What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PC under attack from White Smoke virus.

60 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

http://forums.whatthetech.com/index.php?showtopic=115885&view=findpost&p=699570

Collect::
c:\documents and settings\After the flop\Application Data\Ax403hUpc.exe
c:\windows\wpe2sh.dll
c:\windows\system32\i5yzbueb.dll
c:\windows\user.exe
c:\windows\lsass.exe
c:\windows\nvsvc32.exe
c:\windows\system.exe
c:\windows\setup.exe

DirLook::
C:\jgh

Folder::
c:\windows\system32\3074
c:\windows\system32\1078
c:\windows\system32\%APPDATA%

RenV::
c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager .exe
c:\program files\Yahoo!\Messenger\ypager .exe
c:\windows\system32\rundll32 .exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rtiboqiqurihik"=-
"uPc+MV0NctYCxl"=-
"MKee"=-
"MKcuc"=-
"MKdw+"=-
"MKexe"=-
"MKevc"=-

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:52753

FireFox::
FF - ProfilePath - c:\documents and settings\After the flop\Application Data\Mozilla\Firefox\Profiles\skjh66zf.default\
FF - prefs.js: network.proxy.http_port - 52753
Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe


Then post the results log using Copy / Paste
Post #17
ComboFix 10-12-13.02 - After the flop 12/14/2010 1:31.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.559 [GMT -6:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\After the flop\Desktop\CFScript.txt
FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Created a new restore point

file zipped: c:\documents and settings\After the flop\Application Data\Ax403hUpc.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\After the flop\Application Data\Ax403hUpc.exe
c:\windows\system32\%APPDATA%
c:\windows\system32\1078
c:\windows\system32\1078\inf1078.dat
c:\windows\system32\3074
c:\windows\system32\3074\inf3074.dat

.
((((((((((((((((((((((((( Files Created from 2010-11-14 to 2010-12-14 )))))))))))))))))))))))))))))))
.

2010-12-12 04:40 . 2010-12-12 04:43 ——– d—–w- c:\documents and settings\After the flop\Local Settings\Application Data\Temp
2010-12-12 03:43 . 2010-09-18 06:53 974848 ——w- c:\windows\system32\dllcache\mfc42.dll
2010-12-12 03:43 . 2010-09-18 06:53 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll
2010-12-12 03:42 . 2010-08-23 16:12 617472 ——w- c:\windows\system32\dllcache\comctl32.dll
2010-12-12 03:39 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe
2010-12-12 03:38 . 2010-09-10 05:58 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll
2010-12-12 03:34 . 2010-06-18 13:36 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe
2010-12-12 01:44 . 2010-12-12 01:55 ——– d—–w- C:\jgh
2010-12-10 06:28 . 2010-12-10 06:28 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-12-10 06:28 . 2010-11-29 23:42 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-10 06:28 . 2010-11-29 23:42 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-12-10 06:07 . 2010-12-10 06:07 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar
2010-12-10 06:06 . 2010-12-10 06:06 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-12-10 05:56 . 2010-12-10 05:56 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2010-12-03 15:57 . 2010-12-03 15:59 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-11-19 20:08 . 2010-11-19 20:08 ——– d—–w- c:\documents and settings\After the flop\Local Settings\Application Data\AVG Security Toolbar

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 18:23 . 2004-08-10 19:00 974848 —-a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-10 19:00 974848 ——w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-10 19:00 954368 —-a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-10 19:00 953856 —-a-w- c:\windows\system32\mfc40u.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of C:\jgh —-

2010-12-12 01:55 . 2010-12-12 01:55 0 —-a-w- c:\jgh\N_\29695
2010-12-12 01:55 . 2010-12-12 01:55 98 —-a-w- c:\jgh\N_\450
2010-12-12 01:55 . 2010-12-12 01:55 98 —-a-w- c:\jgh\N_\25996
2010-12-12 01:55 . 2010-12-12 01:55 0 —-a-w- c:\jgh\N_\18467
2010-12-12 01:55 . 2010-12-12 01:55 34 —-a-w- c:\jgh\N_\28322
2010-12-12 01:55 . 2010-12-12 01:55 0 —-a-w- c:\jgh\N_\31773
2010-12-12 01:55 . 2010-12-12 01:55 9 —-a-w- c:\jgh\RBoot.dat
2010-12-12 01:55 . 2010-12-12 01:55 24 —-a-w- c:\jgh\N_\29272
2010-12-12 01:55 . 2010-12-12 01:55 1544 —-a-w- c:\jgh\N_\32551
2010-12-12 01:55 . 2010-12-12 01:55 33 —-a-w- c:\jgh\N_\22329
2010-12-12 01:55 . 2010-12-12 01:55 0 —-a-w- c:\jgh\N_\5301
2010-12-12 01:55 . 2010-12-12 01:55 0 —-a-w- c:\jgh\N_\17909
2010-12-12 01:55 . 2010-12-12 01:55 1145 —-a-w- c:\jgh\N_\25582
2010-12-12 01:53 . 2010-12-12 01:55 511 —-a-w- c:\jgh\N_\19406
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\max_.dat
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\27914
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\9923
2010-12-12 01:53 . 2010-12-12 01:53 33 —-a-w- c:\jgh\N_\11385
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\20547
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\13135
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\26859
2010-12-12 01:53 . 2010-12-12 01:53 134 —-a-w- c:\jgh\N_\7869
2010-12-12 01:53 . 2010-12-12 01:53 8 —-a-w- c:\jgh\N_\423
2010-12-12 01:53 . 2010-12-12 01:53 44 —-a-w- c:\jgh\N_\11634
2010-12-12 01:53 . 2010-12-12 01:53 44 —-a-w- c:\jgh\N_\24318
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\8297
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\Zlob01
2010-12-12 01:53 . 2010-12-12 01:53 248 —-a-w- c:\jgh\N_\1116
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\23929
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\24509
2010-12-12 01:53 . 2010-12-12 01:53 318 —-a-w- c:\jgh\N_\27395
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\31996
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\20867
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\1904
2010-12-12 01:53 . 2010-12-12 01:53 8192 —-a-w- c:\jgh\cfdummy
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\cfdummy00
2010-12-12 01:53 . 2009-04-17 23:37 147456 —-a-w- c:\jgh\Catchme.tmp
2010-12-12 01:53 . 2010-12-12 01:53 27 —-a-w- c:\jgh\N_\18075
2010-12-12 01:53 . 2010-12-12 01:53 8367 —-a-w- c:\jgh\ViPev01
2010-12-12 01:53 . 2010-12-12 01:53 4526 —-a-w- c:\jgh\Temp.dat
2010-12-12 01:53 . 2010-12-12 01:53 8433 —-a-w- c:\jgh\ViPev00
2010-12-12 01:53 . 2010-12-12 01:53 8 —-a-w- c:\jgh\Drive.folder.dat
2010-12-12 01:53 . 2010-12-12 01:53 6 —-a-w- c:\jgh\Drives.dat
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\23433
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\13762
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\32021
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\d-del_A.dat
2010-12-12 01:53 . 2010-12-12 01:53 474794 —-a-w- c:\jgh\ClistB.dat
2010-12-12 01:53 . 2010-12-12 01:53 0 —-a-w- c:\jgh\N_\20895
2010-12-12 01:53 . 2010-12-12 01:53 15061 —-a-w- c:\jgh\autorun_inf.dat
2010-12-12 01:53 . 2010-12-12 01:53 35 —-a-w- c:\jgh\vundonames.dat
2010-12-12 01:53 . 2010-12-12 01:53 3219 —-a-w- c:\jgh\autorun_infB.dat
2010-12-12 01:53 . 2010-12-12 01:53 242 —-a-w- c:\jgh\borlander_folder.dat
2010-12-12 01:52 . 2010-12-12 01:52 752 —-a-w- c:\jgh\borlander_file.dat
2010-12-12 01:52 . 2010-12-12 01:52 15917 —-a-w- c:\jgh\GOLDUN.DAT
2010-12-12 01:52 . 2010-12-12 01:52 483617 —-a-w- c:\jgh\Cfolders.dat
2010-12-12 01:52 . 2010-12-12 01:53 3309044 —-a-w- c:\jgh\Cfiles.dat
2010-12-12 01:52 . 2010-12-12 01:52 29665 —-a-w- c:\jgh\attr.dat
2010-12-12 01:52 . 2010-12-12 01:52 34 —-a-w- c:\jgh\N_\16348
2010-12-12 01:52 . 2010-12-12 01:52 1739 —-a-w- c:\jgh\run.sed
2010-12-12 01:52 . 2010-12-12 01:52 609 —-a-w- c:\jgh\Env.sed
2010-12-12 01:52 . 2010-12-12 01:52 33 —-a-w- c:\jgh\N_\29446
2010-12-12 01:52 . 2010-12-12 01:52 24 —-a-w- c:\jgh\N_\794
2010-12-12 01:52 . 2010-12-12 01:52 82940 —-a-w- c:\jgh\whiteAll.dat
2010-12-12 01:52 . 2010-12-12 01:52 4073 —-a-w- c:\jgh\vRun_DLL
2010-12-12 01:52 . 2010-12-12 01:52 39854 —-a-w- c:\jgh\v_wht.dat
2010-12-12 01:52 . 2010-12-12 01:52 606 —-a-w- c:\jgh\unhand.dat
2010-12-12 01:52 . 2010-12-12 01:52 176 —-a-w- c:\jgh\notifykeys.dat
2010-12-12 01:52 . 2010-12-12 01:52 210 —-a-w- c:\jgh\notifykeysB.dat
2010-12-12 01:52 . 2010-12-12 01:52 44 —-a-w- c:\jgh\N_\13421
2010-12-12 01:52 . 2010-12-12 01:52 1137 —-a-w- c:\jgh\whitedirCreated.dat
2010-12-12 01:52 . 2010-12-12 01:52 24698 —-a-w- c:\jgh\whitedir.dat
2010-12-12 01:52 . 2010-12-12 01:52 3193 —-a-w- c:\jgh\dll_whitelist.dat
2010-12-12 01:52 . 2010-12-12 01:52 0 —-a-w- c:\jgh\N_\18162
2010-12-12 01:52 . 2010-12-12 01:52 27960 —-a-w- c:\jgh\dnd.dat
2010-12-12 01:52 . 2010-12-12 01:52 34 —-a-w- c:\jgh\FdsvOK
2010-12-12 01:52 . 2010-12-12 01:52 802 —-a-w- c:\jgh\pend.txt
2010-12-12 01:52 . 2010-12-12 01:52 57 —-a-w- c:\jgh\N_\CmdLine00
2010-12-12 01:52 . 2010-12-12 01:52 250 —-a-w- c:\jgh\N_\13416
2010-12-12 01:52 . 2010-12-12 01:52 98 —-a-w- c:\jgh\N_\28693
2010-12-12 01:52 . 2010-12-12 01:52 37 —-a-w- c:\jgh\PreDIR
2010-12-12 01:52 . 2010-12-12 01:52 0 —-a-w- c:\jgh\Gateway
2010-12-12 01:49 . 2010-12-12 01:49 2 —-a-w- c:\jgh\IntelMatrix.dat
2010-12-12 01:49 . 2010-12-12 01:53 0 —-a-w- c:\jgh\Vikpev01
2010-12-12 01:49 . 2010-12-12 01:52 147804 —-a-w- c:\jgh\VikPev00
2010-12-12 01:49 . 2010-12-12 01:49 3594 —-a-w- c:\jgh\ConEnv.sed
2010-12-12 01:49 . 2010-12-12 01:49 201 —-a-w- c:\jgh\Templates.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 273 —-a-w- c:\jgh\StartUp.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 258 —-a-w- c:\jgh\StartMenu.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 143 —-a-w- c:\jgh\SendTo.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 143 —-a-w- c:\jgh\Recent.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 303 —-a-w- c:\jgh\Programs.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 719 —-a-w- c:\jgh\Profiles.Folder.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 152 —-a-w- c:\jgh\PrintHood.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 258 —-a-w- c:\jgh\Pictures.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 267 —-a-w- c:\jgh\Personal.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 146 —-a-w- c:\jgh\NetHood.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 246 —-a-w- c:\jgh\Music.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 342 —-a-w- c:\jgh\LocalSettings.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 368 —-a-w- c:\jgh\LocalAppData.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 323 —-a-w- c:\jgh\History.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 255 —-a-w- c:\jgh\Favorites.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 243 —-a-w- c:\jgh\Desktop.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 248 —-a-w- c:\jgh\Cookies.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 490 —-a-w- c:\jgh\Cache.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 410 —-a-w- c:\jgh\AppData.folder.dat
2010-12-12 01:49 . 2010-12-12 01:49 390 —-a-w- c:\jgh\Profiles.Folder.dat
2010-12-12 01:45 . 2010-12-12 01:52 6121 —-a-w- c:\jgh\SetPath.bat
2010-12-12 01:44 . 2010-12-12 01:45 2056 —-a-w- c:\jgh\SysPath.dat
2010-12-12 01:44 . 2010-12-12 01:44 0 —-a-w- c:\jgh\f_system
2010-12-12 01:44 . 2010-12-12 01:46 5245 —-a-w- c:\jgh\progfile.dat
2010-12-12 01:44 . 2010-12-12 01:44 82 —-a-w- c:\jgh\OsId.txt
2010-12-12 01:44 . 2010-12-12 01:44 0 —-a-w- c:\jgh\restore_pt.dat
2010-12-12 01:44 . 2010-12-12 01:44 972 —-a-w- c:\jgh\CregC_.dat
2010-12-12 01:44 . 2010-12-12 01:44 0 —-a-w- c:\jgh\Administrator.user.cf
2010-12-12 01:44 . 2010-12-12 01:44 146432 —-a-w- c:\jgh\REGT.cfxxe
2010-12-12 01:44 . 2010-12-12 01:44 6578176 —-a-w- c:\jgh\clsid.hiv
2010-12-12 01:44 . 2010-12-12 01:44 709332 —-a-w- c:\jgh\clsid.dat
2010-12-12 01:44 . 2010-12-12 01:44 2225174 —-a-w- c:\jgh\badclsid
2010-12-12 01:44 . 2010-12-12 01:44 467 —-a-w- c:\jgh\MWindows.dat
2010-12-12 01:44 . 2010-12-12 01:44 0 —-a-w- c:\jgh\d-delA.dat
2010-12-12 01:44 . 2010-12-12 01:44 14 —-a-w- c:\jgh\LatestVer
2010-12-12 01:44 . 2010-12-12 01:44 35 —-a-w- c:\jgh\version.txt
2010-12-12 01:44 . 2010-12-12 01:44 75 —-a-w- c:\jgh\Mirrors
2010-12-12 01:44 . 2010-12-12 01:44 880 —-a-w- c:\jgh\ForeignWht
2010-12-12 01:44 . 2010-12-12 01:44 10 —-a-w- c:\jgh\erunt.dat
2010-12-12 01:44 . 2010-12-12 01:44 15 —-a-w- c:\jgh\kmd.dat
2010-12-12 01:44 . 2010-12-12 01:44 91 —-a-w- c:\jgh\CCS.bat
2010-12-12 01:44 . 2010-12-12 01:44 0 —-a-w- c:\jgh\NULL
2010-12-12 01:44 . 2010-12-12 01:44 2 —-a-w- c:\jgh\Start_dat
2010-12-12 01:44 . 2010-12-12 01:44 389120 —-a-r- c:\jgh\CF11935.cfxxe
2010-12-12 01:44 . 2010-12-12 01:44 146 —-a-w- c:\jgh\Resident.txt
2010-12-12 01:44 . 2004-08-10 19:00 19968 —-a-r- c:\jgh\ROUTE.cfxxe
2010-12-12 01:44 . 2008-04-14 00:12 17920 —-a-r- c:\jgh\PING.cfxxe
2010-12-12 01:44 . 2008-05-07 09:07 135168 —-a-r- c:\jgh\CSCRIPT.cfxxe
2010-12-12 01:44 . 2008-04-14 00:12 12288 —-a-r- c:\jgh\ATTRIB.cfxxe
2010-12-12 01:44 . 2010-12-12 01:44 14 —-a-w- c:\jgh\sfx.cmd
2010-12-12 01:44 . 2010-12-12 01:44 17 —-a-w- c:\jgh\DisclaimED.dat
2010-12-12 01:44 . 2010-12-12 01:44 13 —-a-w- c:\jgh\CFVersionOld
2010-12-12 01:44 . 2010-12-12 01:44 6 —-a-w- c:\jgh\NlsLanguageDefault
2010-12-12 01:44 . 2010-12-12 01:44 16 —-a-w- c:\jgh\CHCP.bat
2010-12-12 01:44 . 2010-04-26 21:58 256512 —-a-r- c:\jgh\PEV.cfxxe
2010-12-12 01:44 . 2009-04-20 18:56 31232 —-a-w- c:\jgh\NircmdB.exe
2010-12-12 01:44 . 2000-08-31 14:00 161792 —-a-r- c:\jgh\SWREG.cfxxe
2010-12-12 01:44 . 2010-12-12 01:44 338 —-a-w- c:\jgh\VerCF.bat
2010-12-12 01:44 . 2010-12-12 01:44 164 —-a-w- c:\jgh\MtPt00
2010-12-12 01:44 . 2010-12-12 01:44 43 —-a-w- c:\jgh\OsVer
2010-12-12 01:44 . 2010-12-12 01:44 40 —-a-w- c:\jgh\XP.mac
2010-12-12 01:43 . 2000-08-31 14:00 1057 —-a-w- c:\jgh\image001.gif
2010-12-12 01:43 . 2000-08-31 14:00 977 —-a-w- c:\jgh\OSid.vbs
2010-12-12 01:43 . 2009-05-02 04:26 587 —-a-w- c:\jgh\restore_pt.vbs
2010-12-12 01:43 . 2000-08-31 14:00 2176 —-a-w- c:\jgh\SvcDrv.vbs
2010-12-12 01:43 . 2010-12-12 09:38 1127 —-a-w- c:\jgh\Wmi_rem.vbs
2010-12-12 01:43 . 2009-07-14 05:09 602 —-a-w- c:\jgh\asp.str
2010-12-12 01:43 . 2010-12-12 10:24 2709 —-a-w- c:\jgh\av.vbs
2010-12-12 01:43 . 2010-07-27 22:55 875 —-a-w- c:\jgh\BootDrv.vbs
2010-12-12 01:43 . 2000-08-31 14:00 746 —-a-w- c:\jgh\DPF.str
2010-12-12 01:43 . 2010-04-19 08:44 650 —-a-w- c:\jgh\DrvRun.vbs
2010-12-12 01:43 . 2000-08-31 14:00 2428 —-a-w- c:\jgh\lnkread.vbs
2010-12-12 01:43 . 2009-06-10 17:38 30 —-a-w- c:\jgh\Rust.str
2010-12-12 01:43 . 2000-08-31 14:00 303 —-a-w- c:\jgh\embedded.sed
2010-12-12 01:43 . 2000-08-31 14:00 3558 —-a-w- c:\jgh\REGDACL.sed
2010-12-12 01:43 . 2000-08-31 14:00 9203 —-a-w- c:\jgh\RegDo.sed
2010-12-12 01:43 . 2000-08-31 14:00 287 —-a-w- c:\jgh\run2.sed
2010-12-12 01:43 . 2009-10-30 19:26 633 —-a-w- c:\jgh\toolbar.sed
2010-12-12 01:43 . 2009-05-25 15:59 7983 —-a-w- c:\jgh\ddsDo.sed
2010-12-12 01:43 . 2010-12-09 08:37 14517 —-a-w- c:\jgh\Exe.reg
2010-12-12 01:43 . 2009-04-20 18:56 31232 —-a-w- c:\jgh\n.pif
2010-12-12 01:43 . 2010-02-03 00:41 13090 —-a-w- c:\jgh\XPSBoot.reg
2010-12-12 01:43 . 2010-12-12 01:52 6630 —-a-w- c:\jgh\md5sum.pif
2010-12-12 01:43 . 2010-12-12 10:46 3049 —-a-w- c:\jgh\files.pif
2010-12-12 01:43 . 2000-08-31 14:00 2815 —-a-w- c:\jgh\ERDNTDOS.LOC
2010-12-12 01:43 . 2000-08-31 14:00 3275 —-a-w- c:\jgh\ERDNTWIN.LOC
2010-12-12 01:43 . 2000-08-31 14:00 4090 —-a-w- c:\jgh\ERUNT.LOC
2010-12-12 01:43 . 2010-12-11 20:20 260542 —-a-w- c:\jgh\srizbi.md5
2010-12-12 01:43 . 2005-10-21 02:02 163328 —-a-w- c:\jgh\ERDNT.e_e
2010-12-12 01:43 . 2000-08-31 14:00 23773 —-a-w- c:\jgh\zDomain.dat
2010-12-12 01:43 . 2010-12-12 01:44 45889 —-a-w- c:\jgh\zhsvc.dat
2010-12-12 01:43 . 2010-07-24 10:20 440 —-a-w- c:\jgh\w7Mcode.dat
2010-12-12 01:43 . 2010-07-23 04:14 440 —-a-w- c:\jgh\xpmcode.dat
2010-12-12 01:43 . 2010-11-25 05:44 60049 —-a-w- c:\jgh\xpreg.dat
2010-12-12 01:43 . 2000-08-31 14:00 276 —-a-w- c:\jgh\system_ini.dat
2010-12-12 01:43 . 2010-05-11 05:30 308 —-a-w- c:\jgh\Vipev.dat
2010-12-12 01:43 . 2010-07-27 09:17 440 —-a-w- c:\jgh\vistaMcode.dat
2010-12-12 01:43 . 2010-06-21 10:05 7584 —-a-w- c:\jgh\vun.dat
2010-12-12 01:43 . 2000-08-31 14:00 555 —-a-w- c:\jgh\svchost.dat
2010-12-12 01:43 . 2010-11-27 19:12 749 —-a-w- c:\jgh\svchost.vista.x64.dat
2010-12-12 01:43 . 2010-09-17 10:03 1153 —-a-w- c:\jgh\region.dat
2010-12-12 01:43 . 2000-08-31 14:00 820 —-a-w- c:\jgh\rogues.dat
2010-12-12 01:43 . 2000-08-31 14:00 329 —-a-w- c:\jgh\safeboot.dat
2010-12-12 01:43 . 2009-06-10 08:25 1464 —-a-w- c:\jgh\safeboot.def.dat
2010-12-12 01:43 . 2009-11-29 12:42 11987 —-a-w- c:\jgh\svc_wht.dat
2010-12-12 01:43 . 2010-04-15 00:21 520 —-a-w- c:\jgh\netsvc.bad.dat
2010-12-12 01:43 . 2000-08-31 14:00 525 —-a-w- c:\jgh\netsvc.dat
2010-12-12 01:43 . 2000-08-31 14:00 88 —-a-w- c:\jgh\NetworkService.dat
2010-12-12 01:43 . 2009-07-06 09:51 2992 —-a-w- c:\jgh\Policies.dat
2010-12-12 01:43 . 2010-05-13 22:57 64 —-a-w- c:\jgh\powp.dat
2010-12-12 01:43 . 2000-08-31 14:00 404 —-a-w- c:\jgh\Purity.dat
2010-12-12 01:43 . 2010-04-17 23:21 472 —-a-w- c:\jgh\CregC.dat
2010-12-12 01:43 . 2010-08-10 10:32 677 —-a-w- c:\jgh\Fin.dat
2010-12-12 01:43 . 2010-09-05 13:07 224 —-a-w- c:\jgh\Imefile.dat
2010-12-12 01:43 . 2000-08-31 14:00 225 —-a-w- c:\jgh\LocalService.dat
2010-12-12 01:43 . 2000-08-31 14:00 91 —-a-w- c:\jgh\LocalServiceNetworkRestricted.dat
2010-12-12 01:43 . 2000-08-31 14:00 198 —-a-w- c:\jgh\LocalSystemNetworkRestricted.dat
2010-12-12 01:43 . 2000-08-31 14:00 0 —-a-w- c:\jgh\mynul.dat
2010-12-12 01:43 . 2009-12-24 22:12 283 —-a-w- c:\jgh\ndis_combofix.dat
2010-12-12 01:43 . 2010-11-27 09:07 2181 —-a-w- c:\jgh\023v.dat
2010-12-12 01:43 . 2010-02-13 07:55 660 —-a-w- c:\jgh\023w7.dat
2010-12-12 01:43 . 2010-12-11 18:07 529840 —-a-w- c:\jgh\Creg.dat
2010-12-12 01:43 . 2010-12-12 01:44 52784 —-a-w- c:\jgh\023.dat
2010-12-12 01:43 . 2010-08-29 17:30 2141 —-a-w- c:\jgh\mbr.chk
2010-12-12 01:43 . 1999-11-10 14:00 35328 —-a-r- c:\jgh\tail.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 68096 —-a-r- c:\jgh\zip.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 212480 —-a-r- c:\jgh\swxcacls.cfxxe
2010-12-12 01:43 . 1999-11-11 06:00 38400 —-a-r- c:\jgh\s0rt.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 98816 —-a-r- c:\jgh\sed.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 31014 —-a-r- c:\jgh\setpath.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 136704 —-a-r- c:\jgh\swsc.cfxxe
2010-12-12 01:43 . 2010-12-12 01:53 8496 —-a-r- c:\jgh\ncmd.com
2010-12-12 01:43 . 2009-04-20 18:56 31232 —-a-r- c:\jgh\NirCmd.cfxxe
2010-12-12 01:43 . 2009-04-20 18:56 30720 —-a-r- c:\jgh\NirCmdC.cfxxe
2010-12-12 01:43 . 2002-09-29 19:01 68096 —-a-r- c:\jgh\pausep.cfxxe
2010-12-12 01:43 . 2010-11-08 07:20 89088 —-a-r- c:\jgh\rmbr.cfxxe
2010-12-12 01:43 . 2009-10-25 12:11 77312 —-a-r- c:\jgh\mbr.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 11264 —-a-r- c:\jgh\mtee.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 80412 —-a-r- c:\jgh\grep.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 15360 —-a-r- c:\jgh\gsar.cfxxe
2010-12-12 01:43 . 2008-11-18 19:15 173936 —-a-r- c:\jgh\handle.cfxxe
2010-12-12 01:43 . 2005-10-21 02:00 157696 —-a-r- c:\jgh\ERUNT.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 52736 —-a-r- c:\jgh\extract.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 145920 —-a-r- c:\jgh\FileKill.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 141312 —-a-r- c:\jgh\ComboFix-Download.cfxxe
2010-12-12 01:43 . 2010-08-23 11:14 101376 —-a-r- c:\jgh\dd.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 51200 —-a-r- c:\jgh\dumphive.cfxxe
2010-12-12 01:43 . 2009-04-17 23:37 147456 —-a-r- c:\jgh\catchme.cfxxe
2010-12-12 01:43 . 2000-08-31 14:00 6760 —-a-w- c:\jgh\appinit.bad
2010-12-12 01:43 . 2010-09-17 06:30 4327 —-a-r- c:\jgh\VInfo
2010-12-12 01:43 . 2010-12-11 20:20 8839 —-a-w- c:\jgh\VInfo2
2010-12-12 01:43 . 2009-06-21 20:45 98948 —-a-w- c:\jgh\w_sock.dll
2010-12-12 01:43 . 2010-08-30 10:45 38901 —-a-w- c:\jgh\ffdefstr.dll
2010-12-12 01:43 . 2010-04-26 21:58 256512 —-a-w- c:\jgh\pev.exe
2010-12-12 01:43 . 2000-08-31 14:00 161792 —-a-w- c:\jgh\swreg.exe
2010-12-12 01:43 . 2005-08-16 07:54 1536 —-a-w- c:\jgh\hidec.exe
2010-12-12 01:43 . 2009-04-20 18:56 31232 —-a-w- c:\jgh\iexplore.exe
2010-12-12 01:43 . 2010-12-09 08:39 2898 —-a-w- c:\jgh\Prep.inf
2010-12-12 01:43 . 2006-03-03 05:42 73728 —-a-w- c:\jgh\pv.com
2010-12-12 01:43 . 2010-12-12 10:46 266403 —-a-w- c:\jgh\clsid.c
2010-12-12 01:43 . 2010-11-24 10:02 3936 —-a-w- c:\jgh\Update-CF.cmd
2010-12-12 01:43 . 2009-11-15 11:35 442 —-a-w- c:\jgh\Rkey.cmd
2010-12-12 01:43 . 2010-10-14 17:17 4630 —-a-w- c:\jgh\SnapShot.cmd
2010-12-12 01:43 . 2010-10-21 21:35 2146 —-a-w- c:\jgh\SRestore.cmd
2010-12-12 01:43 . 2010-11-27 20:50 20489 —-a-w- c:\jgh\SuppScan.cmd
2010-12-12 01:43 . 2010-11-27 18:34 52771 —-a-w- c:\jgh\RegScan.cmd
2010-12-12 01:43 . 2010-11-16 12:39 1179 —-a-w- c:\jgh\katch.cmd
2010-12-12 01:43 . 2010-10-04 00:37 1695 —-a-w- c:\jgh\Kill-All.cmd
2010-12-12 01:43 . 2010-12-09 05:03 36919 —-a-w- c:\jgh\NT-OS.cmd
2010-12-12 01:43 . 2010-10-04 09:52 3342 —-a-w- c:\jgh\CregC.cmd
2010-12-12 01:43 . 2009-12-24 03:49 1686 —-a-w- c:\jgh\CSet.cmd
2010-12-12 01:43 . 2010-12-07 15:41 7905 —-a-w- c:\jgh\FD-SV.cmd
2010-12-12 01:43 . 2010-01-04 02:41 1085 —-a-w- c:\jgh\FKMGen.cmd
2010-12-12 01:43 . 2010-10-23 00:02 5979 —-a-w- c:\jgh\GetHive.cmd
2010-12-12 01:43 . 2010-11-16 12:16 28898 —-a-w- c:\jgh\CF-Script.cmd
2010-12-12 01:43 . 2010-11-27 17:37 17755 —-a-w- c:\jgh\Create.cmd
2010-12-12 01:43 . 2010-04-16 04:11 4144 —-a-w- c:\jgh\Assoc.cmd
2010-12-12 01:43 . 2010-12-12 09:53 3446 —-a-w- c:\jgh\av.cmd
2010-12-12 01:43 . 2009-11-16 07:03 659 —-a-w- c:\jgh\AWF.cmd
2010-12-12 01:43 . 2010-12-09 06:30 4786 —-a-w- c:\jgh\Boot-Rk.cmd
2010-12-12 01:43 . 2010-10-21 22:45 1080 —-a-w- c:\jgh\Catch-sub.cmd
2010-12-12 01:43 . 2010-12-09 17:43 16896 —-a-w- c:\jgh\SetEnvmt.bat
2010-12-12 01:43 . 2010-10-12 19:12 2834 —-a-w- c:\jgh\MoveIt.bat
2010-12-12 01:43 . 2010-10-29 00:21 64146 —-a-w- c:\jgh\ND_.bat
2010-12-12 01:43 . 2010-12-12 02:18 227841 —-a-w- c:\jgh\List-C.bat
2010-12-12 01:43 . 2010-12-11 20:49 16688 —-a-w- c:\jgh\List-B.bat
2010-12-12 01:43 . 2009-10-20 23:25 954 —-a-w- c:\jgh\history.bat
2010-12-12 01:43 . 2010-12-02 00:19 215364 —-a-w- c:\jgh\Lang.bat
2010-12-12 01:43 . 2010-11-16 06:26 31154 —-a-w- c:\jgh\FIND3M.bat
2010-12-12 01:43 . 2010-10-23 22:41 4777 —-a-w- c:\jgh\FIXLSP.bat
2010-12-12 01:43 . 2010-11-16 06:27 7733 —-a-w- c:\jgh\Combobatch.bat
2010-12-12 01:43 . 2010-05-04 09:31 2016 —-a-w- c:\jgh\DelClsid.bat
2010-12-12 01:43 . 2010-12-12 02:18 61662 —-a-w- c:\jgh\c.bat
2010-12-12 01:43 . 2010-11-26 05:54 8418 —-a-w- c:\jgh\Boot.bat
2006-06-10 20:42 . 2006-06-10 20:42 49152 —-a-w- c:\jgh\SF.exe
2006-03-03 05:42 . 2006-03-03 05:42 73728 —-a-r- c:\jgh\PV.cfxxe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\ypager.exe" [2005-08-15 3092480]
"cdloader"="c:\documents and settings\After the flop\Application Data\mjusbsp\cdloader2.exe" [2010-10-08 50592]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-11 59392]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-11 368706]
"Motive SmartBridge"="c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2003-12-10 380928]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-08-09 221184]
"ISUSScheduler"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" [2004-08-09 81920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2010-05-26 730600]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2006-6-2 180224]
KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe.vir [2004-2-13 16423]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [5/26/2010 7:35 AM 26352]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [5/26/2010 7:35 AM 493032]
R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [10/21/2009 3:22 PM 46592]
S3 ATIXPGAA;ATIXPGAA;\??\c:\pcdr5\ATIXPGAA.SYS –> c:\pcdr5\ATIXPGAA.SYS [?]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG8\Toolbar\ToolbarBroker.exe –> c:\program files\AVG\AVG8\Toolbar\ToolbarBroker.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.bing.com/?pc=Z007&form=ZGAPHP
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\After the flop\Application Data\Mozilla\Firefox\Profiles\skjh66zf.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4ce696f1&v=6.010.006.004&i=23&tp=ab&iy=&ychte=us&lng=en-US&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.type - 1
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: ZoneAlarm Security Engine: {FFB96CC1-7EB3-449D-B827-DB661701C6BB} - c:\program files\CheckPoint\ZAForceField\TrustChecker
FF - Ext: Move Media Player: [removed] - c:\documents and settings\After the flop\Application Data\Move Networks
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - %profile%\extensions\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-ares - c:\program files\Ares\Ares.exe
HKCU-Run-Google Update - c:\documents and settings\After the flop\Local Settings\Application Data\Google\Update\GoogleUpdate.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-14 01:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\c:\docume~1\AFTERT~1\LOCALS~1\Temp\ASFWHide"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3c,dc,ed,31,48,3d,18,40,a8,3f,c9,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3c,dc,ed,31,48,3d,18,40,a8,3f,c9,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(556)
c:\windows\system32\Ati2evxx.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'lsass.exe'(612)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

- - - - - - - > 'explorer.exe'(1716)
c:\windows\system32\WININET.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\progra~1\SBCSEL~1\SMARTB~1\SBHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
c:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\eHome\ehmsas.exe
c:\program files\Common Files\Java\Java Update\jucheck.exe
c:\hp\KBD\KBD.EXE
c:\windows\ALCXMNTR.EXE
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
.
**************************************************************************
.
Completion time: 2010-12-14 01:51:59 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-14 07:51
ComboFix2.txt 2010-12-13 18:41
ComboFix3.txt 2010-12-12 04:16

Pre-Run: 149,396,971,520 bytes free
Post-Run: 149,380,665,344 bytes free

- - End Of File - - 90C69C719ACF2DB5BBB84968F7747FE6
Post #19
Hi Pacer,

It is not recommended that you run more than one antivirus software because that can cause conflicts and slow system performance. Choose one of the 3 (Kaspersky, AVG, or Avast), although my personal favorite is Microsoft Security Essnetials.

Besides that, how is your computer running?

I need you to run DDS to see if you have any programs that need updating.

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

Next, Please Submit a file


Please open this link HERE in a new window.

In the box marked Link to topic where this file was requested: please paste in the following text
http://forums.whatthetech.com/index.php?showtopic=115885

Click the Browse button and navigate to C:\Qoobox\Quarantine

There should be a zip file there called [4]-Submit_****-**-**_**.**.**.zip ( the * denotes Date and Time stamp. Your date and time will be close to this: 12/14/2010 1:31.5.2 )
Select this file and click Open
In the Largest box please put
File Requested By NoodleTech
Failed Collect::

Finally click SendFile

Please return here and let me know when that file has been uploaded.
Post #20
Submission at 10:58 pm 12/15/10. DDS (Ver_10-12-12.02) - NTFSx86 Run by [removed] at 22:43:30.84 on Wed 12/15/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.434 [GMT -6:00] AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: ZoneAlarm Firewall *Enabled* ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Alwil Software\Avast5\avastUI.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE C:\WINDOWS\system32\svchost.exe -k imgsvc C:\HP\KBD\KBD.EXE C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe c:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Common Files\Java\Java Update\jucheck.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Documents and Settings\After the flop\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\After the flop\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\After the flop\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.bing.com/?pc=Z007&form=ZGAPHP uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\ypager.exe" -quiet uRun: [cdloader] "c:\documents and settings\after the flop\application data\mjusbsp\cdloader2.exe" MAGICJACK uRun: [MKerbla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3] c:\windows\taskmgr.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [HPHUPD08] c:\program files\hp\digital imaging\{33d6cc28-9f75-4d1b-a11d-98895b3a3729}\hphupd08.exe mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run mRun: [PS2] c:\windows\system32\ps2.exe mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [BJCFD] c:\program files\broadjump\client foundation\CFD.exe mRun: [Motive SmartBridge] c:\progra~1\sbcsel~1\smartb~1\MotiveSB.exe mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup mRun: [ISUSScheduler] "c:\progra~1\common~1\instal~1\update~1\issch.exe" -start mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe" mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden" mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodaks~1.lnk - c:\program files\kodak\kodak software updater\7288971\program\Kodak Software Updater.exe.vir StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\launch~1.lnk - c:\program files\whitesmoke translator\WSTrayDictMode.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\sbcsel~1.lnk - c:\program files\sbc self support tool\bin\matcli.exe IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\progra~1\yahoo!\messen~1\YPager.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper20073151.dll DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {6E704581-CCAE-46D2-9C64-20D724B3624E} - hxxp://radaol-prod-web-rr.streamops.aol.com/mediaplugin/3.0.84.2/win32/unagi3.0.84.2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - Notify: AtiExtEvent - Ati2evxx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\aftert~1\applic~1\mozilla\firefox\profiles\skjh66zf.default\ FF - prefs.js: browser.search.selectedEngine - Bing FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4ce696f1&v=6.010.006.004&i=23&tp=ab&iy=&ychte=us&lng=en-US&q= FF - prefs.js: network.proxy.http - 127.0.0.1 FF - prefs.js: network.proxy.type - 1 FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff FF - Ext: ZoneAlarm Security Engine: {FFB96CC1-7EB3-449D-B827-DB661701C6BB} - c:\program files\checkpoint\zaforcefield\TrustChecker FF - Ext: Move Media Player: [removed] - c:\documents and settings\after the flop\application data\Move Networks FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} FF - Ext: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - %profile%\extensions\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd} ============= SERVICES / DRIVERS =============== R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-12-15 165584] R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2010-6-29 532224] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-12-15 17744] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-12-15 40384] R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2010-5-26 26352] R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2010-5-26 493032] R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service –> c:\windows\system32\zonelabs\vsmon.exe -service [?] R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [2009-10-21 46592] S3 ATIXPGAA;ATIXPGAA;\??\c:\pcdr5\atixpgaa.sys –> c:\pcdr5\ATIXPGAA.SYS [?] S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-12-15 40384] S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-12-15 40384] S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg8\toolbar\toolbarbroker.exe –> c:\program files\avg\avg8\toolbar\ToolbarBroker.exe [?] =============== Created Last 30 ================ 2010-12-15 11:38:59 38848 —-a-w- c:\windows\avastSS.scr 2010-12-15 11:38:49 ——– d—–w- c:\docume~1\alluse~1\applic~1\Alwil Software 2010-12-15 07:33:34 40960 ——w- c:\windows\system32\dllcache\ndproxy.sys 2010-12-15 07:32:15 45568 ——w- c:\windows\system32\dllcache\wab.exe 2010-12-12 04:40:08 ——– d—–w- c:\docume~1\aftert~1\locals~1\applic~1\Temp 2010-12-12 03:43:19 974848 ——w- c:\windows\system32\dllcache\mfc42.dll 2010-12-12 03:43:19 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll 2010-12-12 03:42:18 617472 ——w- c:\windows\system32\dllcache\comctl32.dll 2010-12-12 03:39:45 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe 2010-12-12 03:38:40 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll 2010-12-12 03:34:02 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe 2010-12-12 03:09:59 ——– d-sha-r- C:\cmdcons 2010-12-12 01:44:18 ——– d—–w- C:\jgh 2010-12-10 06:28:12 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-10 06:28:07 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-11-19 20:08:48 ——– d—–w- c:\docume~1\aftert~1\locals~1\applic~1\AVG Security Toolbar 2010-11-18 18:12:44 81920 ——w- c:\windows\system32\dllcache\isign32.dll ==================== Find3M ==================== 2010-11-18 18:12:44 81920 —-a-w- c:\windows\system32\isign32.dll 2010-11-08 07:20:24 89088 —-a-w- c:\windows\MBR.exe 2010-11-06 00:26:58 916480 —-a-w- c:\windows\system32\wininet.dll 2010-11-06 00:26:58 43520 —-a-w- c:\windows\system32\licmgr10.dll 2010-11-06 00:26:58 1469440 ——w- c:\windows\system32\inetcpl.cpl 2010-11-03 12:25:54 385024 —-a-w- c:\windows\system32\html.iec 2010-10-28 13:13:22 290048 —-a-w- c:\windows\system32\atmfd.dll 2010-10-26 13:25:00 1853312 —-a-w- c:\windows\system32\win32k.sys 2010-09-18 18:23:26 974848 —-a-w- c:\windows\system32\mfc42u.dll 2010-09-18 06:53:25 974848 ——w- c:\windows\system32\mfc42.dll 2010-09-18 06:53:25 954368 —-a-w- c:\windows\system32\mfc40.dll 2010-09-18 06:53:25 953856 —-a-w- c:\windows\system32\mfc40u.dll ============= FINISH: 22:44:50.98 ===============

Attachments:

Post #21
Hi Pacer,

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 23.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the pull down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version.
Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]
  • Under Temporary Internet Files, click the Settings… button
  • click the Delete Files button.
  • There are three options in the window to clear the cache - Leave all 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Settings
  • Click OK to leave the Java Control Panel.

===================================================

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
  • Go to Start > Control Panel > Add/Remove Programs
  • Remove ALL instances of Adobe Reader
  • Re-boot your computer as required.
  • Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader
Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.

===================================================

The following will implement some cleanup procedures as well as reset System Restore points:
[external image: Posted Image]

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall

===================================================

NEXT:

We need to install antivirus software on your computer to protect you from future infection.

Please click here to download Microsoft Security Essentials.

Double click the setup file and follow through the installation prompts to install it.

===================================================

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.

    • Change the Download signed ActiveX controls to Prompt.
    • Change the Download unsigned ActiveX controls to Disable.
    • Change the Initialise and script ActiveX controls not marked as safe to Disable.
    • Change the Installation of desktop items to Prompt.
    • Change the Launching programs and files in an IFRAME to Prompt.
    • Change the Navigate sub-frames across different domains to Prompt.
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

6. Install Spybot - Search and Destroy - Download and install Spybot - Search and Destroy with its TeaTimer option. This will provide real time spyware and hijacker protection on your computer alongside your virus protection. You should scan your computer with the program on a regular basis just as you would with your anti-virus software. A tutorial on installing and using this product can be found here:
Instructions for - Spybot S & D and Ad-aware

7. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?
Post #22
Is there a alternate route to the Java console, because the Start menu. control panel path does not exist for me. I have already removed the old Java and downloaded a fresh one.
Post #24
Java cache is cleared and made some much needed security related updates. PC is once again running smoothly. Thanks for all the help. You guys continue to impress.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI