What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Possible Virus/Malware ?

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, today I discovered an extrange behaviour in my desktop. There is a "no name" program running with a "no name icon" in the taskbar. I tried to right click on it, but no answer. I tried to left click on it and same result, no answer. Task manager doesn't display any task running (and too many services to guess what could it be). I also looked at the startup programs (both using msconfig and startupctl) and nothing not expected is there. I feel it could be a malware or virus executing. So, I already executed AFT cleaning and Anti Malware from Malware' Bytes, after updating it and Fast analysis, but it doesn't find anything. What could I do to find out what is really happening/running? And what could be next step to be sure it is not any virus/malware? Thanks so much Javier
Post #4

Posted Image

Can you post the scan results from MBAM?


I just ran again MBAM today. Here is the log of the scan that again said "nothing discovered" (sorry, the "real" log is in spanish, I will try to translate into english, may be the translation is not the best, but hopefully understandable and usable):

**************************************************************

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Data Base Version: 4845

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

16/10/2010 10:15:27
mbam-log-2010-10-16 (10-15-27).txt

Type of Analysis: Fast Analysis
Objects: 163163
Time: 6 min(s), 22 sec(s)

In Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Elements Infected: 0
Folders Infected: 0
Files Infected: 0

In Memory Processes Infected:
(No malicious elements has been detected)

Memory Modules Infected:
(No malicious elements has been detected)

Registry Keys Infected:
(No malicious elements has been detected)

Registry Values Infected:
(No malicious elements has been detected)

Registry Data Elements Infected:
(No malicious elements has been detected)

Folder Infected:
(No malicious elements has been detected)

Files Infected:
(No malicious elements has been detected)

**********************************************************************

Waiting your news.
Thanks for your help.
Post #5
Please do not delete anything unless instructed to.


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:


Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

    Note: If you have SP3, use the SP2 package.
    If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.
Post #6
LDTate, thanks. I will not have access to the referred computer in a couple of days. As soon as I will be able, I'll follow your instructions, and will put here the result of ComboFix. Thanks again and regards.
Post #7

LDTate, thanks.

I will not have access to the referred computer in a couple of days. As soon as I will be able, I'll follow your instructions, and will put here the result of ComboFix.

Thanks again and regards.

:thumbup:
Post #8
Hi, LDTate,

there was someone in the computer and I was able to access to it vía a remote VNC connection. I ran ATF (in fact I had already run it days ago, but I did it again) and then ComboFix, and here is the ComboFix log / result. Hoe it will help.

Another important thing is that this time, when the computer was booted, the strange blank icon in the taskbar was not there!!!!! :wacko: And believe me, the only thing before this boot we did was to execute MBAM.

In fact, once the ComboFix was executed, we rebooted the computer and, again, the offending blank icon was still NOT there. Phantoms? Virus scheduled to be executed only in particular circumstances? :unsure: Don't know. Anyway, here is the ComboFix log.

There was also a msg about Windows Genuine Advantage problem…. :blush: it has already been solved….. :angry:

Thanks a lot again for your help…..

***************************************

ComboFix 10-10-15.03 - Estela 16/10/2010 14:42:55.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.1023.415 [GMT 2:00]
Running from: c:\documents and settings\[removed]\Escritorio\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

*********
* OOOPS, :blush: I forgot to disable it. When I got the ComboFix msg about it, I disabled it
* and then resumed Combofix execution….. :blush:
*********
.
ADS - WINDOWS: deleted 48 bytes in 1 streams.
ADS - explorer.exe: deleted 88 bytes in 2 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Estela\Reciente\lesiones-dermatologicas.pdf
t:\docume~1\Estela\CONFIG~1\Temp\7zSA.tmp\vnchooks.dll
t:\docume~1\Estela\CONFIG~1\Temp\7zSF.tmp\winvnc.exe
t:\documents and settings\Estela\Configuración local\Temp\7zSA.tmp\vnchooks.dll
t:\documents and settings\Estela\Configuración local\Temp\7zSF.tmp\winvnc.exe

.
((((((((((((((((((((((((( Files Created from 2010-09-16 to 2010-10-16 )))))))))))))))))))))))))))))))
.

2010-10-12 09:06 . 2010-10-12 09:06 160704 —-a-w- c:\windows\system32\drivers\afcdp.sys
2010-10-12 09:06 . 2010-10-12 09:06 911680 —-a-w- c:\windows\system32\drivers\tdrpm258.sys
2010-10-12 09:06 . 2010-10-12 09:06 581984 —-a-w- c:\windows\system32\drivers\timntr.sys
2010-10-12 09:06 . 2010-10-12 09:06 166272 —-a-w- c:\windows\system32\drivers\snapman.sys
2010-10-12 09:05 . 2010-10-12 09:05 ——– d—–w- c:\archivos de programa\Acronis
2010-10-12 09:05 . 2010-10-12 09:06 ——– d—–w- c:\archivos de programa\Archivos comunes\Acronis
2010-10-09 21:08 . 2010-10-09 21:08 ——– d—–w- c:\documents and settings\Estela\Datos de programa\Malwarebytes
2010-10-09 21:08 . 2010-04-29 13:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-09 21:08 . 2010-10-09 21:08 ——– d—–w- c:\documents and settings\All Users\Datos de programa\Malwarebytes
2010-10-09 21:08 . 2010-04-29 13:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-10-09 17:08 . 2010-10-09 17:08 ——– d—–w- c:\windows\system32\winrm
2010-10-09 17:08 . 2010-10-09 17:08 ——– d—–w- c:\windows\system32\GroupPolicy
2010-10-09 17:08 . 2010-10-09 17:09 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$
2010-10-09 16:36 . 2010-10-09 16:36 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2010-10-09 16:36 . 2010-10-09 16:36 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-10-09 16:35 . 2010-10-11 10:48 ——– d—–w- c:\windows\system32\drivers\NIS
2010-10-09 16:35 . 2010-10-09 16:35 ——– d—–w- c:\archivos de programa\Windows Sidebar
2010-10-09 16:35 . 2010-10-09 16:35 ——– d—–w- c:\archivos de programa\Norton Internet Security
2010-10-09 16:35 . 2010-10-09 19:28 ——– d—–w- c:\documents and settings\All Users\Datos de programa\Norton
2010-10-09 16:35 . 2010-10-09 16:35 ——– d—–w- c:\archivos de programa\NortonInstaller

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATI Launchpad"="c:\archivos de programa\ATI Multimedia\main\launchpd.exe" [2001-03-26 77824]
"swg"="c:\archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-08 68856]
"Google Update"="c:\documents and settings\Estela\Configuración local\Datos de programa\Google\Update\GoogleUpdate.exe" [2010-03-28 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\archivos de programa\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Lexmark X1100 Series"="c:\archivos de programa\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
"ADUserMon"="c:\archivos de programa\Iomega\AutoDisk\ADUserMon.exe" [2002-09-24 147456]
"Iomega Drive Icons"="p:\archivos de programa\Iomega\DriveIcons\ImgIcon.exe" [2002-08-13 86016]
"Deskup"="p:\archivos de programa\Iomega\DriveIcons\deskup.exe" [2002-07-16 32768]
"RTBatteryMeter"="c:\archivos de programa\Ruling Technologies\GameDeviceDrivers\RFPIcon.exe" [2002-03-04 49152]
"RTGameClean"="c:\archivos de programa\Ruling Technologies\GameDeviceDrivers\RegClean.exe" [2002-04-29 49152]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"iTunesHelper"="c:\archivos de programa\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"Conceptronic Conceptronic 54Mbps Wireless Utility"="c:\archivos de programa\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe" [2007-01-19 950272]
"LiveMonitor"="c:\archivos de programa\MSI\Live Update 3\LMonitor.exe" [2008-04-30 498176]
"QuickTime Task"="p:\archivos de programa\QuickTime\qttask.exe" [2009-05-26 413696]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 577536]
"ANIWZCS2Service"="c:\archivos de programa\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"TrueImageMonitor.exe"="p:\archivos de programa\Acronis\TrueImageHome\TrueImageMonitor.exe" [2010-06-16 5138560]
"Servicio de Acronis Scheduler2 "="c:\archivos de programa\Archivos comunes\Acronis\Schedule2\schedhlp.exe" [2010-06-16 362656]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Men£ Inicio\Programas\Inicio\
Acrobat Assistant.lnk - c:\archivos de programa\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Adobe Gamma Loader.exe.lnk - c:\archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-26 110592]
NkvMon.exe.lnk - p:\archivos de programa\Nikon\NkView5\NkvMon.exe [2007-11-1 233472]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "p:\archivos de programa\Qualcomm\Eudora\EuShlExt.dll" [2006-08-17 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Messenger\\msmsgs.exe"=
"p:\microsoft activesync 4-2\rapimgr.exe"= p:\microsoft activesync 4-2\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"p:\microsoft activesync 4-2\wcescomm.exe"= p:\microsoft activesync 4-2\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"p:\microsoft activesync 4-2\WCESMgr.exe"= p:\microsoft activesync 4-2\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=
"c:\\Archivos de programa\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"p:\\VoipBuster.com\\VoipBuster\\VoipBuster.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Downloads\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5985:TCP"= 5985:TCP:*:Disabled:Administración remota de Windows

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1108000.005\symds.sys [10/10/2010 10:17 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1108000.005\symefa.sys [10/10/2010 10:17 173104]
R0 tdrpman258;Acronis Try&Decide; and Restore Points filter (build 258);c:\windows\system32\drivers\tdrpm258.sys [12/10/2010 11:06 911680]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1108000.005\cchpx86.sys [10/10/2010 10:17 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1108000.005\ironx86.sys [10/10/2010 10:17 116784]
R2 afcdpsrv;Acronis Nonstop Backup service;c:\archivos de programa\Archivos comunes\Acronis\CDP\afcdpsrv.exe [12/10/2010 11:06 2480048]
R2 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Datos de programa\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx86.sys [02/10/2010 0:00 692272]
R2 NIS;Norton Internet Security;c:\archivos de programa\Norton Internet Security\Engine\17.8.0.5\ccsvchst.exe [10/10/2010 10:17 126392]
R2 NMSAccess32;NMSAccess32;c:\windows\system32\NMSAccess32.exe [12/01/2009 7:15 71096]
R3 afcdp;afcdp;c:\windows\system32\drivers\afcdp.sys [12/10/2010 11:06 160704]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\archivos de programa\Archivos comunes\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/10/2010 23:07 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Datos de programa\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20101015.003\IDSXpx86.sys [13/10/2010 21:59 341880]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]
S2 gupdate1c9a8ed59e9275c;Google Update Service (gupdate1c9a8ed59e9275c);c:\archivos de programa\Google\Update\GoogleUpdate.exe [20/03/2009 1:49 133104]
S2 Programador de LiveUpdate automático;Programador de LiveUpdate automático;"c:\archivos de programa\Symantec\LiveUpdate\ALUSchedulerSvc.exe" –> c:\archivos de programa\Symantec\LiveUpdate\ALUSchedulerSvc.exe [?]
S3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\DynCal.sys [21/05/2001 15:01 8051]
S3 EraserUtilDrv10621;EraserUtilDrv10621;\??\c:\archivos de programa\Archivos comunes\Symantec Shared\EENGINE\EraserUtilDrv10621.sys –> c:\archivos de programa\Archivos comunes\Symantec Shared\EENGINE\EraserUtilDrv10621.sys [?]
S3 PIXMCV;JVC Communication PIX-MCV Driver;c:\windows\system32\drivers\pixmcvc.sys [01/02/2008 23:44 32000]
S3 PIXMCVA;JVC PIX-MCV Audio Capture;c:\windows\system32\drivers\pixmcva.sys [01/02/2008 23:46 27961]
S3 PIXMCVV;JVC PIX-MCV Video Capture;c:\windows\system32\drivers\pixmcvv.sys [01/02/2008 23:45 20953]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [19/08/2004 15:43 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder

2010-10-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\archivos de programa\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-10-16 c:\windows\Tasks\Google Software Updater.job
- c:\archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-08 23:59]

2010-10-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2009-03-19 23:49]

2010-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2009-03-19 23:49]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xportar; a Microsoft Excel - c:\archiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {F0A761D1-1968-4CC0-88A2-29DA177E831E} = 192.168.1.1
DPF: {08EC5265-BFFB-48C1-8B3B-B96B19921616} - hxxp://media.fotoprix.com/ReveladoOnline/1.3.1.11/setup.exe
DPF: {48D9E4FD-2FD3-4C69-BAF3-682E9C616815} - hxxp://notificaciones.administracion.es/PortalCiudadano/CABS/PaqueteSin/SNAE_MSA.cab
DPF: {B785FA3C-1DE9-4D20-8396-613C486FE95E} - hxxps://aeat.es/imagenes/comun/cactivex.cab
.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\archivos de programa\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\archivos de programa\Norton Internet Security\Engine\17.8.0.5\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\Machine\System\CurrentControlSet]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

[HKEY_LOCAL_MACHINE\software\BufferZone\Virtual\Untrusted\USER\LocalSystem]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|é•9~*]
"A0C0110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1424)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(5228)
c:\windows\system32\WININET.dll
t:\docume~1\Estela\CONFIG~1\Temp\7zSD.tmp\vnchooks.dll
p:\archivos de programa\Iomega\DriveIcons\IMGHOOK.DLL
c:\archiv~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\archivos de programa\Archivos comunes\Acronis\Schedule2\schedul2.exe
c:\archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\ATKKBService.exe
c:\archivos de programa\Bonjour\mDNSResponder.exe
c:\archivos de programa\Archivos comunes\InterVideo\DeviceService\DevSvc.exe
c:\archiv~1\Iomega\System32\AppServices.exe
c:\archivos de programa\Java\jre6\bin\jqs.exe
c:\archivos de programa\Iomega\AutoDisk\ADService.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\WgaTray.exe
c:\archivos de programa\Lexmark X1100 Series\lxbkbmon.exe
c:\windows\system32\rundll32.exe
c:\windows\SOUNDMAN.EXE
p:\microsoft activesync 4-2\wcescomm.exe
p:\micros~1\rapimgr.exe
c:\archivos de programa\iPod\bin\iPodService.exe
c:\windows\system32\rundll32.exe
c:\documents and settings\Estela\Escritorio\FJEuvncSCgeneral.exe
t:\docume~1\Estela\CONFIG~1\Temp\7zSD.tmp\winvnc.exe
.
**************************************************************************
.
Completion time: 2010-10-16 15:01:49 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-16 13:01

Pre-Run: 16.992.768.000 bytes libres
Post-Run: 16.982.499.328 bytes libres

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 3EC02BD0D8B44C179F19989748EFDAFF
Post #9 last edited

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Estela\Reciente\lesiones-dermatologicas.pdf
t:\docume~1\Estela\CONFIG~1\Temp\7zSA.tmp\vnchooks.dll
t:\docume~1\Estela\CONFIG~1\Temp\7zSF.tmp\winvnc.exe
t:\documents and settings\Estela\Configuración local\Temp\7zSA.tmp\vnchooks.dll
t:\documents and settings\Estela\Configuración local\Temp\7zSF.tmp\winvnc.exe

My guess is it was one of these or something that was leftover.

Looks good to me.

You need to unistall Combofix when you get the PC in front of you.

Good job :thumbup:

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:
  • Click START run
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

For Vista / Windows 7
  • Click START Search
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
Post #10
LDTate, thanks. Having a look to your suggestion, I feel that only the first line could be the problem, even it is a pdf file with a report from the research lab where my daughter works. The other four seems to be part of the VNC program we use for the remote control of her computer. Anyway, being in the temporary files I will delete them anyway. I also thank you for the guideliness for uninstalling ComboFix, we will do. Thanks to you very much for all your help. Hopefully the strange icon wiol not appear again. Our best regards.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI