Spyware / Malware / Virus Removal

Trojan/White smoke problem

13 min read

Looking for the outcome? Ask AI

shaunag

Post #16February 7, 2011, 4:01 PM UTC

SystemLook 04.09.10 by jpshortstuff Log created at 11:01 on 07/02/2011 by Ward Realty Administrator - Elevation successful ========== dir ========== c:\windows\system32\C:\Documents and Settings\Ward Realty\Application Data - Unable to find folder. -= EOF =-

CatByte

Post #17February 7, 2011, 4:09 PM UTC

Hi

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

DirLook::
c:\windows\system32\%APPDATA%

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

shaunag

Post #18February 7, 2011, 6:19 PM UTC

ComboFix 11-02-06.02 - Ward Realty 02/07/2011 13:10:20.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1447 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Ward Realty\Desktop\CFScript.txt
AV: F-PROT Antivirus for Windows *Disabled/Updated* {3F8BAFFE-D251-4DC6-ACF9-81FDF61FB9C9}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Ward Realty\Local Settings\Application Data\{0700D11E-1A1D-4528-8A1F-E300248884CE}
c:\documents and settings\Ward Realty\Local Settings\Application Data\{0700D11E-1A1D-4528-8A1F-E300248884CE}\chrome\content\_cfg.js
c:\documents and settings\Ward Realty\Local Settings\Application Data\{0700D11E-1A1D-4528-8A1F-E300248884CE}\chrome\content\overlay.xul
c:\documents and settings\Ward Realty\Local Settings\Application Data\{0700D11E-1A1D-4528-8A1F-E300248884CE}\install.rdf

.
((((((((((((((((((((((((( Files Created from 2011-01-07 to 2011-02-07 )))))))))))))))))))))))))))))))
.

2011-02-03 19:26 . 2010-11-12 23:53 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-02-03 19:11 . 2011-02-03 19:11 ——– d—–w- c:\program files\Common Files\Adobe AIR
2011-02-02 14:28 . 2011-02-02 14:28 ——– d—–w- c:\program files\ESET
2011-02-02 14:13 . 2010-12-20 23:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-02 14:13 . 2010-12-20 23:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-01-30 18:04 . 2011-01-30 18:05 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-01-29 16:08 . 2011-01-29 16:08 ——– d—–w- c:\program files\CCleaner
2011-01-29 15:59 . 2011-01-29 15:59 ——– d—–w- c:\program files\AVG antivirus
2011-01-29 15:03 . 2011-01-29 15:03 ——– d—–w- c:\windows\system32\wbem\Repository
2011-01-28 06:09 . 2011-01-28 06:09 ——– d—–w- c:\windows\system32\%APPDATA%
2011-01-27 21:38 . 2011-01-27 21:38 ——– d—–w- c:\windows\system32\LogFiles
2011-01-27 20:29 . 2011-01-27 20:29 ——– d—–w- c:\documents and settings\Ward Realty\Application Data\Malwarebytes
2011-01-27 20:29 . 2011-01-27 20:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-01-27 20:29 . 2011-02-02 14:13 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-01-27 18:16 . 2011-01-29 15:03 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:12 . 2004-03-19 22:38 81920 —-a-w- c:\windows\system32\isign32.dll
2010-11-12 21:34 . 2010-02-24 18:29 73728 —-a-w- c:\windows\system32\javacpl.cpl
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\windows\system32\%APPDATA% —-

2011-01-30 17:54 . 2010-06-14 15:06 165 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\setup.iss
2011-01-30 17:54 . 2009-06-10 11:57 550192 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\setup.ocx
2011-01-30 17:54 . 2010-07-07 09:45 581440 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\ISSetup.dll
2011-01-30 17:54 . 2009-05-21 12:53 21494 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\0x0409.ini
2011-01-30 17:54 . 2010-07-07 09:45 807744 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\setup.exe
2011-01-30 17:54 . 2010-07-07 09:44 1178 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\setup.ini
2011-01-28 06:09 . 2011-01-30 17:54 86 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\setup.log
2011-01-28 06:09 . 2010-07-07 09:45 31743 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\data1.hdr
2011-01-28 06:09 . 2010-07-07 09:44 234304 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\setup.inx
2011-01-28 06:09 . 2010-06-14 15:32 152 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\config.txt
2011-01-28 06:09 . 2010-07-07 09:45 473 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\layout.bin
2011-01-28 06:09 . 2010-07-07 09:45 3525401 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\data2.cab
2011-01-28 06:09 . 2010-07-07 09:45 567840 —-a-w- c:\windows\system32\%APPDATA%\WhiteSmokeSetup\data1.cab

((((((((((((((((((((((((((((( SnapShot@2011-02-01_17.08.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-02-07 13:52 . 2011-02-07 13:52 16384 c:\windows\temp\Perflib_Perfdata_24c.dat
+ 2011-02-03 19:12 . 2011-02-03 19:12 28160 c:\windows\Installer\aa64d3e.msi
+ 2011-02-03 19:26 . 2010-11-12 23:53 157472 c:\windows\SYSTEM32\javaws.exe
+ 2011-02-03 19:26 . 2010-11-12 23:53 145184 c:\windows\SYSTEM32\javaw.exe
- 2011-01-27 21:37 . 2010-02-24 18:29 145184 c:\windows\SYSTEM32\javaw.exe
- 2011-01-27 21:37 . 2010-02-24 18:29 145184 c:\windows\SYSTEM32\java.exe
+ 2011-02-03 19:26 . 2010-11-12 23:53 145184 c:\windows\SYSTEM32\java.exe
+ 2011-02-03 19:26 . 2011-02-03 19:26 180224 c:\windows\Installer\609ab.msi
+ 2011-02-03 19:34 . 2011-02-03 19:34 2283008 c:\windows\Installer\60dee.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-01-20 28160]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"F-PROT Antivirus Tray application"="c:\program files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe" [2010-07-05 1674032]
"ToolBoxFX"="c:\program files\Hewlett-Packard\hp LaserJet 1160_1320 series\ToolBoxFX\bin\HPTLBXFX.exe" [2008-04-02 53248]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-01 524632]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]

c:\documents and settings\Ward Realty\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FPAVServer]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Ward Realty^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\Ward Realty\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ward Realty^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\Ward Realty\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2007-03-15 15:09 460784 —-a-w- c:\program files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2010-03-12 17:08 49208 —-a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuschd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-09-20 14:32 77824 —-a-w- c:\windows\SYSTEM32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-09-20 14:36 114688 —-a-w- c:\windows\SYSTEM32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2005-09-20 14:35 94208 —-a-w- c:\windows\SYSTEM32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2007-03-30 13:16 32768 —-a-w- c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2004-04-12 01:15 290816 ——w- c:\program files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusClient 2.6]
2004-02-27 17:29 61440 —-a-w- c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-10 14:11 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup 2.5]
2004-05-20 16:40 188416 —-a-w- c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SYSTEM32\\msiexec.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=

R0 FPAV_RTP;FPAV_RTP;c:\windows\SYSTEM32\DRIVERS\FStopW.sys [10/30/2007 2:28 PM 700632]
R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [6/10/2009 2:45 PM 64160]
R2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [11/3/2010 4:40 PM 83624]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 2:06 PM 1029456]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/18/2009 9:08 AM 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2011-02-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 20:45]

2011-02-01 c:\windows\Tasks\F-PROT Antivirus - VIRUS SCAN.job
- c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPWin.exe [2010-07-07 21:26]

2011-02-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-27 09:36]

2011-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 14:07]

2011-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 14:07]

2011-02-07 c:\windows\Tasks\User_Feed_Synchronization-{46845E8E-2B37-421B-A06F-D8B65144068F}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://wardrealty.com/
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.5.0_11\bin\jusched.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-07 13:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2011-02-07 13:17:02
ComboFix-quarantined-files.txt 2011-02-07 18:17
ComboFix2.txt 2011-02-01 17:11

Pre-Run: 57,085,005,824 bytes free
Post-Run: 57,114,660,864 bytes free

- - End Of File - - E59F9FC958A7D5E7D120B044D73E6A57

CatByte

Post #19February 7, 2011, 8:33 PM UTC

Hi

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Folder::
c:\windows\system32\%APPDATA%

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

shaunag

Post #20February 8, 2011, 6:13 PM UTC

ComboFix 11-02-08.01 - Ward Realty 02/08/2011 12:55:48.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.526 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Ward Realty\Desktop\CFScript.txt
AV: F-PROT Antivirus for Windows *Disabled/Updated* {3F8BAFFE-D251-4DC6-ACF9-81FDF61FB9C9}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\%APPDATA%

.
((((((((((((((((((((((((( Files Created from 2011-01-08 to 2011-02-08 )))))))))))))))))))))))))))))))
.

2011-02-07 18:27 . 2011-02-07 18:27 98392 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-02-07 18:24 . 2011-02-07 18:24 ——– d—–w- c:\documents and settings\Ward Realty\Local Settings\Application Data\Sunbelt Software
2011-02-07 18:23 . 2011-02-07 18:23 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2011-02-03 19:26 . 2010-11-12 23:53 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-02-03 19:11 . 2011-02-03 19:11 ——– d—–w- c:\program files\Common Files\Adobe AIR
2011-02-02 14:28 . 2011-02-02 14:28 ——– d—–w- c:\program files\ESET
2011-02-02 14:13 . 2010-12-20 23:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-02 14:13 . 2010-12-20 23:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-01-30 18:04 . 2011-01-30 18:05 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-01-29 16:08 . 2011-01-29 16:08 ——– d—–w- c:\program files\CCleaner
2011-01-29 15:59 . 2011-01-29 15:59 ——– d—–w- c:\program files\AVG antivirus
2011-01-29 15:03 . 2011-01-29 15:03 ——– d—–w- c:\windows\system32\wbem\Repository
2011-01-27 21:38 . 2011-01-27 21:38 ——– d—–w- c:\windows\system32\LogFiles
2011-01-27 20:29 . 2011-01-27 20:29 ——– d—–w- c:\documents and settings\Ward Realty\Application Data\Malwarebytes
2011-01-27 20:29 . 2011-01-27 20:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-01-27 20:29 . 2011-02-02 14:13 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-01-27 18:16 . 2011-01-29 15:03 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-03 09:05 . 2009-06-10 19:45 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-11-18 18:12 . 2004-03-19 22:38 81920 —-a-w- c:\windows\system32\isign32.dll
2010-11-12 21:34 . 2010-02-24 18:29 73728 —-a-w- c:\windows\system32\javacpl.cpl
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-01-20 28160]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"F-PROT Antivirus Tray application"="c:\program files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe" [2010-07-05 1674032]
"ToolBoxFX"="c:\program files\Hewlett-Packard\hp LaserJet 1160_1320 series\ToolBoxFX\bin\HPTLBXFX.exe" [2008-04-02 53248]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2011-02-07 936712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]

c:\documents and settings\Ward Realty\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FPAVServer]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Ward Realty^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\Ward Realty\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Ward Realty^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\Ward Realty\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2007-03-15 15:09 460784 —-a-w- c:\program files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2010-03-12 17:08 49208 —-a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuschd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-09-20 14:32 77824 —-a-w- c:\windows\SYSTEM32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-09-20 14:36 114688 —-a-w- c:\windows\SYSTEM32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2005-09-20 14:35 94208 —-a-w- c:\windows\SYSTEM32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2007-03-30 13:16 32768 —-a-w- c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2004-04-12 01:15 290816 ——w- c:\program files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusClient 2.6]
2004-02-27 17:29 61440 —-a-w- c:\program files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-10 14:11 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup 2.5]
2004-05-20 16:40 188416 —-a-w- c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SYSTEM32\\msiexec.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=

R0 FPAV_RTP;FPAV_RTP;c:\windows\SYSTEM32\DRIVERS\FStopW.sys [10/30/2007 2:28 PM 700632]
R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [6/10/2009 2:45 PM 64288]
R2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [11/3/2010 4:40 PM 83624]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/3/2010 4:05 AM 1402272]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/18/2009 9:08 AM 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2011-02-07 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-12-03 18:26]

2011-02-08 c:\windows\Tasks\F-PROT Antivirus - VIRUS SCAN.job
- c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPWin.exe [2010-07-07 21:26]

2011-02-08 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-27 09:36]

2011-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 14:07]

2011-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 14:07]

2011-02-08 c:\windows\Tasks\User_Feed_Synchronization-{46845E8E-2B37-421B-A06F-D8B65144068F}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://wardrealty.com/
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-08 13:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2792)
c:\windows\system32\WININET.dll
c:\windows\system32\KMPJLMN.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\System32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-02-08 13:09:11 - machine was rebooted
ComboFix-quarantined-files.txt 2011-02-08 18:09
ComboFix2.txt 2011-02-07 18:17
ComboFix3.txt 2011-02-01 17:11

Pre-Run: 56,853,549,056 bytes free
Post-Run: 57,225,433,088 bytes free

- - End Of File - - C3DBF8C2D05EF21D47C0EE69DFB9781F

CatByte

Post #21February 8, 2011, 11:27 PM UTC

Looks good

Just some housekeeping to do now

Please do the following:

You can delete the DDS and GMER logs and programs from your desktop.

NEXT

Follow these steps to uninstall Combofix

Make sure your security programs are totally disabled.
Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

shaunag

Post #22February 11, 2011, 6:02 PM UTC

Thank you so much for everything. The computer seems to be working great now.

CatByte

Post #23February 12, 2011, 4:02 AM UTC

You are welcome stay safe

~CB

CatByte

Post #24February 24, 2011, 12:11 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Trojan/White smoke problem

✨ Ask AI

Ask AI