37 . 2010-05-26 22:55 ——– d—–w- c:\programdata\Microsoft Help
2010-09-17 03:27 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-09-06 01:12 . 2010-05-19 17:21 ——– d—–w- c:\programdata\NVIDIA
2010-09-06 00:57 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Calendar
2010-09-06 00:57 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Sidebar
2010-09-06 00:57 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Journal
2010-09-06 00:57 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Collaboration
2010-09-06 00:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Photo Gallery
2010-09-06 00:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Defender
2010-09-05 22:55 . 2010-07-05 21:15 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-09-04 18:14 . 2010-05-22 23:48 ——– d—–w- c:\users\Mignesh\AppData\Roaming\DivX
2010-09-04 18:12 . 2010-05-19 23:45 ——– d—–w- c:\program files\Google
2010-09-04 01:12 . 2010-05-17 19:51 680 —-a-w- c:\users\Mignesh\AppData\Local\d3d9caps.dat
2010-08-29 20:33 . 2010-06-16 21:50 ——– d—–w- c:\program files\LimeWire
2010-08-11 21:57 . 2010-05-17 19:51 100432 —-a-w- c:\users\Mignesh\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-11 08:14 . 2010-08-11 08:14 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-08-11 08:07 . 2010-05-26 23:01 ——– d—–w- c:\program files\Microsoft Works
2010-08-08 18:17 . 2010-08-08 18:17 ——– d—–w- c:\program files\Microsoft
2010-08-08 18:17 . 2010-08-08 18:16 ——– d—–w- c:\program files\Windows Live
2010-08-08 18:16 . 2010-08-08 18:16 ——– d—–w- c:\program files\Windows Live SkyDrive
2010-08-08 18:12 . 2010-08-08 18:12 ——– d—–w- c:\program files\Common Files\Windows Live
2010-06-28 08:00 . 2010-07-05 20:47 108032 —-a-w- c:\windows\system32\ff_vfw.dll
2010-06-26 06:05 . 2010-09-06 00:03 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-09-06 00:03 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-09-06 00:03 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-09-06 00:03 133632 —-a-w- c:\windows\system32\ieUnatt.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\users\Mignesh\AppData\Roaming\B1AA70B0751AB96B8967FCA05B3C2BDD —-



((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-06-30 2102600]

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-06-30 19:23 2102600 —-a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-04 21:50 1197448 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-06-30 2102600]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-06-30 2102600]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-17 3872080]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-08-25 2424560]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-19 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-20 1316136]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-03 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-03 92704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-09-05 2065760]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-20 135664]
R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [2010-06-30 431432]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 Normandy;Normandy SR2; [x]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2010-09-05 52872]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2010-09-05 216400]
S1 AvgTdiX;AVG Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2010-09-05 243024]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2010-01-08 380928]
S2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-09-05 308136]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-20 03:11]

2010-09-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-20 03:11]

2010-09-19 c:\windows\Tasks\User_Feed_Synchronization-{811831D9-272E-4264-81D7-06F9CD07AF39}.job
- c:\windows\system32\msfeedssync.exe [2010-09-06 04:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-19 21:28
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-09-19 21:34:48
ComboFix-quarantined-files.txt 2010-09-20 02:34
ComboFix2.txt 2010-09-19 21:31

Pre-Run: 463,694,438,400 bytes free
Post-Run: 463,647,866,880 bytes free

- - End Of File - - B7EC6EE4454AF4E4E1DF08AF9D639E9E
Upload was successful



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4653

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

9/19/2010 10:02:46 PM
mbam-log-2010-09-19 (22-02-46).txt

Scan type: Quick scan
Objects scanned: 153120
Time elapsed: 13 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Post #10
syxxpac316:

I'm glad it's running better. We still have a few things to to though:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Java™ 6 Update 18 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. If it does not, let me know.

Once the install is complete…

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
    • Trace and Log Files
  • Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.
  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • Kaspersky log
Post #11 last edited
Here is the Kaspersky log. It took about 4 hours to complete the scan, I don't know if thats normal. I did everything that was instructed in the previous post. I'm not sure if you saw anything else on the other logs. Thanks for the help, please let me know if there is anything else I can do to help his cpu. ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Tuesday, September 21, 2010 Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, September 20, 2010 22:35:50 Records in database: 4232702 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 95077 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 04:12:30 No threats found. Scanned area is clean. Selected area has been scanned.
Post #12
syxxpac316:

Your logs look good! All I have left for you to do is another update and some very important cleanup:

🖼Click to load external image (Posted Image) Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

🖼Click to load external image (Posted Image) Uninstall ComboFix
  • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
    Combofix /Uninstall
🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Delete the following tools along with any other logs you saved from our work:
  • DDS
  • GMER
  • Rootkit Unhooker
🖼Click to load external image (Posted Image) Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application and MBAM current and updated. Scan with them at least weekly.
  • Avoid using P2P programs. Refer back to my earlier post for more information.
  • Please carefully review the information in the Security - Best Practices and Prevention forum located HERE
Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #13
I updated Adobe reader and removed all of the scanners and logs like i was instructed. I also ran the TFC scanner. Everything seems good. I wanna thank you for all your help. I really appreciate it.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI