Spyware / Malware / Virus Removal

Trojan infection usxxxxxxxx

9 min read

Looking for the outcome? Ask AI

theclarken Topic Starter

Post #1May 1, 2011, 6:55 PM UTC

Greetings,

I have several computers at home. My primary desktop which I do most of my online banking etc. has an issue. The machine is running Windows XP Pro, McAfee antivirus, and AdAware. I’m usually very good about applying updates & patches weekly.

Two days ago AdAware let me know I had a Trojan running [usxxxxxxxx]. McAfee VirusScan Enterprise 8.5.0i did not catch this [DAT updated about 10 days prior] which bothers me quite a bit. AdAware quarantined usxxxxxxxx.exe, asesagub.dll, and wz3dabc.dll. The Trojan created a folder C:\usxxxxxxxx\ and within the folder there was usxxxxxxxx.dll which was not quarantined. I shift+deleted the .dll [not recycled] and the folder. I did a system restore to two weeks prior, updated Windows and McAfee and re-scanned. AdAware showed clean but McAfee showed several instances of Hiloti.gen.u in the quarantine folder. I deleted these from the folder. Subsequent scans show nothing. When I launched Firefox every site was asking me to log in again with username and password. I didn’t delete any cookies so I thought this was suspicious [or maybe I’m just a little paranoid]. In the interim I have removed from this computer from my home network and internet access. I also changed passwords for everything using my laptop [which scanned free of anything + nothing in the quarantine folders].

Following the instructions posted on this forum I downloaded HijackThis and ran it with the logfile listed below.

I’m tempted to reload the OS or even reformat the HD and start fresh. I don’t mind an XP reload but I’d rather not reformat if I don’t have to. I have multiple HD’s on this machine and also keep files on an external HD. Would reloading the OS help in this case? If anyone thinks this is overkill I’m open to that feedback or any other advice.

Thanks in advance,

Dave

——-

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:34:09 PM, on 5/1/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Quantum Digital Security\Security Toolkit\SecurityToolkit.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\NetLimiter 2 Monitor\NLClient.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcconsol.exe
C:\Documents and Settings\Dave\Desktop\HijackThis.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\GoogleUpdate.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SecurityToolkit] C:\Program Files\Quantum Digital Security\Security Toolkit\SecurityToolkit.exe -boot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10e.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.cinemanow.com
O15 - Trusted Zone: http://*.qflix.com
O15 - Trusted Zone: http://*.roxio.com
O15 - Trusted Zone: http://redirect.sonic.com
O15 - Trusted Zone: http://redirect2.sonic.com
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: CinemaNow Service - CinemaNow, Inc. - C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: RoxMediaDB12 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe

–
End of file - 8424 bytes

CatByte

Post #2May 3, 2011, 1:23 AM UTC

we need to have a deeper look to see if there is anything lurking on your system

please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT

Please download aswMBR ( 511KB ) to your desktop.

Double click the aswMBR.exe icon to run it
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

theclarken

Post #3May 3, 2011, 2:39 PM UTC

Hello CatByte, In sequence here are the following: DDS.txt Attach.txt aswMBR.txt ——–BEGIN DDS.txt———– . DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 10:07:02.26 on Tue 05/03/2011 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1292 [GMT -4:00] . AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33} AV: McAfee VirusScan Enterprise *Disabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\AGEIA Technologies\TrayIcon.exe C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Quantum Digital Security\Security Toolkit\SecurityToolkit.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\NetLimiter 2 Monitor\NLClient.exe C:\WINDOWS\explorer.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\Program Files\McAfee\VirusScan Enterprise\mcconsol.exe C:\Documents and Settings\Dave\Desktop\dds.com . ============== Pseudo HJT Report =============== . uStart Page = about:blank BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptcl.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10e.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [AGEIA PhysX SysTray] c:\program files\ageia technologies\TrayIcon.exe mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [SecurityToolkit] c:\program files\quantum digital security\security toolkit\SecurityToolkit.exe -boot mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL Trusted Zone: cinemanow.com Trusted Zone: nih.gov\mail Trusted Zone: qflix.com Trusted Zone: roxio.com Trusted Zone: sonic.com\redirect Trusted Zone: sonic.com\redirect2 DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\docume~1\dave\applic~1\mozilla\firefox\profiles\d5w51t36.default\ FF - prefs.js: browser.startup.homepage - www.yahoo.com FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll . ============= SERVICES / DRIVERS =============== . P2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\mcshield.exe [2006-11-30 144960] R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-1-3 64288] R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2006-11-30 31944] R1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [2007-4-23 81688] R2 CinemaNow Service;CinemaNow Service;c:\program files\cinemanow\cinemanow media manager\CinemaNowSvc.exe [2009-6-23 127352] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-12-3 2146496] R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2007-12-23 104000] R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\vstskmgr.exe [2006-11-30 54872] R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-12-3 15232] R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2007-12-23 72264] R3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2007-12-23 34152] R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2007-12-23 168776] R3 physX32;physX32;c:\windows\system32\drivers\physX32.sys [2008-1-9 120320] R4 CryptoDrv;CryptoDrv;c:\program files\quantum digital security\security toolkit\CryptoDrv.sys [2009-7-3 147008] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-25 136176] S3 athena;athena;c:\windows\system32\drivers\athena.sys [2006-3-20 107392] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-25 136176] S3 RoxMediaDB12;RoxMediaDB12;c:\program files\common files\roxio shared\12.0\sharedcom\RoxMediaDB12.exe [2009-7-24 1116656] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2011-04-30 12:07:29 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2011-04-30 12:07:28 89048 —-a-w- c:\program files\mozilla firefox\libEGL.dll 2011-04-30 12:07:28 781272 —-a-w- c:\program files\mozilla firefox\mozsqlite3.dll 2011-04-30 12:07:28 465880 —-a-w- c:\program files\mozilla firefox\libGLESv2.dll 2011-04-30 12:07:28 1974616 —-a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll 2011-04-30 12:07:28 1892184 —-a-w- c:\program files\mozilla firefox\d3dx9_42.dll 2011-04-30 12:07:28 1874904 —-a-w- c:\program files\mozilla firefox\mozjs.dll 2011-04-30 12:07:28 15832 —-a-w- c:\program files\mozilla firefox\mozalloc.dll 2011-04-29 02:06:00 ——– d—–w- c:\windows\system32\wbem\repository\FS 2011-04-29 02:06:00 ——– d—–w- c:\windows\system32\wbem\Repository 2011-04-28 02:11:16 0 —-a-w- c:\windows\Owuvafupeyeguw.bin 2011-04-28 02:11:14 ——– d—–w- c:\docume~1\dave\locals~1\applic~1\{D91B4315-06D8-49B9-ABB3-DF79E4ED6E73} . ==================== Find3M ==================== . 2011-04-29 19:59:45 252316 —-a-w- c:\windows\system32\nvdrsdb0.bin 2011-04-29 19:59:45 1 —-a-w- c:\windows\system32\nvdrssel.bin 2011-04-29 09:53:36 16432 —-a-w- c:\windows\system32\lsdelete.exe 2011-04-23 14:58:45 252316 —-a-w- c:\windows\system32\nvdrsdb1.bin 2011-03-11 14:10:38 471552 —-a-w- c:\windows\apppatch\aclayers.dll 2011-03-07 05:33:50 692736 ——w- c:\windows\system32\inetcomm.dll 2011-03-04 06:37:06 420864 —-a-w- c:\windows\system32\vbscript.dll 2011-03-03 13:21:11 1857920 —-a-w- c:\windows\system32\win32k.sys 2011-02-23 12:27:00 941160 —-a-w- c:\windows\system32\nvdispco322090.dll 2011-02-23 12:27:00 837736 —-a-w- c:\windows\system32\nvgenco322040.dll 2011-02-23 12:27:00 6398720 —-a-w- c:\windows\system32\nv4_disp.dll 2011-02-23 12:27:00 61440 —-a-w- c:\windows\system32\OpenCL.dll 2011-02-23 12:27:00 4980736 —-a-w- c:\windows\system32\nvcuda.dll 2011-02-23 12:27:00 2916968 —-a-w- c:\windows\system32\nvcuvid.dll 2011-02-23 12:27:00 2292678 —-a-w- c:\windows\system32\nvdata.bin 2011-02-23 12:27:00 2251368 —-a-w- c:\windows\system32\nvcuvenc.dll 2011-02-23 12:27:00 1958400 —-a-w- c:\windows\system32\nvapi.dll 2011-02-23 12:27:00 14671872 —-a-w- c:\windows\system32\nvoglnt.dll 2011-02-23 12:27:00 13004800 —-a-w- c:\windows\system32\nvcompiler.dll 2011-02-22 23:06:29 916480 —-a-w- c:\windows\system32\wininet.dll 2011-02-22 23:06:29 43520 ——w- c:\windows\system32\licmgr10.dll 2011-02-22 23:06:29 1469440 ——w- c:\windows\system32\inetcpl.cpl 2011-02-22 11:41:59 385024 ——w- c:\windows\system32\html.iec 2011-02-17 12:32:12 5120 —-a-w- c:\windows\system32\xpsp4res.dll 2011-02-15 12:56:39 290432 —-a-w- c:\windows\system32\atmfd.dll 2011-02-09 13:53:52 270848 ——w- c:\windows\system32\sbe.dll 2011-02-09 13:53:52 186880 ——w- c:\windows\system32\encdec.dll 2011-02-08 13:33:55 978944 ——w- c:\windows\system32\mfc42.dll 2011-02-08 13:33:55 974848 —-a-w- c:\windows\system32\mfc42u.dll . ============= FINISH: 10:07:54.85 =============== ——–END DDS.txt———– ——–BEGIN Attach.txt———- . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume4 Install Date: 12/8/2007 6:53:43 PM System Uptime: 5/2/2011 6:14:38 AM (28 hours ago) . Motherboard: ASUSTeK Computer INC. | | A8N-E Processor: AMD Athlon™ 64 Processor 3700+ | Socket 939 | 2216/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 298 GiB total, 43.55 GiB free. D: is CDROM () E: is FIXED (NTFS) - 186 GiB total, 111.696 GiB free. F: is FIXED (NTFS) - 47 GiB total, 45.547 GiB free. G: is FIXED (NTFS) - 932 GiB total, 61.456 GiB free. H: is Removable J: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP629: 2/1/2011 9:41:08 AM - System Checkpoint RP630: 2/2/2011 5:37:00 PM - System Checkpoint RP631: 2/4/2011 8:35:44 PM - System Checkpoint RP632: 2/6/2011 12:44:39 PM - System Checkpoint RP633: 2/7/2011 8:59:16 PM - System Checkpoint RP634: 2/9/2011 8:51:15 PM - System Checkpoint RP635: 2/11/2011 9:35:11 PM - System Checkpoint RP636: 2/12/2011 9:35:50 PM - System Checkpoint RP637: 2/14/2011 6:49:15 PM - System Checkpoint RP638: 2/15/2011 7:43:06 PM - System Checkpoint RP639: 2/17/2011 4:23:08 PM - System Checkpoint RP640: 2/18/2011 6:26:32 PM - System Checkpoint RP641: 2/21/2011 8:12:15 AM - System Checkpoint RP642: 2/26/2011 4:01:10 PM - System Checkpoint RP643: 2/28/2011 6:12:53 PM - System Checkpoint RP644: 3/3/2011 5:49:56 PM - System Checkpoint RP645: 3/5/2011 1:24:25 PM - System Checkpoint RP646: 3/6/2011 2:01:43 PM - System Checkpoint RP647: 3/7/2011 6:11:55 PM - System Checkpoint RP648: 3/8/2011 6:39:03 PM - System Checkpoint RP649: 3/12/2011 12:53:15 PM - System Checkpoint RP650: 3/13/2011 2:29:43 PM - System Checkpoint RP651: 3/26/2011 12:48:10 PM - System Checkpoint RP652: 3/27/2011 12:53:08 PM - System Checkpoint RP653: 3/30/2011 3:21:05 PM - System Checkpoint RP654: 4/5/2011 5:40:22 PM - System Checkpoint RP655: 4/8/2011 5:58:17 PM - System Checkpoint RP656: 4/9/2011 6:06:56 PM - System Checkpoint RP657: 4/15/2011 6:28:32 PM - System Checkpoint RP658: 4/17/2011 1:20:16 AM - System Checkpoint RP659: 4/18/2011 5:42:30 PM - System Checkpoint RP660: 4/19/2011 5:52:37 PM - System Checkpoint RP661: 4/20/2011 6:15:16 PM - System Checkpoint RP662: 4/21/2011 6:55:26 PM - System Checkpoint RP663: 4/23/2011 10:51:14 AM - Software Distribution Service 3.0 RP664: 4/23/2011 11:55:11 PM - Software Distribution Service 3.0 RP665: 4/25/2011 12:00:18 AM - System Checkpoint RP666: 4/27/2011 4:36:44 PM - System Checkpoint RP667: 4/28/2011 7:18:09 PM - Software Distribution Service 3.0 RP668: 4/28/2011 10:02:20 PM - Restore Operation RP669: 4/29/2011 3:55:11 PM - Software Distribution Service 3.0 RP670: 4/30/2011 4:03:32 PM - System Checkpoint RP671: 5/1/2011 4:12:17 PM - System Checkpoint . ==== Installed Programs ====================== . . 7-Zip 9.15 beta Acrobat.com Active@ ISO Burner v 1.1 Ad-Aware Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 9.4.2 AGEIA PhysX Unreal Tournament 3 Mods AGEIA PhysX v2.4.2 AGEIA PhysX v7.09.13 Apple Software Update Battlefield 2™ Battlefield 2: Special Forces BufferChm Call of Duty Call of Duty - United Offensive CameraDrivers CinemaNow Media Manager CombiMovie Version 1.31 CP_AtenaShokunin1Config CP_CalendarTemplates1 CP_Package_Basic1 CP_Package_Variety1 CP_Package_Variety2 CP_Package_Variety3 CP_Panorama1Config Critical Update for Windows Media Player 11 (KB959772) CueTour Destinations DeviceFunctionQFolder DeviceManagementQFolder DirectX 9 Runtime DivX Converter DivX Plus DirectShow Filters DivX Setup DivX Version Checker eSupportQFolder FLV Player 2.0 (build 25) FullDPAppQFolder Google Earth Plug-in Google Update Helper Half-Life Hotfix for Microsoft .NET Framework 3.0 (KB932471) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB2158563) Hotfix for Windows XP (KB2443685) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) HP Image Zone 5.3 HP Imaging Device Functions 5.3 HP Photosmart 330,380,420,470,7800,8000,8200 Series HP Software Update HP Solution Center & Imaging Support Tools 5.3 HPProductAssistant InstantShareDevices IrfanView (remove only) IZArc 4.1.2 Java Auto Updater Java™ 6 Update 23 K-Lite Codec Pack 4.8.5 (Full) McAfee VirusScan Enterprise Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2416447) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Base Smart Card Cryptographic Service Provider Package Microsoft Compression Client Pack 1.0 for Windows XP Microsoft IntelliPoint 6.1 Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Live Add-in 1.3 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable - KB2467175 Microsoft Windows XP Video Decoder Checkup Utility Mozilla Firefox 4.0.1 (x86 en-US) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 6.0 Parser (KB933579) MSXML4 Parser Myst IV - Revelation NetLimiter 2 Monitor (remove only) NVIDIA Display Control Panel NVIDIA Drivers NVIDIA nView Desktop Manager OGA Notifier 2.0.0048.0 PanoStandAlone PhotoGallery PowerDVD PS8200 PSPrinters08 PSTAPlugin Psychonauts QDS Security Toolkit Quake III Arena Quake III Arena Point Release 1.32 QuickPar 0.9 QuickTime RandMap Realtek AC'97 Audio Rise of Nations Roxio Activation Module Roxio Burn Manager Roxio Burn Manager CDB Roxio CinePlayer Decoder Pack Roxio Creator 2010 Content Roxio Easy DVD Copy Premier Roxio Venue Security Update for 2007 Microsoft Office System (KB2288621) Security Update for 2007 Microsoft Office System (KB2288931) Security Update for 2007 Microsoft Office System (KB2345043) Security Update for 2007 Microsoft Office System (KB2466156) Security Update for 2007 Microsoft Office System (KB2509488) Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB976321) Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Extended (KB2416472) Security Update for Microsoft Office Access 2007 (KB979440) Security Update for Microsoft Office Excel 2007 (KB2464583) Security Update for Microsoft Office Groove 2007 (KB2494047) Security Update for Microsoft Office InfoPath 2007 (KB979441) Security Update for Microsoft Office PowerPoint 2007 (KB2464594) Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623) Security Update for Microsoft Office Publisher 2007 (KB2284697) Security Update for Microsoft Office system 2007 (972581) Security Update for Microsoft Office system 2007 (KB974234) Security Update for Microsoft Office Visio Viewer 2007 (KB973709) Security Update for Microsoft Office Word 2007 (KB2344993) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 8 (KB2183461) Security Update for Windows Internet Explorer 8 (KB2360131) Security Update for Windows Internet Explorer 8 (KB2416400) Security Update for Windows Internet Explorer 8 (KB2497640) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB969897) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB972260) Security Update for Windows Internet Explorer 8 (KB974455) Security Update for Windows Internet Explorer 8 (KB976325) Security Update for Windows Internet Explorer 8 (KB978207) Security Update for Windows Internet Explorer 8 (KB981332) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2121546) Security Update for Windows XP (KB2160329) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2259922) Security Update for Windows XP (KB2279986) Security Update for Windows XP (KB2286198) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2296199) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2436673) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476687) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2503658) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2511455) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981852) Security Update for Windows XP (KB981957) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982214) Security Update for Windows XP (KB982665) Security Update for Windows XP (KB982802) SkinsHP1 SmartSound Quicktracks Plugin SolutionCenter Sonic_PrimoSDK Status System Requirements Lab TeamSpeak 2 RC2 TELL ME MORE The Core Media Player 4.0 TrayApp Unload Unreal Tournament 3 Unreal Tournament G.O.T.Y. Edition Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 (KB980729) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 (KB2412171) Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Update for Microsoft Windows (KB971513) Update for Outlook 2007 Junk Email Filter (KB2522999) Update for Windows Internet Explorer 8 (KB2447568) Update for Windows Internet Explorer 8 (KB968220) Update for Windows Internet Explorer 8 (KB971180) Update for Windows Internet Explorer 8 (KB972636) Update for Windows Internet Explorer 8 (KB973874) Update for Windows Internet Explorer 8 (KB976662) Update for Windows Internet Explorer 8 (KB976749) Update for Windows Internet Explorer 8 (KB980182) Update for Windows Internet Explorer 8 (KB982664) Update for Windows XP (KB2141007) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2492386) Update for Windows XP (KB943729) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) VC80CRTRedist - 8.0.50727.4053 Ventrilo Client Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 WebFldrs XP WebReg Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Imaging Component Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Live Sign-in Assistant Windows Media Format 11 runtime Windows Media Player 11 Windows PowerShell™ 1.0 Windows Presentation Foundation Windows XP Service Pack 3 XML Paper Specification Shared Components Pack 1.0 XP Codec Pack . ==== Event Viewer Messages From Past Week ======== . 5/1/2011 2:11:36 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 5/1/2011 2:10:21 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 4/28/2011 10:14:53 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 4/28/2011 10:10:13 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service. . ==== End Of File =========================== ——–END Attach.txt———– ——–BEGIN aswMBR.txt———- aswMBR version 0.9.5.247 Copyright© 2011 AVAST Software Run date: 2011-05-03 10:09:37 —————————– 10:09:37.359 OS Version: Windows 5.1.2600 Service Pack 3 10:09:37.359 Number of processors: 1 586 0x3702 10:09:37.359 ComputerName: SUN-TZU UserName: Dave 10:09:37.937 Initialize success 10:09:51.062 Disk 0 \Device\Harddisk0\DR0 -> \Device\0000006e 10:09:51.062 Disk 0 Vendor: WDC_WD1001FALS-00J7B0 05.00K05 Size: 953869MB BusType: 3 10:09:51.062 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000070 10:09:51.062 Disk 1 Vendor: WDC_WD2500KS-00MJB0 02.01C03 Size: 238475MB BusType: 3 10:09:51.062 Disk 2 (boot) \Device\Harddisk2\DR2 -> \Device\00000071 10:09:51.062 Disk 2 Vendor: MAXTOR_STM3320620AS 3.AAE Size: 305245MB BusType: 3 10:09:51.062 Device \Driver\nvata -> MajorFunction 8a5691f8 10:09:51.062 Disk 2 MBR read successfully 10:09:51.062 Disk 2 MBR scan 10:09:51.062 Disk 2 Windows XP default MBR code 10:09:51.062 Disk 2 scanning sectors +625121280 10:09:51.093 Disk 2 scanning C:\WINDOWS\system32\drivers 10:09:55.296 Service scanning 10:09:56.156 Disk 2 trace - called modules: 10:09:56.656 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8a5691f8]<< 10:09:56.656 1 nt!IofCallDriver -> \Device\Harddisk2\DR2[0x8a4d8ab8] 10:09:56.656 3 CLASSPNP.SYS[b80e8fd7] -> nt!IofCallDriver -> \Device\00000073[0x8a4c6f18] 10:09:56.656 5 ACPI.sys[b7e74620] -> nt!IofCallDriver -> \Device\00000071[0x8a4f6030] 10:09:56.656 \Driver\nvata[0x8a51ff38] -> IRP_MJ_CREATE -> 0x8a5691f8 10:09:56.656 Scan finished successfully 10:20:07.937 Disk 2 MBR has been saved successfully to "C:\Documents and Settings\Dave\Desktop\MBR.dat" 10:20:07.937 The log file has been saved successfully to "C:\Documents and Settings\Dave\Desktop\aswMBR.txt" ——–END aswMBR.txt———-

CatByte

Post #4May 3, 2011, 11:01 PM UTC

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

theclarken

Post #5May 4, 2011, 1:10 AM UTC

Hello CatByte, I loaded ComboFix and ran the program after disabling McAfee and AdAware. It did what you described below until the machine rebooted. There is no ComboFix.txt on the C: drive. I did get a Windows message: The system has recovered from a serious error. [I'm going to try to attach a picture of the error report below.] 📎Error_Message.JPG Dave

CatByte

Post #6May 4, 2011, 1:16 AM UTC

OK, try this

delete the copy of ComboFix that you have on your desktop and download a fresh copy but rename it to iexplore before saving it to your desktop.

Now try running it again, if you still have issues, boot to safe mode and run from safe mode, post the resulting log.

To Enter Safemode

Go to Start> Shut off your Computer> Restart
As the computer starts to boot-up, Tap the F8 KEY repeatedly,
this will bring up a menu.
Use the Up and Down Arrow Keys to scroll up to Safemode
Then press the Enter Key on your Keyboard
go into your usual account

theclarken

Post #7May 4, 2011, 2:03 AM UTC

OK - second time worked!

ComboFix 11-05-02.04 - Dave 05/03/2011 22:41:53.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1569 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: McAfee VirusScan Enterprise *Enabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk
c:\documents and settings\Dave\Application Data\Local
c:\documents and settings\Dave\Application Data\Local\Temp\DDM\Settings\2.ddi
c:\documents and settings\Dave\Application Data\Local\Temp\DDM\Settings\Post_Install_RB_HiQ_en.divx.ddr
c:\documents and settings\Dave\Application Data\Local\Temp\DDM\Settings\settings.ddi
c:\documents and settings\Dave\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2).ddp
c:\documents and settings\Dave\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\.ddp
c:\documents and settings\Dave\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\Post_Install_RB_HiQ_en.divx
c:\documents and settings\Dave\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\TESVSkyrim_OfficialTrailer_US_Desktop_0.mp4.ddp
c:\program files\Internet Explorer\SET3FB.tmp
c:\program files\Internet Explorer\SET3FC.tmp
.
.
((((((((((((((((((((((((( Files Created from 2011-04-04 to 2011-05-04 )))))))))))))))))))))))))))))))
.
.
2011-04-30 12:07 . 2011-04-14 16:26 142296 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-30 12:07 . 2011-04-14 16:25 781272 —-a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-30 12:07 . 2011-04-14 16:25 1874904 —-a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-30 12:07 . 2011-04-14 16:25 15832 —-a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-30 12:07 . 2011-04-14 16:25 465880 —-a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-30 12:07 . 2011-04-14 16:25 89048 —-a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-30 12:07 . 2010-01-01 08:00 1974616 —-a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-30 12:07 . 2010-01-01 08:00 1892184 —-a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-29 02:06 . 2011-04-29 02:06 ——– d—–w- c:\windows\system32\wbem\Repository
2011-04-29 02:04 . 2011-04-29 02:05 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2011-04-28 02:11 . 2011-04-28 23:01 0 —-a-w- c:\windows\Owuvafupeyeguw.bin
2011-04-28 02:11 . 2011-04-29 02:03 ——– d—–w- c:\documents and settings\Dave\Local Settings\Application Data\{D91B4315-06D8-49B9-ABB3-DF79E4ED6E73}
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-29 09:53 . 2011-01-18 12:44 16432 —-a-w- c:\windows\system32\lsdelete.exe
2011-03-11 14:10 . 2004-08-04 04:56 471552 —-a-w- c:\windows\apppatch\aclayers.dll
2011-03-07 05:33 . 2007-12-08 23:49 692736 ——w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 04:56 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-04 03:17 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-23 12:27 . 2011-02-23 12:27 941160 —-a-w- c:\windows\system32\nvdispco322090.dll
2011-02-23 12:27 . 2011-02-23 12:27 837736 —-a-w- c:\windows\system32\nvgenco322040.dll
2011-02-23 12:27 . 2010-01-12 17:03 61440 —-a-w- c:\windows\system32\OpenCL.dll
2011-02-23 12:27 . 2010-01-12 17:03 2251368 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-02-23 12:27 . 2010-01-12 17:03 13004800 —-a-w- c:\windows\system32\nvcompiler.dll
2011-02-23 12:27 . 2009-03-28 04:03 2916968 —-a-w- c:\windows\system32\nvcuvid.dll
2011-02-23 12:27 . 2008-09-18 04:55 4980736 —-a-w- c:\windows\system32\nvcuda.dll
2011-02-23 12:27 . 2007-10-04 22:14 9888384 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-02-23 12:27 . 2007-10-04 22:14 6398720 —-a-w- c:\windows\system32\nv4_disp.dll
2011-02-23 12:27 . 2007-10-04 22:14 1958400 —-a-w- c:\windows\system32\nvapi.dll
2011-02-23 12:27 . 2007-10-04 22:14 14671872 —-a-w- c:\windows\system32\nvoglnt.dll
2011-02-22 23:06 . 2004-08-04 04:56 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 23:06 . 2004-08-04 04:56 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2004-08-04 04:56 43520 ——w- c:\windows\system32\licmgr10.dll
2011-02-22 11:41 . 2004-08-04 02:59 385024 ——w- c:\windows\system32\html.iec
2011-02-17 13:18 . 2004-08-04 03:15 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-08-04 03:14 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2009-04-14 23:52 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-08-04 04:56 290432 —-a-w- c:\windows\system32\atmfd.dll
2011-02-09 13:53 . 2004-08-04 04:56 270848 ——w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-04 04:56 186880 ——w- c:\windows\system32\encdec.dll
2011-02-08 13:33 . 2004-08-04 04:56 978944 ——w- c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 2004-08-04 04:56 974848 —-a-w- c:\windows\system32\mfc42u.dll
2011-04-14 16:26 . 2011-04-30 12:07 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 77824]
"AGEIA PhysX SysTray"="c:\program files\AGEIA Technologies\TrayIcon.exe" [2006-03-20 335872]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 112216]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 136768]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"SecurityToolkit"="c:\program files\Quantum Digital Security\Security Toolkit\SecurityToolkit.exe" [2005-11-16 3289088]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 04:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-12-09 19:28 1226608 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 15:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-12 03:12 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-01 16:35 49152 —-a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2007-04-11 20:32 56080 —-a-w- c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
2007-04-11 20:32 56080 —-a-w- c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Quake III Arena\\quake3.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\UnrealTournament\\System\\UnrealTournament.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\CinemaNow\\CinemaNow Media Manager\\CinemaNowShell.exe"=
"c:\\Program Files\\Roxio 2010\\Venue\\Venue.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/3/2011 9:50 PM 64288]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/25/2010 6:12 PM 691696]
R1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [4/23/2007 12:08 PM 81688]
R2 CinemaNow Service;CinemaNow Service;c:\program files\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe [6/23/2009 5:40 PM 127352]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/3/2010 5:05 AM 2146496]
R3 physX32;physX32;c:\windows\system32\drivers\physX32.sys [1/9/2008 8:52 PM 120320]
R4 CryptoDrv;CryptoDrv;c:\program files\Quantum Digital Security\Security Toolkit\CryptoDrv.sys [7/3/2009 6:06 PM 147008]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/25/2011 11:24 PM 136176]
S3 athena;athena;c:\windows\system32\drivers\athena.sys [3/20/2006 3:50 PM 107392]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/25/2011 11:24 PM 136176]
S3 RoxMediaDB12;RoxMediaDB12;c:\program files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe [7/24/2009 8:33 AM 1116656]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - CRYPTODRV
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-12-03 09:53]
.
2011-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-26 03:24]
.
2011-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-26 03:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: cinemanow.com
Trusted Zone: nih.gov\mail
Trusted Zone: qflix.com
Trusted Zone: roxio.com
Trusted Zone: sonic.com\redirect
Trusted Zone: sonic.com\redirect2
FF - ProfilePath - c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\d5w51t36.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-AGEIA PhysX v2.4.2 - c:\program files\AGEIA Technologies\uninstall.exe
AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-03 22:51
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3444)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\mcshield.exe
c:\program files\McAfee\VirusScan Enterprise\vstskmgr.exe
c:\program files\NetLimiter 2 Monitor\nlsvc.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\program files\NetLimiter 2 Monitor\NLClient.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
c:\windows\SOUNDMAN.EXE
c:\program files\McAfee\Common Framework\McTray.exe
.
**************************************************************************
.
Completion time: 2011-05-03 22:58:12 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-04 02:58
.
Pre-Run: 50,936,131,584 bytes free
Post-Run: 89,309,843,456 bytes free
.
- - End Of File - - 0D0B9435722495182E2A3E3173E9B4A0

CatByte

Post #8May 4, 2011, 2:32 AM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
c:\windows\Owuvafupeyeguw.bin

Folder::
c:\documents and settings\Dave\Local Settings\Application Data\{D91B4315-06D8-49B9-ABB3-DF79E4ED6E73}

DDS::
Trusted Zone: cinemanow.com
Trusted Zone: qflix.com
Trusted Zone: roxio.com
Trusted Zone: sonic.com\redirect
Trusted Zone: sonic.com\redirect2

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

Note: You will need to use Internet explorer for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

theclarken

Post #9May 5, 2011, 2:50 AM UTC

Hello CatByte,

That took a little longer than expected. [4 hours for ESET]

In order, here are the following files:
1) ComboFix [2nd iteration using the provided script]
2) mbam-log
3) ESETSCAN

——BEGIN ComboFix—–

ComboFix 11-05-02.04 - Dave 05/04/2011 18:50:10.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1486 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dave\Desktop\CFScript.txt
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: McAfee VirusScan Enterprise *Disabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
FILE ::
"c:\windows\Owuvafupeyeguw.bin"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Dave\Local Settings\Application Data\{D91B4315-06D8-49B9-ABB3-DF79E4ED6E73}
c:\documents and settings\Dave\Local Settings\Application Data\{D91B4315-06D8-49B9-ABB3-DF79E4ED6E73}\chrome\content\_cfg.js
c:\documents and settings\Dave\Local Settings\Application Data\{D91B4315-06D8-49B9-ABB3-DF79E4ED6E73}\install.rdf
c:\windows\Owuvafupeyeguw.bin
.
.
((((((((((((((((((((((((( Files Created from 2011-04-04 to 2011-05-04 )))))))))))))))))))))))))))))))
.
.
2011-04-30 12:07 . 2011-04-14 16:26 142296 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-30 12:07 . 2011-04-14 16:25 781272 —-a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-30 12:07 . 2011-04-14 16:25 1874904 —-a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-30 12:07 . 2011-04-14 16:25 15832 —-a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-30 12:07 . 2011-04-14 16:25 465880 —-a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-30 12:07 . 2011-04-14 16:25 89048 —-a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-30 12:07 . 2010-01-01 08:00 1974616 —-a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-30 12:07 . 2010-01-01 08:00 1892184 —-a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-29 02:06 . 2011-04-29 02:06 ——– d—–w- c:\windows\system32\wbem\Repository
2011-04-29 02:04 . 2011-04-29 02:05 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-29 09:53 . 2011-01-18 12:44 16432 —-a-w- c:\windows\system32\lsdelete.exe
2011-03-11 14:10 . 2004-08-04 04:56 471552 —-a-w- c:\windows\apppatch\aclayers.dll
2011-03-07 05:33 . 2007-12-08 23:49 692736 ——w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 04:56 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-04 03:17 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-23 12:27 . 2011-02-23 12:27 941160 —-a-w- c:\windows\system32\nvdispco322090.dll
2011-02-23 12:27 . 2011-02-23 12:27 837736 —-a-w- c:\windows\system32\nvgenco322040.dll
2011-02-23 12:27 . 2010-01-12 17:03 61440 —-a-w- c:\windows\system32\OpenCL.dll
2011-02-23 12:27 . 2010-01-12 17:03 2251368 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-02-23 12:27 . 2010-01-12 17:03 13004800 —-a-w- c:\windows\system32\nvcompiler.dll
2011-02-23 12:27 . 2009-03-28 04:03 2916968 —-a-w- c:\windows\system32\nvcuvid.dll
2011-02-23 12:27 . 2008-09-18 04:55 4980736 —-a-w- c:\windows\system32\nvcuda.dll
2011-02-23 12:27 . 2007-10-04 22:14 9888384 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-02-23 12:27 . 2007-10-04 22:14 6398720 —-a-w- c:\windows\system32\nv4_disp.dll
2011-02-23 12:27 . 2007-10-04 22:14 1958400 —-a-w- c:\windows\system32\nvapi.dll
2011-02-23 12:27 . 2007-10-04 22:14 14671872 —-a-w- c:\windows\system32\nvoglnt.dll
2011-02-22 23:06 . 2004-08-04 04:56 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 23:06 . 2004-08-04 04:56 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2004-08-04 04:56 43520 ——w- c:\windows\system32\licmgr10.dll
2011-02-22 11:41 . 2004-08-04 02:59 385024 ——w- c:\windows\system32\html.iec
2011-02-17 13:18 . 2004-08-04 03:15 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-08-04 03:14 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2009-04-14 23:52 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-08-04 04:56 290432 —-a-w- c:\windows\system32\atmfd.dll
2011-02-09 13:53 . 2004-08-04 04:56 270848 ——w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-04 04:56 186880 ——w- c:\windows\system32\encdec.dll
2011-02-08 13:33 . 2004-08-04 04:56 978944 ——w- c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 2004-08-04 04:56 974848 —-a-w- c:\windows\system32\mfc42u.dll
2011-04-14 16:26 . 2011-04-30 12:07 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 77824]
"AGEIA PhysX SysTray"="c:\program files\AGEIA Technologies\TrayIcon.exe" [2006-03-20 335872]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 112216]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 136768]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"SecurityToolkit"="c:\program files\Quantum Digital Security\Security Toolkit\SecurityToolkit.exe" [2005-11-16 3289088]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 04:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-12-09 19:28 1226608 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 15:44 31072 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-12 03:12 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-01 16:35 49152 —-a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2007-04-11 20:32 56080 —-a-w- c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
2007-04-11 20:32 56080 —-a-w- c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Quake III Arena\\quake3.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"c:\\UnrealTournament\\System\\UnrealTournament.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\CinemaNow\\CinemaNow Media Manager\\CinemaNowShell.exe"=
"c:\\Program Files\\Roxio 2010\\Venue\\Venue.exe"=
"c:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1/3/2011 9:50 PM 64288]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/25/2010 6:12 PM 691696]
R1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [4/23/2007 12:08 PM 81688]
R2 CinemaNow Service;CinemaNow Service;c:\program files\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe [6/23/2009 5:40 PM 127352]
R3 physX32;physX32;c:\windows\system32\drivers\physX32.sys [1/9/2008 8:52 PM 120320]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/25/2011 11:24 PM 136176]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/3/2010 5:05 AM 2146496]
S3 athena;athena;c:\windows\system32\drivers\athena.sys [3/20/2006 3:50 PM 107392]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/25/2011 11:24 PM 136176]
S3 RoxMediaDB12;RoxMediaDB12;c:\program files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe [7/24/2009 8:33 AM 1116656]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - CryptoDrv
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-12-03 09:53]
.
2011-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-26 03:24]
.
2011-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-26 03:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: nih.gov\mail
FF - ProfilePath - c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\d5w51t36.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-04 18:55
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-05-04 18:57:28
ComboFix-quarantined-files.txt 2011-05-04 22:57
ComboFix2.txt 2011-05-04 02:58
.
Pre-Run: 89,422,610,432 bytes free
Post-Run: 89,402,236,928 bytes free
.
- - End Of File - - F901B3D145C6C382B2D7E8EA55BF4F3A

——END ComboFix———–BEGIN mbam-log—–

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6508

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/4/2011 7:10:30 PM
mbam-log-2011-05-04 (19-10-30).txt

Scan type: Quick scan
Objects scanned: 161475
Time elapsed: 2 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

——END mbam-log———–BEGIN ESETSCAN—–

C:\Documents and Settings\Dave\Application Data\Sun\Java\Deployment\cache\6.0\26\3cb09a9a-15521832 multiple threats

——END ESETSCAN—–

CatByte

Post #10May 5, 2011, 5:13 AM UTC

Hi

Please do the following:

Visit ADOBEand download the latest version of Acrobat Reader (version X)

NEXT

Having the latest updates ensures there are no security vulnerabilities in your system.
[external image: Posted Image] Your Java is out of date.
Java™ 6 Update 23 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now.
An update should begin; > follow the prompts.

Clear Java cache

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup) If you do not see the icon, look to your left and click 'Switch to Classic View'.

On the General tab, under Temporary Internet Files, click the Settings button.
Next, click on the Delete Files button
There are two options in the window to clear the cache - Leave BOTH Checked
- Applications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

NEXT

Please post a fresh DDS log and advise how the computer is running now and is there are any outstanding issues

theclarken

Post #11May 5, 2011, 10:24 PM UTC

Hello CatByte, I followed your directions and below is the dds file. Did you also need Attach.txt? For my own education, I've been reading through the various outputs that I've been posting and was wondering if you could tell me what values/programs/etc caused you to be suspicious. Also, is it normal to run each of these programs [HijackThis, aswMBR, etc] or just the normal routine to be thorough. Thanks, Dave —–BEGIN DDS.txt—– . DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 19:22:08.64 on Thu 05/05/2011 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1269 [GMT -4:00] . AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33} AV: McAfee VirusScan Enterprise *Disabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe C:\Program Files\NetLimiter 2 Monitor\nlsvc.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\NetLimiter 2 Monitor\NLClient.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\AGEIA Technologies\TrayIcon.exe C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Program Files\Quantum Digital Security\Security Toolkit\SecurityToolkit.exe C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Documents and Settings\Dave\Desktop\dds.com . ============== Pseudo HJT Report =============== . uStart Page = about:blank BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptcl.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [AGEIA PhysX SysTray] c:\program files\ageia technologies\TrayIcon.exe mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [SecurityToolkit] c:\program files\quantum digital security\security toolkit\SecurityToolkit.exe -boot mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL Trusted Zone: nih.gov\mail DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\docume~1\dave\applic~1\mozilla\firefox\profiles\d5w51t36.default\ FF - prefs.js: browser.startup.homepage - www.yahoo.com FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll . ============= SERVICES / DRIVERS =============== . R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-1-3 64288] R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2006-11-30 31944] R1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [2007-4-23 81688] R2 CinemaNow Service;CinemaNow Service;c:\program files\cinemanow\cinemanow media manager\CinemaNowSvc.exe [2009-6-23 127352] R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2007-12-23 104000] R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\vstskmgr.exe [2006-11-30 54872] R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2007-12-23 168776] R3 physX32;physX32;c:\windows\system32\drivers\physX32.sys [2008-1-9 120320] R4 CryptoDrv;CryptoDrv;c:\program files\quantum digital security\security toolkit\CryptoDrv.sys [2009-7-3 147008] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-25 136176] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-12-3 2146496] S2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\mcshield.exe [2006-11-30 144960] S3 athena;athena;c:\windows\system32\drivers\athena.sys [2006-3-20 107392] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-25 136176] S3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2007-12-23 72264] S3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2007-12-23 34152] S3 RoxMediaDB12;RoxMediaDB12;c:\program files\common files\roxio shared\12.0\sharedcom\RoxMediaDB12.exe [2009-7-24 1116656] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2011-05-04 23:29:13 ——– d—–w- c:\program files\ESET 2011-05-04 23:07:27 ——– d—–w- c:\docume~1\dave\applic~1\Malwarebytes 2011-05-04 23:07:19 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-05-04 23:07:18 ——– d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2011-05-04 23:07:16 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-05-04 23:07:16 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-05-04 22:48:14 ——– d—–w- C:\ComboFix 2011-05-04 00:42:50 ——– d-sha-r- C:\cmdcons 2011-05-04 00:41:01 98816 —-a-w- c:\windows\sed.exe 2011-05-04 00:41:01 89088 —-a-w- c:\windows\MBR.exe 2011-05-04 00:41:01 256512 —-a-w- c:\windows\PEV.exe 2011-05-04 00:41:01 161792 —-a-w- c:\windows\SWREG.exe 2011-04-30 12:07:29 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2011-04-30 12:07:28 89048 —-a-w- c:\program files\mozilla firefox\libEGL.dll 2011-04-30 12:07:28 781272 —-a-w- c:\program files\mozilla firefox\mozsqlite3.dll 2011-04-30 12:07:28 465880 —-a-w- c:\program files\mozilla firefox\libGLESv2.dll 2011-04-30 12:07:28 1974616 —-a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll 2011-04-30 12:07:28 1892184 —-a-w- c:\program files\mozilla firefox\d3dx9_42.dll 2011-04-30 12:07:28 1874904 —-a-w- c:\program files\mozilla firefox\mozjs.dll 2011-04-30 12:07:28 15832 —-a-w- c:\program files\mozilla firefox\mozalloc.dll 2011-04-29 02:06:00 ——– d—–w- c:\windows\system32\wbem\repository\FS 2011-04-29 02:06:00 ——– d—–w- c:\windows\system32\wbem\Repository . ==================== Find3M ==================== . 2011-04-29 19:59:45 252316 —-a-w- c:\windows\system32\nvdrsdb0.bin 2011-04-29 19:59:45 1 —-a-w- c:\windows\system32\nvdrssel.bin 2011-04-29 09:53:36 16432 —-a-w- c:\windows\system32\lsdelete.exe 2011-04-23 14:58:45 252316 —-a-w- c:\windows\system32\nvdrsdb1.bin 2011-03-11 14:10:38 471552 —-a-w- c:\windows\apppatch\aclayers.dll 2011-03-07 05:33:50 692736 ——w- c:\windows\system32\inetcomm.dll 2011-03-04 06:37:06 420864 —-a-w- c:\windows\system32\vbscript.dll 2011-03-03 13:21:11 1857920 —-a-w- c:\windows\system32\win32k.sys 2011-02-23 12:27:00 941160 —-a-w- c:\windows\system32\nvdispco322090.dll 2011-02-23 12:27:00 837736 —-a-w- c:\windows\system32\nvgenco322040.dll 2011-02-23 12:27:00 6398720 —-a-w- c:\windows\system32\nv4_disp.dll 2011-02-23 12:27:00 61440 —-a-w- c:\windows\system32\OpenCL.dll 2011-02-23 12:27:00 4980736 —-a-w- c:\windows\system32\nvcuda.dll 2011-02-23 12:27:00 2916968 —-a-w- c:\windows\system32\nvcuvid.dll 2011-02-23 12:27:00 2292678 —-a-w- c:\windows\system32\nvdata.bin 2011-02-23 12:27:00 2251368 —-a-w- c:\windows\system32\nvcuvenc.dll 2011-02-23 12:27:00 1958400 —-a-w- c:\windows\system32\nvapi.dll 2011-02-23 12:27:00 14671872 —-a-w- c:\windows\system32\nvoglnt.dll 2011-02-23 12:27:00 13004800 —-a-w- c:\windows\system32\nvcompiler.dll 2011-02-22 23:06:29 916480 —-a-w- c:\windows\system32\wininet.dll 2011-02-22 23:06:29 43520 ——w- c:\windows\system32\licmgr10.dll 2011-02-22 23:06:29 1469440 ——w- c:\windows\system32\inetcpl.cpl 2011-02-22 11:41:59 385024 ——w- c:\windows\system32\html.iec 2011-02-17 12:32:12 5120 —-a-w- c:\windows\system32\xpsp4res.dll 2011-02-15 12:56:39 290432 —-a-w- c:\windows\system32\atmfd.dll 2011-02-09 13:53:52 270848 ——w- c:\windows\system32\sbe.dll 2011-02-09 13:53:52 186880 ——w- c:\windows\system32\encdec.dll 2011-02-08 13:33:55 978944 ——w- c:\windows\system32\mfc42.dll 2011-02-08 13:33:55 974848 —-a-w- c:\windows\system32\mfc42u.dll . ============= FINISH: 19:22:17.57 =============== —–END DDS.txt—–

CatByte

Post #12May 5, 2011, 10:54 PM UTC

Hi

Your symptoms caused me to be suspicious so it's best to get as thorough a diagnosis as you possibly can as no one log can show everything.

Just some housekeeping to do now:

You can delete the DDS and aswMBR logs and programs from your desktop.

NEXT

Follow these steps to uninstall Combofix

Make sure your security programs are totally disabled.
Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

theclarken

Post #13May 5, 2011, 11:34 PM UTC

Hello CatByte, I have followed your directions [install/uninstall/delete/change/etc] Thanks for all of your help.

CatByte

Post #14May 5, 2011, 11:44 PM UTC

you are welcome stay safe

~CB

CatByte

Post #15May 17, 2011, 3:57 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Trojan infection usxxxxxxxx

✨ Ask AI

Ask AI