What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Antivirus Scan Inc

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello -

My system is poxed by Antivirus Scan Inc. Security warnings permanently on screen. I have tried AVG, Malwarebytes and Super Antispyware - no joy. Could not run Email or any work processor applications until I managed to run rkill - log is as follows:

Rkill was run on 16/01/2011 at 20:45:49.
Operating System: Microsoft Windows XP


Processes terminated by Rkill or while it was running:

C:\WINDOWS.0\Explorer.EXE
C:\DOCUME~1\Perrin\LOCALS~1\Temp\anwfwpoth\vgjvupluerb.exe


Rkill completed on 16/01/2011 at 20:45:55.



I was then able to save a HJ log as follows:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:46:34, on 16/01/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS.0\system32\ASTSRV.EXE
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS.0\system32\HPZipm12.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS.0\SOUNDMAN.EXE
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS.0\system32\Tablet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS.0\system32\WTablet\TabUserW.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\explorer.exe
C:\WINDOWS.0\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8893
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [bqpcnbym] C:\DOCUME~1\Perrin\LOCALS~1\Temp\anwfwpoth\vgjvupluerb.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS.0\system32\WTablet\TabUserW.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS.0\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS.0\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Nalpeiron Licensing Service (ASTSRV) - Nalpeiron Ltd. - C:\WINDOWS.0\system32\ASTSRV.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS.0\system32\Ati2evxx.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS.0\system32\HPZipm12.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS.0\system32\Tablet.exe

–
End of file - 5808 bytes


I'd be very grateful if anyone could help, thanks in advance -

Tony
Post #2
Hello tonyperrin and welcome to WhatTheTech. Please follow these guidelines while we work on your PC:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Any underlined text in my posts indicates a clickable link.
  • If you have any questions at all, please stop and ask before proceeding.
Use RKill again if you have to and run these for me:

🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.com
DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:
  • Make sure that your security software is disabled
  • Uncheck the box next to "Files" this time also
  • If you still can't run it, try in the Safe Mode
Please include the following in your next post:
  • DDS.txt and Attach.txt logs
  • GMER log
Post #3
Thank you for your reply RPMcMurphy. Since my first post, I am no getting Antivirus Scan popups at present, though I am unable to connect at all via Internet Explorer (using Firefox at present). Both scanners ran without problem, contents of DDS.txt are as follows:

DDS (Ver_10-12-12.02) - NTFSx86
Run by [removed] at 20:22:35.50 on 18/01/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.350 [GMT 0:00]

AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS.0\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
svchost.exe
C:\WINDOWS.0\system32\ASTSRV.EXE
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS.0\SOUNDMAN.EXE
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS.0\system32\WTablet\TabUserW.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS.0\system32\svchost.exe -k imgsvc
C:\WINDOWS.0\system32\Tablet.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS.0\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\Documents and Settings\Perrin\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:8893
uInternet Settings,ProxyOverride =
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
uRun: [ctfmon.exe] c:\windows.0\system32\ctfmon.exe
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
StartupFolder: c:\docume~1\perrin\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tabuse~1.lnk - c:\windows.0\system32\wtablet\TabUserW.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\viarai~1.lnk - c:\program files\via\raid\raid_tool.exe
Trusted Zone: amazon.co.uk\www
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows.0\system32\wpdshserviceobj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\perrin\applic~1\mozilla\firefox\profiles\pjo20krg.default\
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\photodex presenter\npPxPlay.dll
FF - plugin: c:\program files\tabletplugins\npwacom.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Get Mail Plus: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg9\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows.0\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

—- FIREFOX POLICIES —-
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false

============= SERVICES / DRIVERS ===============

R0 viasraid;viasraid;c:\windows.0\system32\drivers\viasraid.sys [2010-6-6 77312]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows.0\system32\drivers\avgldx86.sys [2003-1-1 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows.0\system32\drivers\avgmfx86.sys [2003-1-1 29584]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows.0\system32\drivers\avgtdix.sys [2003-1-1 243024]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 ASTSRV;Nalpeiron Licensing Service;c:\windows.0\system32\ASTSRV.EXE [2010-4-5 57344]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-17 308136]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows.0\system32\drivers\thdudf.sys [2010-1-29 66944]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-12-25 136176]
S3 cpuz132;cpuz132;\??\c:\docume~1\perrin\locals~1\temp\cpuz132\cpuz132_x32.sys –> c:\docume~1\perrin\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 scsiscan;SCSI Scanner Driver;c:\windows.0\system32\drivers\scsiscan.sys [2010-1-24 11520]

=============== Created Last 30 ================

2011-01-16 16:51:19 ——– d—–w- c:\docume~1\perrin\applic~1\SUPERAntiSpyware.com
2011-01-16 16:51:19 ——– d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2011-01-16 16:50:38 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-12-25 13:44:30 ——– d—–r- c:\program files\Skype
2010-12-25 13:27:05 5504 -c–a-w- c:\windows.0\system32\dllcache\mstee.sys
2010-12-25 13:27:05 5504 —-a-w- c:\windows.0\system32\drivers\MSTEE.sys
2010-12-25 13:27:01 10880 -c–a-w- c:\windows.0\system32\dllcache\ndisip.sys
2010-12-25 13:27:01 10880 —-a-w- c:\windows.0\system32\drivers\NdisIP.sys
2010-12-25 13:24:50 490008 —-a-w- c:\windows.0\system32\LVUI2.dll
2010-12-25 13:24:50 465432 —-a-w- c:\windows.0\system32\LVUI2RC.dll
2010-12-25 13:24:50 416280 —-a-w- c:\windows.0\system32\lvcodec2.dll
2010-12-25 13:24:50 195096 —-a-w- c:\windows.0\system32\lvci1150.dll
2010-12-25 13:24:50 1279000 —-a-w- c:\windows.0\system32\drivers\LV302V32.SYS
2010-12-25 13:24:49 41752 —-a-w- c:\windows.0\system32\drivers\LVUSBSta.sys
2010-12-25 13:24:49 21138 —-a-w- c:\windows.0\system32\Repository.reg
2010-12-25 13:24:47 13848 —-a-w- c:\windows.0\system32\drivers\lv302af.sys
2010-12-25 12:29:07 60032 -c–a-w- c:\windows.0\system32\dllcache\usbaudio.sys
2010-12-25 12:29:07 60032 —-a-w- c:\windows.0\system32\drivers\USBAUDIO.sys

==================== Find3M ====================

2009-05-14 20:02:10 3392872 —-a-w- c:\program files\common files\adlmint_libFNP.dll
2009-05-14 20:02:10 3298152 —-a-w- c:\program files\common files\adlmint.dll

============= FINISH: 20:23:06.76 ===============


I've uploaded the attach file as instructed, her are contents of gmer.txt :

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-19 00:37:27
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-c ExcelStor_Technology_J8160 rev.P22OA8BA
Running: chbsq31z.exe; Driver: C:\DOCUME~1\Perrin\LOCALS~1\Temp\kgliquow.sys


—- Kernel code sections - GMER 1.0.15 —-

.text C:\WINDOWS.0\system32\DRIVERS\ati2mtag.sys section is writeable [0xF68A6000, 0x239517, 0xE8000020]
init C:\WINDOWS.0\system32\drivers\ALCXSENS.SYS entry point in "init" section [0xF675F510]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs sisidex.sys (FileSpy Filter Driver/Windows ® 2000 DDK provider)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat sisidex.sys (FileSpy Filter Driver/Windows ® 2000 DDK provider)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{71D940F9-0E35-E0F0-1675-249C6C404004}

—- EOF - GMER 1.0.15 —-


Thanks for your help, best regards - Tony

Attachments:

Post #4
tonyperrin:

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - ComboFix will not run until AVG is uninstalled. This is because AVG falsely detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first. You may do this through Control Panel > Add/Remove Programs or you can use this tool for a more complete removal:

Download AppRemover from here saving it to your desktop.
  • Double click to run AppRemover
  • Follow the prompts to remove AVG
  • Reboot
Once you've removed AVG with this tool please continue with these instructions
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • ComboFix log
Post #5
Hello RPMcMurphy - thanks for your help, here is my ComboFix log:

ComboFix 11-01-18.04 - tony1 19/01/2011 22:18:26.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.624 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
ADS - system32: deleted 40 bytes in 1 streams.

((((((((((((((((((((((((( Files Created from 2010-12-19 to 2011-01-19 )))))))))))))))))))))))))))))))
.

2011-01-16 16:51 . 2011-01-16 16:51 ——– d—–w- c:\documents and settings\Perrin\Application Data\SUPERAntiSpyware.com
2011-01-16 16:51 . 2011-01-16 16:51 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-01-16 16:50 . 2011-01-16 16:51 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-12-25 13:52 . 2010-12-26 10:16 ——– d—–w- c:\documents and settings\Perrin\Application Data\skypePM
2010-12-25 13:44 . 2010-12-25 13:44 ——– d—–w- c:\program files\Common Files\Skype
2010-12-25 13:44 . 2011-01-16 02:19 ——– d—–r- c:\program files\Skype
2010-12-25 13:44 . 2010-12-26 16:27 ——– d—–w- c:\documents and settings\Perrin\Application Data\Skype
2010-12-25 13:44 . 2010-12-25 13:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2010-12-25 13:27 . 2008-04-14 00:09 5504 -c–a-w- c:\windows.0\system32\dllcache\mstee.sys
2010-12-25 13:27 . 2008-04-14 00:09 5504 —-a-w- c:\windows.0\system32\drivers\MSTEE.sys
2010-12-25 13:27 . 2008-04-14 00:16 10880 -c–a-w- c:\windows.0\system32\dllcache\ndisip.sys
2010-12-25 13:27 . 2008-04-14 00:16 10880 —-a-w- c:\windows.0\system32\drivers\NdisIP.sys
2010-12-25 13:24 . 2007-10-12 02:00 465432 —-a-w- c:\windows.0\system32\LVUI2RC.dll
2010-12-25 13:24 . 2007-10-12 02:00 490008 —-a-w- c:\windows.0\system32\LVUI2.dll
2010-12-25 13:24 . 2007-10-12 01:57 195096 —-a-w- c:\windows.0\system32\lvci1150.dll
2010-12-25 13:24 . 2007-10-12 01:57 416280 —-a-w- c:\windows.0\system32\lvcodec2.dll
2010-12-25 13:24 . 2007-10-12 01:55 1279000 —-a-w- c:\windows.0\system32\drivers\LV302V32.SYS
2010-12-25 13:24 . 2007-10-12 02:00 41752 —-a-w- c:\windows.0\system32\drivers\LVUSBSta.sys
2010-12-25 13:24 . 2007-10-12 01:18 21138 —-a-w- c:\windows.0\system32\Repository.reg
2010-12-25 13:24 . 2007-10-12 01:55 13848 —-a-w- c:\windows.0\system32\drivers\lv302af.sys
2010-12-25 13:23 . 2010-12-25 13:30 ——– d—–w- c:\documents and settings\All Users\Application Data\Logishrd
2010-12-25 13:23 . 2010-12-25 13:26 ——– d—–w- c:\program files\Common Files\LogiShrd
2010-12-25 13:23 . 2010-12-25 13:23 ——– d—–w- c:\program files\Logitech
2010-12-25 13:23 . 2010-12-25 13:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Logitech
2010-12-25 12:29 . 2008-04-14 00:15 60032 -c–a-w- c:\windows.0\system32\dllcache\usbaudio.sys
2010-12-25 12:29 . 2008-04-14 00:15 60032 —-a-w- c:\windows.0\system32\drivers\USBAUDIO.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 18:09 . 2009-08-11 10:13 38224 —-a-w- c:\windows.0\system32\drivers\mbamswissarmy.sys
2010-12-20 18:08 . 2009-08-11 10:13 20952 —-a-w- c:\windows.0\system32\drivers\mbam.sys
2010-10-30 12:27 . 2010-10-30 12:27 388096 —-a-r- c:\documents and settings\Perrin\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2009-05-14 20:02 . 2009-05-14 20:02 3392872 —-a-w- c:\program files\Common Files\adlmint_libFNP.dll
2009-05-14 20:02 . 2009-05-14 20:02 3298152 —-a-w- c:\program files\Common Files\adlmint.dll
.

——- Sigcheck ——-

[-] 2009-11-23 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows.0\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-30 149280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-04 102400]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 577536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]

c:\documents and settings\Perrin\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
TabUserW.exe.lnk - c:\windows.0\system32\WTablet\TabUserW.exe [2010-7-28 77824]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2010-6-6 565248]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-10-25 16:33 563984 —-a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2007-10-25 16:37 2178832 —-a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 16:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS4\\Dreamweaver.exe"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"c:\\Program Files\\Autodesk\\Maya2010\\bin\\maya.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R0 viasraid;viasraid;c:\windows.0\system32\drivers\viasraid.sys [06/06/2010 16:07 77312]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 18:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 18:41 67656]
R2 ASTSRV;Nalpeiron Licensing Service;c:\windows.0\system32\ASTSRV.EXE [05/04/2010 15:41 57344]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows.0\system32\drivers\thdudf.sys [29/01/2010 16:05 66944]
R3 scsiscan;SCSI Scanner Driver;c:\windows.0\system32\drivers\scsiscan.sys [24/01/2010 11:29 11520]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [25/12/2010 13:45 136176]
.
Contents of the 'Scheduled Tasks' folder

2011-01-19 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 13:45]

2011-01-19 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 13:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:8893
uInternet Settings,ProxyOverride =
Trusted Zone: amazon.co.uk\www
FF - ProfilePath - c:\documents and settings\Perrin\Application Data\Mozilla\Firefox\Profiles\pjo20krg.default\
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Get Mail Plus: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-19 22:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1960408961-413027322-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{71D940F9-0E35-E0F0-1675-249C6C404004}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1048)
c:\windows.0\system32\Ati2evxx.dll
c:\windows.0\system32\atiadlxx.dll

- - - - - - - > 'explorer.exe'(1212)
c:\windows.0\system32\WININET.dll
c:\windows.0\system32\tabhook.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows.0\system32\ieframe.dll
c:\windows.0\system32\webcheck.dll
c:\windows.0\system32\wpdshserviceobj.dll
c:\windows.0\system32\portabledevicetypes.dll
c:\windows.0\system32\portabledeviceapi.dll
.
Completion time: 2011-01-19 22:25:18
ComboFix-quarantined-files.txt 2011-01-19 22:25
ComboFix2.txt 2010-10-31 18:45

Pre-Run: 123,818,598,400 bytes free
Post-Run: 123,846,660,096 bytes free

- - End Of File - - 0C397C23B1683D6B28113FB2F2CD6EEA
Post #6
tonyperrin:

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above DDS::

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:8893
uInternet Settings,ProxyOverride =

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
sfcfiles.*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Please include the following in your next post:
  • ComboFix log
  • SystemLook log
Post #7
Hello RPMcMurphy - thanks for your last post here is my ComboFix log:

ComboFix 11-01-19.04 - tony1 20/01/2011 21:48:48.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.680 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Perrin\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2010-12-20 to 2011-01-20 )))))))))))))))))))))))))))))))
.

2011-01-20 00:57 . 2011-01-20 00:57 ——– d—–w- c:\documents and settings\Perrin\Application Data\AVG10
2011-01-19 23:35 . 2011-01-19 23:35 ——– d–h–w- c:\documents and settings\All Users\Application Data\Common Files
2011-01-19 23:34 . 2011-01-20 21:44 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG10
2011-01-19 23:00 . 2011-01-19 23:34 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-01-16 16:51 . 2011-01-16 16:51 ——– d—–w- c:\documents and settings\Perrin\Application Data\SUPERAntiSpyware.com
2011-01-16 16:51 . 2011-01-16 16:51 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-01-16 16:50 . 2011-01-16 16:51 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-12-25 13:52 . 2010-12-26 10:16 ——– d—–w- c:\documents and settings\Perrin\Application Data\skypePM
2010-12-25 13:44 . 2010-12-25 13:44 ——– d—–w- c:\program files\Common Files\Skype
2010-12-25 13:44 . 2011-01-16 02:19 ——– d—–r- c:\program files\Skype
2010-12-25 13:44 . 2010-12-26 16:27 ——– d—–w- c:\documents and settings\Perrin\Application Data\Skype
2010-12-25 13:44 . 2010-12-25 13:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2010-12-25 13:27 . 2008-04-14 00:09 5504 -c–a-w- c:\windows.0\system32\dllcache\mstee.sys
2010-12-25 13:27 . 2008-04-14 00:09 5504 —-a-w- c:\windows.0\system32\drivers\MSTEE.sys
2010-12-25 13:27 . 2008-04-14 00:16 10880 -c–a-w- c:\windows.0\system32\dllcache\ndisip.sys
2010-12-25 13:27 . 2008-04-14 00:16 10880 —-a-w- c:\windows.0\system32\drivers\NdisIP.sys
2010-12-25 13:24 . 2007-10-12 02:00 465432 —-a-w- c:\windows.0\system32\LVUI2RC.dll
2010-12-25 13:24 . 2007-10-12 02:00 490008 —-a-w- c:\windows.0\system32\LVUI2.dll
2010-12-25 13:24 . 2007-10-12 01:57 195096 —-a-w- c:\windows.0\system32\lvci1150.dll
2010-12-25 13:24 . 2007-10-12 01:57 416280 —-a-w- c:\windows.0\system32\lvcodec2.dll
2010-12-25 13:24 . 2007-10-12 01:55 1279000 —-a-w- c:\windows.0\system32\drivers\LV302V32.SYS
2010-12-25 13:24 . 2007-10-12 02:00 41752 —-a-w- c:\windows.0\system32\drivers\LVUSBSta.sys
2010-12-25 13:24 . 2007-10-12 01:18 21138 —-a-w- c:\windows.0\system32\Repository.reg
2010-12-25 13:24 . 2007-10-12 01:55 13848 —-a-w- c:\windows.0\system32\drivers\lv302af.sys
2010-12-25 13:23 . 2010-12-25 13:30 ——– d—–w- c:\documents and settings\All Users\Application Data\Logishrd
2010-12-25 13:23 . 2010-12-25 13:26 ——– d—–w- c:\program files\Common Files\LogiShrd
2010-12-25 13:23 . 2010-12-25 13:23 ——– d—–w- c:\program files\Logitech
2010-12-25 13:23 . 2010-12-25 13:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Logitech
2010-12-25 12:29 . 2008-04-14 00:15 60032 -c–a-w- c:\windows.0\system32\dllcache\usbaudio.sys
2010-12-25 12:29 . 2008-04-14 00:15 60032 —-a-w- c:\windows.0\system32\drivers\USBAUDIO.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 18:09 . 2009-08-11 10:13 38224 —-a-w- c:\windows.0\system32\drivers\mbamswissarmy.sys
2010-12-20 18:08 . 2009-08-11 10:13 20952 —-a-w- c:\windows.0\system32\drivers\mbam.sys
2010-10-30 12:27 . 2010-10-30 12:27 388096 —-a-r- c:\documents and settings\Perrin\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2009-05-14 20:02 . 2009-05-14 20:02 3392872 —-a-w- c:\program files\Common Files\adlmint_libFNP.dll
2009-05-14 20:02 . 2009-05-14 20:02 3298152 —-a-w- c:\program files\Common Files\adlmint.dll
.

——- Sigcheck ——-

[-] 2009-11-23 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows.0\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-01-19_22.23.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-01-20 21:44 . 2011-01-20 21:44 16384 c:\windows.0\Temp\Perflib_Perfdata_1d4.dat
+ 2010-07-28 10:29 . 2011-01-20 21:44 26238 c:\windows.0\system32\tablet.dat
- 2010-07-28 10:29 . 2011-01-19 22:14 26238 c:\windows.0\system32\tablet.dat
+ 2011-01-19 23:35 . 2011-01-19 23:35 3141632 c:\windows.0\Installer\4983ba.msi
+ 2011-01-19 23:33 . 2011-01-19 23:33 1568768 c:\windows.0\Installer\4983b6.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-30 149280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-04 102400]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 577536]

c:\documents and settings\Perrin\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
TabUserW.exe.lnk - c:\windows.0\system32\WTablet\TabUserW.exe [2010-7-28 77824]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2010-6-6 565248]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-10-25 16:33 563984 —-a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2007-10-25 16:37 2178832 —-a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 16:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS4\\Dreamweaver.exe"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"c:\\Program Files\\Autodesk\\Maya2010\\bin\\maya.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R0 viasraid;viasraid;c:\windows.0\system32\drivers\viasraid.sys [06/06/2010 16:07 77312]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 18:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 18:41 67656]
R2 ASTSRV;Nalpeiron Licensing Service;c:\windows.0\system32\ASTSRV.EXE [05/04/2010 15:41 57344]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows.0\system32\drivers\thdudf.sys [29/01/2010 16:05 66944]
R3 scsiscan;SCSI Scanner Driver;c:\windows.0\system32\drivers\scsiscan.sys [24/01/2010 11:29 11520]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [25/12/2010 13:45 136176]
.
Contents of the 'Scheduled Tasks' folder

2011-01-20 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 13:45]

2011-01-20 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 13:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: amazon.co.uk\www
FF - ProfilePath - c:\documents and settings\Perrin\Application Data\Mozilla\Firefox\Profiles\pjo20krg.default\
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Get Mail Plus: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-20 21:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1960408961-413027322-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{71D940F9-0E35-E0F0-1675-249C6C404004}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1052)
c:\windows.0\system32\Ati2evxx.dll
c:\windows.0\system32\atiadlxx.dll
c:\windows.0\system32\msacm32.drv

- - - - - - - > 'explorer.exe'(3292)
c:\windows.0\system32\WININET.dll
c:\windows.0\system32\tabhook.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows.0\system32\ieframe.dll
c:\windows.0\system32\webcheck.dll
c:\windows.0\system32\wpdshserviceobj.dll
c:\windows.0\system32\portabledevicetypes.dll
c:\windows.0\system32\portabledeviceapi.dll
.
Completion time: 2011-01-20 21:55:24
ComboFix-quarantined-files.txt 2011-01-20 21:55
ComboFix2.txt 2011-01-19 22:25
ComboFix3.txt 2010-10-31 18:45

Pre-Run: 122,458,185,728 bytes free
Post-Run: 122,446,581,760 bytes free

- - End Of File - - 45B1092B9660586817FBC78ADE1C6703

- And SystemLook log:

SystemLook 04.09.10 by jpshortstuff
Log created at 22:02 on 20/01/2011 by tony1
Administrator - Elevation successful

========== filefind ==========

Searching for "sfcfiles.*"
C:\WINDOWS\system32\sfcfiles.dll –a—- 1614848 bytes [02:44 12/01/2009] [02:44 12/01/2009] 362BC5AF8EAF712832C58CC13AE05750
C:\WINDOWS.0\system32\sfcfiles.dll –a—- 1614848 bytes [20:36 23/01/2010] [13:09 23/11/2009] 362BC5AF8EAF712832C58CC13AE05750

-= EOF =-
Post #8
Hi, It appears that you did a parallel installation of Windows at one time or another on this PC. Can you explain the circumstances of that to me, please? I ask because we can clean one of the installations up if you wish.
Post #9
Hi RPMcMurphy - I had a dose of Virut over twelve months ago. One of the advisers here on the forum tried very hard to help me cure it, but we couldn't root it out and ultimately he advised me to format. I took it to someone else to re-format and it came back with this parallel installation (don't know why), which I've been using since. Things have run pretty well except for this current problem. I do now have Internet explorer back working, don't know how or why.
Post #10
tonyperrin: I'm afraid that may be bad news. I looked over your old threads and you indeed had a virut infection last August. As you were instructed then, the only remedy for that infection is to reformat the drive and reinstall windows. It would seem that whomever you had do that for you did not format the drive, but instead did a parallel installation of Windows. As a result it is entirely possible that you still have remnants of the virut infection in your PC which would explain why you are having recurring issues. My recommendation to you, based on what I would do if this were my computer, is to completely reformat the drive and reinstall Windows. If you wish to continue trying to clean the computer there are a few things we can try, but understand that I can give you no assurances that we can remove all the problems. I'm sorry I don't have better news. Please let me know how you want to proceed.
Post #11
Thanks RPMcMurphy - To be honest, things have been running pretty well until this current problem, If at all possible I'd like to avoid formatting. If there's anything else to try, I'd be very glad to follow your instructions - obviously I won't be complaining if it fails to work! Thanks again, Tonyp
Post #12
tonyperrin:

OK, as long as you understand that you may very well have a virut infection onboard and this is against my better judgement. Please do this for me:

🖼Click to load external image (Posted Image) Go to My Computer-> Tools-> Folder Options-> View tab:
  • Under the Hidden files and folders heading:
  • Select - Show hidden files and folders.
  • Uncheck- Hide protected operating system files (recommended) option.
  • Also, make sure there is no checkmark beside Hide file extensions for known file types.
  • Click OK. (Remember to Hide files and folders once done)
Please go to one of the below sites to scan the following files:
virscan.org
Virus Total

Click on Browse, and upload the following file for analysis:
C:\WINDOWS\system32\sfcfiles.dll

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

🖼Click to load external image (Posted Image) Please run ESET Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Please include the following in your next post:
  • File analysis results
  • ESET log
Post #13
Hi RPMcMurphy -

Thanks for sticking with me, I appreciate it, no matter how it pans out. Here are my file analysis results:

VirSCAN.org Scanned Report :
Scanned time : 2011/01/24 21:27:37 (GMT)
Scanner results: Scanners did not find malware!
File Name : sfcfiles.dll
File Size : 1614848 byte
File Type : PE32 executable for MS Windows (DLL) (console) Intel 80386 3
MD5 : 362bc5af8eaf712832c58cc13ae05750
SHA1 : c8c2d44f34115f27f10bc435dd986d4eff00fe3f
Online report : http://virscan.org/report/580fef9f94f8017e…40a2d134d5.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.1.0.2 20110121020209 2011-01-21 5.28 -
AhnLab V3 2011.01.11.00 2011.01.11 2011-01-11 1.87 -
AntiVir 8.2.4.150 7.11.1.237 2011-01-24 0.28 -
Antiy 2.0.18 20101228.6954489 2010-12-28 0.12 -
Arcavir 2010 201101212251 2011-01-21 75.66 -
Authentium 5.1.1 201101241028 2011-01-24 1.52 -
AVAST! 4.7.4 110124-0 2011-01-24 0.08 -
AVG 8.5.850 271.1.1/3400 2011-01-24 0.28 -
BitDefender 7.90123.6675866 7.35893 2011-01-25 6.23 -
ClamAV 0.96.5 12564 2011-01-25 0.28 -
Comodo 4.0 7486 2011-01-24 1.07 -
CP Secure 1.3.0.5 1970.01.01 1970-01-01 0.44 -
Dr.Web 5.0.2.3300 2011.01.25 2011-01-25 10.41 -
F-Prot 4.4.4.56 20110124 2011-01-24 1.57 -
F-Secure 7.02.73807 2011.01.24.09 2011-01-24 12.17 -
Fortinet 4.2.254 12.831 2011-01-24 0.20 -
GData 21.1635/21.640 20110124 2011-01-24 8.82 -
ViRobot 20110124 2011.01.24 2011-01-24 0.40 -
Ikarus T3.1.32.15.0 2011.01.24.77589 2011-01-24 5.04 -
JiangMin 13.0.900 2011.01.24 2011-01-24 1.67 -
Kaspersky 5.5.10 2011.01.24 2011-01-24 0.13 -
KingSoft 2009.2.5.15 2011.1.24.18 2011-01-24 0.76 -
McAfee 5400.1158 6236 2011-01-24 20.55 -
Microsoft 1.6502 2011.01.24 2011-01-24 3.66 -
Norman 6.06.12 6.06.00 2011-01-18 16.02 -
Panda 9.05.01 2011.01.24 2011-01-24 2.47 -
Trend Micro 9.200-1012 7.790.14 2011-01-24 0.08 -
Quick Heal 11.00 2011.01.23 2011-01-23 2.48 -
Rising 20.0 23.42.00.06 2011-01-24 1.16 -
Sophos 3.15.0 4.61 2011-01-25 3.29 -
Sunbelt 3.9.2474.2 8182 2011-01-24 0.73 -
Symantec 1.3.0.24 20110124.003 2011-01-24 0.08 -
nProtect 20110124.01 9646888 2011-01-24 13.35 -
The Hacker 6.7.0.1 v00119 2011-01-23 0.50 -
VBA32 3.12.14.3 20110123.1443 2011-01-23 3.71 -
VirusBuster 5.2.0.28 13.6.152.1/42900732011-01-19 0.00 -


And Eset log:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=b2ba1035b024da4ba2b81ad7c20f67f6
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-01-25 12:09:17
# local_time=2011-01-25 12:09:17 (+0000, GMT Standard Time)
# country="United Kingdom"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 31663278 31663278 0 0
# compatibility_mode=1032 16777173 100 94 24851 39200887 0 0
# compatibility_mode=8192 67108863 100 0 9178 9178 0 0
# scanned=90057
# found=2
# cleaned=0
# scan_time=3662
C:\Program Files\IWONGEI\Installr\3.bin\9uEIPlug.dll a variant of Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\Trend Micro\HijackThis\backups\backup-20101026-002037-387-Reboot.exe Win32/RiskWare.ExitWin.B application (unable to clean) 00000000000000000000000000000000 I


Thanks again, Tonyp
Post #14
tonyperrin:

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\Program Files\IWONGEI\Installr\3.bin\9uEIPlug.dll 
FCopy::
C:\WINDOWS\system32\sfcfiles.dll | C:\WINDOWS.0\system32\sfcfiles.dll

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:
  • ComboFix log
Post #15
Hi RPMcMurphy - here's my ComboFix log:

ComboFix 11-01-24.02 - tony1 25/01/2011 22:28:04.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.632 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Perrin\Desktop\CFScript.txt

FILE ::
"c:\program files\IWONGEI\Installr\3.bin\9uEIPlug.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\IWONGEI\Installr\3.bin\9uEIPlug.dll

.
————— FCopy —————

c:\windows\system32\sfcfiles.dll –> c:\windows.0\system32\sfcfiles.dll
.
((((((((((((((((((((((((( Files Created from 2010-12-25 to 2011-01-25 )))))))))))))))))))))))))))))))
.

2011-01-20 00:57 . 2011-01-20 00:57 ——– d—–w- c:\documents and settings\Perrin\Application Data\AVG10
2011-01-19 23:35 . 2011-01-19 23:35 ——– d–h–w- c:\documents and settings\All Users\Application Data\Common Files
2011-01-19 23:34 . 2011-01-25 22:20 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG10
2011-01-19 23:00 . 2011-01-20 22:57 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-01-16 16:51 . 2011-01-16 16:51 ——– d—–w- c:\documents and settings\Perrin\Application Data\SUPERAntiSpyware.com
2011-01-16 16:51 . 2011-01-16 16:51 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-01-16 16:50 . 2011-01-16 16:51 ——– d—–w- c:\program files\SUPERAntiSpyware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 18:09 . 2009-08-11 10:13 38224 —-a-w- c:\windows.0\system32\drivers\mbamswissarmy.sys
2010-12-20 18:08 . 2009-08-11 10:13 20952 —-a-w- c:\windows.0\system32\drivers\mbam.sys
2010-10-30 12:27 . 2010-10-30 12:27 388096 —-a-r- c:\documents and settings\Perrin\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2009-05-14 20:02 . 2009-05-14 20:02 3392872 —-a-w- c:\program files\Common Files\adlmint_libFNP.dll
2009-05-14 20:02 . 2009-05-14 20:02 3298152 —-a-w- c:\program files\Common Files\adlmint.dll
.

——- Sigcheck ——-

[-] 2009-01-12 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows.0\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2011-01-19_22.23.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-01-25 22:21 . 2011-01-25 22:21 16384 c:\windows.0\Temp\Perflib_Perfdata_1f0.dat
+ 2010-07-28 10:29 . 2011-01-25 22:21 26238 c:\windows.0\system32\tablet.dat
- 2010-07-28 10:29 . 2011-01-19 22:14 26238 c:\windows.0\system32\tablet.dat
+ 2011-01-19 23:35 . 2011-01-19 23:35 3141632 c:\windows.0\Installer\4983ba.msi
+ 2011-01-19 23:33 . 2011-01-19 23:33 1568768 c:\windows.0\Installer\4983b6.msi
+ 2011-01-20 23:02 . 2011-01-20 23:03 3141632 c:\windows.0\Installer\46ddfe.msi
+ 2011-01-20 23:01 . 2011-01-20 23:01 1568768 c:\windows.0\Installer\46ddfa.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-30 149280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-04 102400]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 577536]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]

c:\documents and settings\Perrin\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
TabUserW.exe.lnk - c:\windows.0\system32\WTablet\TabUserW.exe [2010-7-28 77824]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2010-6-6 565248]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-10-25 16:33 563984 —-a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2007-10-25 16:37 2178832 —-a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 16:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS4\\Dreamweaver.exe"=
"c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
"c:\\Program Files\\Autodesk\\Maya2010\\bin\\maya.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

R0 viasraid;viasraid;c:\windows.0\system32\drivers\viasraid.sys [06/06/2010 16:07 77312]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 18:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 18:41 67656]
R2 ASTSRV;Nalpeiron Licensing Service;c:\windows.0\system32\ASTSRV.EXE [05/04/2010 15:41 57344]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;c:\windows.0\system32\drivers\thdudf.sys [29/01/2010 16:05 66944]
R3 scsiscan;SCSI Scanner Driver;c:\windows.0\system32\drivers\scsiscan.sys [24/01/2010 11:29 11520]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [25/12/2010 13:45 136176]
.
Contents of the 'Scheduled Tasks' folder

2011-01-25 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 13:45]

2011-01-25 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 13:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: amazon.co.uk\www
FF - ProfilePath - c:\documents and settings\Perrin\Application Data\Mozilla\Firefox\Profiles\pjo20krg.default\
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Get Mail Plus: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-25 22:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1960408961-413027322-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{71D940F9-0E35-E0F0-1675-249C6C404004}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1052)
c:\windows.0\system32\Ati2evxx.dll
c:\windows.0\system32\atiadlxx.dll
.
Completion time: 2011-01-25 22:34:43
ComboFix-quarantined-files.txt 2011-01-25 22:34
ComboFix2.txt 2011-01-20 21:55
ComboFix3.txt 2011-01-19 22:25
ComboFix4.txt 2010-10-31 18:45

Pre-Run: 122,724,712,448 bytes free
Post-Run: 122,709,626,880 bytes free

- - End Of File - - 8DF3E1EAEAE2DA7B5D448AE0C92F7922

Thanks as usual, Tonyp

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI