What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Searchqu/406

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello NickM,

Did you have a problem running Combofix? The realize I ask is because that is the second run with Combofix.

Could you please tell me what the below lines say? and was there a problem when Gmer ran?

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-20 00:18
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程 。。。
.
扫描被隐藏的启动组 。。。
.
扫描被隐藏的文件 。。。
.
扫描完成
被隐藏的档案: 0
==================
Please open OTL.

  • Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, click the None button near the top (it may looked greyed out)
  • In the window under Custom Scans/Fixes copy and paste the following


    /md5start
    cdrom.sys
    tcpip.sys
    /md5stop


  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window, OTL.Txt. Please post this log.
========================
Please include in your next reply:
1. Any problem executing the instructions?
2. answers to my questions
3. OTL.Txt
4. How is the computer behaving?
Post #17
Right, here we go:

1. The only problem that I have (which has been present for quite a long time) is in scrolling up and down a page. Sometimes, it just won't move. I have just rebooted and it scrolls just fine.
2. I have no problem with Combofix. The last report that I sent to you, however, was part of a larger report which included the previous one; I hadn't uninstalled Combofix after the first scan, so I assume that they were submitted together.
Gmer? I don't recall running that.

扫描被隐藏的进程 。。。Scanning hidden processes
.
扫描被隐藏的启动组 。。。Scanning hidden startup [suite]
.
扫描被隐藏的文件 。。。Scanning hidden documents/files
.
扫描完成 Scan ended
被隐藏的档案: 0 Hidden files/archives: 0

Otherwise, my computer seems to be running normally. It now opens with an English Google homepage, without new tabs being hijacked by other, Chinese pages (usually adverts), although I am sure that the latter will happen again.
Anyway, here is the OTL text.

Thank you.

Nick
————————————————————————————————————————————————————————————————————————————

OTL logfile created on: 7/21/2011 2:13:45 AM - Run 4
OTL by OldTimer - Version 3.2.26.1 Folder = E:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.48 Gb Available Physical Memory | 74.10% Memory free
3.85 Gb Paging File | 3.35 Gb Available in Paging File | 87.16% Paging File free
Paging file location(s): E:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\WINDOWS | %ProgramFiles% = E:\Program Files
Drive C: | 58.75 Gb Total Space | 12.28 Gb Free Space | 20.91% Space Free | Partition Type: NTFS
Drive D: | 67.69 Gb Total Space | 61.46 Gb Free Space | 90.80% Space Free | Partition Type: NTFS
Drive E: | 106.44 Gb Total Space | 79.40 Gb Free Space | 74.59% Space Free | Partition Type: NTFS

Computer Name: EXPERIEN-255718 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========



< MD5 for: CDROM.SYS >
[2008/05/03 13:00:00 | 000,062,976 | —- | M] (Microsoft Corporation) MD5=0CC13B7FE6D2F64EFC82CEBFE9D2B8F0 – E:\WINDOWS\system32\drivers\cdrom.sys
[2008/04/13 19:40:46 | 000,062,976 | —- | M] (Microsoft Corporation) MD5=1F4260CC5B42272D71F79E570A27A4FE – E:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\cdrom.sys
[2009/12/22 19:39:20 | 000,062,592 | —- | M] (Microsoft Corporation) MD5=7B53584D94E9D8716B2DE91D5F1CB42D – E:\WINDOWS\system32\dllcache\cdrom.sys

< MD5 for: TCPIP.SYS >
[2008/05/03 13:00:00 | 000,361,344 | —- | M] (Microsoft Corporation) MD5=37D8387CBD4437C55F454209BE10EF11 – E:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008/06/20 12:51:12 | 000,361,600 | —- | M] (Microsoft Corporation) MD5=4AFB3B0919649F95C1964AA1FAD27D73 – E:\WINDOWS\system32\drivers\tcpip.sys
[2008/04/13 20:20:16 | 000,361,344 | —- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 – E:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\tcpip.sys
[2008/06/20 12:51:12 | 000,361,600 | —- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D – E:\WINDOWS\ERDNT\cache\tcpip.sys
[2008/06/20 12:51:12 | 000,361,600 | —- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D – E:\WINDOWS\system32\dllcache\tcpip.sys
[2008/06/20 12:59:02 | 000,361,600 | —- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E – E:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys

< End of report >
Post #18
Hello NickM,

Have you ever ran combofix on this computer prior to posting here for help?



You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
====================
NEXT

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • Re-enable your Antivirus software.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.
Please post back with the ESET log.

=================================
Please include in your next reply:
1. Any problem executing the instructions?
2. MBAM log
3. ESET log
4. How is the computer behaving?
Post #19
There was no problem executing the instructions, except that there was no "Scan unwanted applications" box to check.
I have used Combofix, before, as well as Eset, when I used a different website to rid me of a virus. More recently, however, I (stupidly) followed instructions from a website on just this topic. That website had a different modus operandi, in that several people were giving advice. I soon realised that this was not a good idea.
My computer is still reacting slowly to mouse 'instructions' (although that could be impatience on my part), and there are still Chinese pop-ups appearing, even when I am on a U.K. website. Anyway…

MBAM:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7249

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7/23/2011 10:04:40 AM
mbam-log-2011-07-23 (10-04-40).txt

Scan type: Quick scan
Objects scanned: 153512
Time elapsed: 2 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


ESET:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=4f19df213ea71a42acdecb9fd4a2c9f3
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-02-28 12:15:03
# local_time=2010-02-28 12:15:03 (+0000, GMT Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1024 16777175 100 0 34028294 34028294 0 0
# compatibility_mode=1280 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 4386 4386 0 0
# scanned=48391
# found=4
# cleaned=4
# scan_time=2753
E:\Documents and Settings\Administrator\My Documents\Downloads\exeHelper.com probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\Documents and Settings\Administrator\My Documents\LimeWire\Saved\best days of ours lives kelly (best quality).mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
E:\Documents and Settings\Administrator\My Documents\LimeWire\Saved\Geno Deys Midnight Runners.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
E:\MGtools\Process.exe Win32/PrcView application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=4f19df213ea71a42acdecb9fd4a2c9f3
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-07-23 10:03:39
# local_time=2011-07-23 11:03:39 (+0000, GMT Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 1802324 1802324 0 0
# compatibility_mode=768 16777215 100 0 27425290 27425290 0 0
# compatibility_mode=1024 16777215 100 0 27433367 27433367 0 0
# compatibility_mode=1280 16777215 100 0 0 0 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 44060889 44060889 0 0
# scanned=67095
# found=1
# cleaned=0
# scan_time=2364
E:\WINDOWS\FixCamera.exe a variant of Win32/KillProc.A application (unable to clean) 00000000000000000000000000000000 I

Thank you.

Nick
Post #20
Hello NickM,

Thank you for the explanation, We need some more scans, there seems to be something still on the computer causing these pop-ups.

Please go to one of the below sites to scan the following files:
Virus Total
jotti.org
Kaspersky Virus File Scanner

click on Browse, and upload the following file for analysis:

E:\WINDOWS\FixCamera.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.
========================
NEXT

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

FCopy::
 e:\windows\system32\dllcache\tcpip.sys | e:\windows\system32\drivers\tcpip.sys
 E:\WINDOWS\system32\dllcache\cdrom.sys | E:\WINDOWS\system32\drivers\cdrom.sys

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
======================
NEXT

Rerun aswMBR

  • Double click the aswMBR.exe icon to run it
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.
=====================
Please include in your next reply:
1. Any problem executing the instructions?
2. Virus Total log
3. Combofix log
4. aswMBR log
5. How is the computer behaving?
Post #22
Sorry about the delay: I suddenly find myself rather busy. Here is the result of the Virus Total scan: ntivirus Version Last Update Result AhnLab-V3 2011.07.28.00 2011.07.27 - AntiVir 7.11.12.134 2011.07.27 - Antiy-AVL 2.0.3.7 2011.07.27 - Avast 4.8.1351.0 2011.07.27 - Avast5 5.0.677.0 2011.07.27 - AVG 10.0.0.1190 2011.07.27 - BitDefender 7.2 2011.07.27 - CAT-QuickHeal 11.00 2011.07.27 - ClamAV 0.97.0.0 2011.07.27 - Commtouch 5.3.2.6 2011.07.27 - Comodo 9531 2011.07.27 - DrWeb 5.0.2.03300 2011.07.27 - Emsisoft 5.1.0.8 2011.07.27 - eSafe 7.0.17.0 2011.07.26 - eTrust-Vet 36.1.8467 2011.07.27 - F-Prot 4.6.2.117 2011.07.27 - F-Secure 9.0.16440.0 2011.07.27 - Fortinet 4.2.257.0 2011.07.27 - GData 22 2011.07.27 - Ikarus T3.1.1.104.0 2011.07.27 - Jiangmin 13.0.900 2011.07.26 - K7AntiVirus 9.108.4950 2011.07.26 - Kaspersky 9.0.0.837 2011.07.27 - McAfee 5.400.0.1158 2011.07.27 - McAfee-GW-Edition 2010.1D 2011.07.26 - Microsoft 1.7104 2011.07.27 - NOD32 6329 2011.07.27 a variant of Win32/KillProc.A Norman 6.07.10 2011.07.27 - nProtect 2011-07-27.01 2011.07.27 - Panda 10.0.3.5 2011.07.26 - PCTools 8.0.0.5 2011.07.27 - Prevx 3.0 2011.07.27 - Rising 23.68.02.03 2011.07.27 - Sophos 4.67.0 2011.07.27 - SUPERAntiSpyware 4.40.0.1006 2011.07.27 - Symantec 20111.1.0.186 2011.07.27 - TheHacker 6.7.0.1.263 2011.07.26 - TrendMicro 9.200.0.1012 2011.07.27 - TrendMicro-HouseCall 9.200.0.1012 2011.07.27 - VBA32 3.12.16.4 2011.07.27 - VIPRE 9980 2011.07.27 - ViRobot 2011.7.27.4591 2011.07.27 - VirusBuster 14.0.141.0 2011.07.27 - Additional information Show all MD5 : 10dd727e26acb6d0917609b55d2d625d SHA1 : d03fb2f36539640c5c3c84686cbe465e6e466316 SHA256: 0026c6d69ca84bb7460eaa2213fbf93d9fe55571c4f1c1aa5a34facb9702bee3 Jotti scan: [ArcaVir] 2011-07-27 Found nothing [F-Secure Anti-Virus] 2011-07-27 Found nothing [Avast! antivirus] 2011-07-27 Found nothing [G DATA] 2011-07-27 Found nothing [Grisoft AVG Anti-Virus] 2011-07-27 Found nothing [Ikarus] 2011-07-27 Found nothing [Avira AntiVir] 2011-07-27 Found nothing [Kaspersky Anti-Virus] 2011-07-27 Found nothing [Softwin BitDefender] 2011-07-27 Found nothing [ESET NOD32] 2011-07-27 Found nothing [ClamAV] 2011-07-27 Found nothing [Panda Antivirus] 2011-07-26 Found nothing [CPsecure] 2011-07-27 Found nothing [Quick Heal] 2011-07-27 Found nothing [Dr.Web] 2011-07-27 Found nothing [Sophos] 2011-07-27 Found nothing [Emsisoft Anti-Malware] 2011-07-27 Found nothing [VirusBlokAda VBA32] 2011-07-27 Found nothing [Frisk F-Prot Antivirus] 2011-07-26 Found nothing [VirusBuster] 2011-07-27 Found nothing There were no actual reports, as such, so I just copied/pasted them, hence the poor presentation.
Post #23
Combofix log:

ComboFix 11-07-27.01 - Administrator 7/2011 Wed 22:45:32.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.2046.1465 [GMT 1:00]
执行位置: e:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: e:\documents and settings\Administrator\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: PC Tools Firewall Plus *Disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
————— FCopy —————
.
e:\windows\system32\dllcache\tcpip.sys –> e:\windows\system32\drivers\tcpip.sys
e:\windows\system32\dllcache\cdrom.sys –> e:\windows\system32\drivers\cdrom.sys
.
((((((((((((((((((((((((( 2011-06-27 至 2011-07-27 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-07-21 08:51 . 2011-07-21 08:51 ——– d—–w- e:\windows\system32\wbem\Repository
2011-07-21 08:50 . 2011-07-21 08:50 ——– d—–w- e:\documents and settings\Administrator\Application Data\DivX
2011-07-21 06:19 . 2011-07-21 06:19 ——– d—–w- e:\documents and settings\Administrator\Application Data\ElevatedDiagnostics
2011-07-21 06:09 . 2011-07-21 08:50 ——– d—–w- e:\program files\K-Lite Codec Pack(2)
2011-07-19 00:34 . 2011-07-19 00:34 ——– d—–w- E:\_OTL
2011-07-15 23:40 . 2011-07-16 03:27 ——– d—–w- E:\desktop
2011-07-15 01:16 . 2011-07-15 01:16 404640 —-a-w- e:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-02 12:45 . 2011-07-02 12:45 ——– d—–w- e:\program files\Trend Micro
2011-07-01 20:16 . 2011-07-02 10:56 ——– d—–w- e:\documents and settings\All Users\Application Data\boost_interprocess
2011-07-01 17:15 . 2011-07-01 17:15 ——– d—–w- e:\documents and settings\Administrator\Local Settings\Application Data\PackageAware
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 18:52 . 2010-08-25 15:57 41272 —-a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 18:52 . 2010-08-25 15:57 22712 —-a-w- e:\windows\system32\drivers\mbam.sys
2011-07-04 11:43 . 2010-09-08 22:16 40112 —-a-w- e:\windows\avastSS.scr
2011-07-04 11:43 . 2010-09-08 22:16 199304 —-a-w- e:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2011-06-25 17:43 441176 —-a-w- e:\windows\system32\drivers\aswSnx.sys
2011-07-04 11:36 . 2010-09-08 22:16 309848 —-a-w- e:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2010-09-08 22:16 43608 —-a-w- e:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2010-09-08 22:16 102616 —-a-w- e:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2010-09-08 22:16 96344 —-a-w- e:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2010-09-08 22:16 25432 —-a-w- e:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2010-09-08 22:16 30808 —-a-w- e:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2010-09-08 22:16 19544 —-a-w- e:\windows\system32\drivers\aswFsBlk.sys
.
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 —-a-w- e:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="e:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-09 39408]
"BitTorrent DNA"="e:\program files\DNA\btdna.exe" [2009-11-06 323392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="e:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
"PPS Accelerator"="e:\program files\PPStream\ppsap.exe" [2010-02-24 214408]
"SUPERAntiSpyware"="e:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-07-01 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="e:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"nwiz"="nwiz.exe" [2006-08-11 1519616]
"IMJPMIG8.1"="e:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-05-03 208952]
"MSPY2002"="e:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-05-03 59392]
"PHIME2002ASync"="e:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-05-03 455168]
"PHIME2002A"="e:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-05-03 455168]
"tsnp325"="e:\windows\tsnp325.exe" [2007-04-21 270336]
"snp325"="e:\windows\vsnp325.exe" [2007-05-09 835584]
"00PCTFW"="e:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2010-01-12 3168216]
"tsnp2std"="e:\windows\tsnp2std.exe" [2006-12-05 262144]
"NvMediaCenter"="e:\windows\system32\NvMcTray.dll" [2006-08-11 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-08-14 18702336]
"Adobe ARM"="e:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"iTunesHelper"="d:\program files\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="e:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"QuickTime Task"="D:\QTTask.exe" [2010-11-29 421888]
"avast"="e:\program files\Alwil Software\Avast5\avastUI.exe" [2011-07-04 3493720]
.
e:\documents and settings\Administrator\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - e:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
e:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - d:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "e:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- e:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0220804]
Ime File REG_SZ GOOGLEPINYIN2.IME
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"YodaoDict"="d:\deskdict2\RunDict.exe" -hide
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"FixCamera"=e:\windows\FixCamera.exe
"iTunesHelper"="d:\program files\iTunesHelper.exe"
"Google Pinyin 2 Autoupdater"="e:\program files\Google\Google Pinyin 2\GooglePinyinDaemon.exe"
"NeroFilterCheck"=e:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\DNA\\btdna.exe"=
"e:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\english\\setup.exe"=
"e:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Program Files\\PPStream\\PPStream.exe"=
"e:\\Program Files\\PPStream\\PPSAP.exe"=
"e:\\Program Files\\PPSGame\\PPSGame.exe"=
"e:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program files\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 aswSnx;aswSnx;e:\windows\system32\drivers\aswSnx.sys [6/25/2011 6:43 PM 441176]
R1 aswSP;aswSP;e:\windows\system32\drivers\aswSP.sys [9/8/2010 11:16 PM 309848]
R1 pctgntdi;pctgntdi;e:\windows\system32\drivers\pctgntdi.sys [3/2/2010 5:13 PM 233136]
R1 SASDIFSV;SASDIFSV;e:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 7:25 PM 12872]
R1 SASKUTIL;SASKUTIL;e:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 7:41 PM 67656]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [9/8/2010 11:16 PM 19544]
R2 PCTAppEvent;PCTAppEvent Driver;e:\windows\system32\drivers\PCTAppEvent.sys [3/2/2010 5:13 PM 88040]
R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;e:\windows\system32\drivers\pctNdis-PacketFilter.sys [3/2/2010 5:12 PM 70664]
R3 pctNDIS;PC Tools Driver;e:\windows\system32\drivers\pctNdis.sys [3/2/2010 5:12 PM 58816]
R3 pctplfw;pctplfw;e:\windows\system32\drivers\pctplfw.sys [3/2/2010 5:12 PM 115216]
S0 qdda;qdda;e:\windows\system32\drivers\ualn.sys –> e:\windows\system32\drivers\ualn.sys [?]
S0 smfgt;smfgt;e:\windows\system32\drivers\loqem.sys –> e:\windows\system32\drivers\loqem.sys [?]
S2 gupdate1ca3fbff137535e;Google Update Service (gupdate1ca3fbff137535e);e:\program files\Google\Update\GoogleUpdate.exe [9/27/2009 11:14 PM 133104]
S3 Ambfilt;Ambfilt;e:\windows\system32\drivers\Ambfilt.sys [10/5/2010 3:25 PM 1684736]
S3 SNP325;USB PC Camera (SNPSTD325);e:\windows\system32\drivers\snp325.sys [3/3/2009 7:47 PM 10343168]
S3 ViaUsbEtsDriver;Nokia 1506 USB Device Driver;e:\windows\system32\drivers\ViaUsbEts.sys –> e:\windows\system32\drivers\ViaUsbEts.sys [?]
.
‘计划任务’ 文件夹 里的内容
.
2011-07-23 e:\windows\Tasks\AppleSoftwareUpdate.job
- e:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
2011-07-27 e:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- e:\program files\Google\Update\GoogleUpdate.exe [2009-09-27 22:14]
.
2011-07-27 e:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- e:\program files\Google\Update\GoogleUpdate.exe [2009-09-27 22:14]
.
.
——- 而外的扫描 ——-
.
uStart Page = hxxp://www.google.co.uk/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: ????(&Y)
IE: Add to Google Photos Screensa&ver - e:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
IE: Google Sidewiki… - e:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
IE: 使用迅雷下载 - e:\docume~1\ADMINI~1\LOCALS~1\Temp\Rar$EX18.516\Thunder\Program\geturl.htm
IE: 使用迅雷下载全部链接 - e:\docume~1\ADMINI~1\LOCALS~1\Temp\Rar$EX18.516\Thunder\Program\getallurl.htm
IE: 有道搜索(&Y) - d:\toolbar\ydtbv2.2\YodaoToolbar.dll/158.htm
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com
TCP: Interfaces\{99BC8365-CA5D-4372-B626-E3D75C8E53DC}: NameServer = 202.103.24.68 202.103.44.150
FF - ProfilePath - e:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\r0w7w5f6.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - e:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: avast! WebRep: [removed] - e:\program files\Alwil Software\Avast5\WebRep\FF
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-27 22:51
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程 。。。
.
扫描被隐藏的启动组 。。。
.
扫描被隐藏的文件 。。。
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1275210071-1645522239-725345543-500\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{99079A25-328F-4BD4-BE04-00955ACAA0A7}"=hex:51,66,7a,6c,4c,1d,3b,1b,35,85,17,
87,bd,63,ba,06,a2,08,43,d5,5b,8f,e1,be
"{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}"=hex:51,66,7a,6c,4c,1d,3b,1b,d5,d9,1d,
ba,e2,28,c6,01,bd,89,cc,b9,88,ea,50,0c
.
[HKEY_USERS\S-1-5-21-1275210071-1645522239-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ea,83,66,8e,97,4c,99,4c,b9,37,fa,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6c,94,48,1e,56,81,53,4d,a3,04,a7,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ea,83,66,8e,97,4c,99,4c,b9,37,fa,\
.
[HKEY_USERS\S-1-5-21-1275210071-1645522239-725345543-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F58D41D6-2C87-FDA2-A848-31A6860F7C39}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— 运行进程下的动态链接库 ———————
.
- - - - - - - > 'winlogon.exe'(1112)
e:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
- - - - - - - > 'explorer.exe'(3012)
e:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
e:\program files\Common Files\Ahead\Lib\MFC71U.DLL
e:\program files\Common Files\Ahead\Lib\BCGCBPRO860un71.dll
e:\windows\system32\ieframe.dll
e:\windows\system32\webcheck.dll
e:\windows\system32\WPDShServiceObj.dll
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
e:\windows\system32\OneX.DLL
e:\progra~1\SPYBOT~1\SDHelper.dll
e:\windows\system32\jsproxy.dll
e:\program files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
.
完成时间: 2011-07-27 22:56:14
ComboFix-quarantined-files.txt 2011-07-27 21:56
.
Pre-Run: 93,112,967,168 bytes free
Post-Run: 93,093,650,432 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CHS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\wubildr.mbr = "Ubuntu"
.
- - End Of File - - 747CB33BEA1BF41ECEBF38A8C45D1032


aswMBR log:

aswMBR version 0.9.7.753 Copyright© 2011 AVAST Software
Run date: 2011-07-27 22:57:55
—————————–
22:57:55.234 OS Version: Windows 5.1.2600 Service Pack 3
22:57:55.234 Number of processors: 2 586 0x4B02
22:57:55.234 ComputerName: EXPERIEN-255718 UserName: Administrator
22:57:55.546 Initialize success
22:57:55.781 AVAST engine defs: 11072700
22:57:59.562 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
22:57:59.578 Disk 0 Vendor: ST3250823AS 3.06 Size: 238475MB BusType: 3
22:58:01.593 Disk 0 MBR read successfully
22:58:01.593 Disk 0 MBR scan
22:58:01.593 Disk 0 Windows XP default MBR code
22:58:03.609 Disk 0 scanning sectors +488376000
22:58:03.687 Disk 0 scanning E:\WINDOWS\system32\drivers
22:58:10.109 Service scanning
22:58:11.234 Disk 0 trace - called modules:
22:58:11.250 ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
22:58:11.265 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a81fab8]
22:58:11.265 3 CLASSPNP.SYS[ba8e8fd7] -> nt!IofCallDriver -> \Device\00000070[0x8a87bf18]
22:58:11.281 5 ACPI.sys[ba77f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a811940]
22:58:11.609 AVAST engine scan E:\WINDOWS
23:09:11.984 AVAST engine scan E:\Documents and Settings\Administrator
23:14:13.750 AVAST engine scan E:\Documents and Settings\All Users
23:15:02.968 Scan finished successfully
23:15:47.718 Disk 0 MBR has been saved successfully to "E:\Documents and Settings\Administrator\Desktop\MBR.dat"
23:15:47.734 The log file has been saved successfully to "E:\Documents and Settings\Administrator\Desktop\aswMBR.txt"
Post #24
When I dragged the notepad text to Combofix, a message appeared informing me that it was "out of date", so I uninstalled then reinstalled it. Apart from that, there were no problems. There is still a problem with a delay between an instruction (e.g. clicking on a tab) and execution (that tab opening. I am quite sure that it isn't the mouse, as I also experience delays using the tab keys to scroll up and down. This does not happen every time, however. Thank you. Nick
Post #25
Hello NickM,

The problem with delays using the tab keys to scroll up and down is only with Internet Explorer? or is it with both Internet Explorer and Firefox?

Let’s check to see if you have any incompatible add-ons. This can be done by using Internet Explorer (No add-ons):

  • Click Start
  • Click All Programs
  • Click Accessories
  • Click System Tools
  • Click Internet Explorer (No add-ons)
Now all add-ons are disabled in Internet Explorer, test to see if the same problem occurs without add-ons. If the problem is fixed then the next step is to enable the add-ons one by one to find which is causing the problem.
  • Click Tools
  • Click Manage Add-ons
  • Click the first disabled add-on
  • Click Enable
  • Click Close
  • Surf a few pages
  • Close Internet Explorer
  • Open Internet Explorer
If Internet Explorer still opens/works correctly, the add-on you enabled is good to stay. Repeat the enabling process for the next disabled add-on and continue this process until the problem returns. Then the last enabled add-on will need to be disabled/uninstalled/updated to avoid further problems.

For Firefox

The following How-to guide will walk you through the procedure on How to disable or remove add-ons from the Firefox web browser.

On the top left corner of your Firefox browser window, click on the Firefox Menu button and then click on Add-ons from the Context menu. This will open up the Add-ons Manager window in a new tab on your browser.

In the Add-ons Manager window, navigate to the add-on that you want to remove or disable and then click on Disable button if you just want to disable the add-on and click on Remove button if you want the add-on to be completely removed from your browser.

If you disable an add-on, it will still be there in your browser for you to later enable it when you want the add-on sometime in the future. If you choose to remove it, then you should re-install it again in order to use it in the future.

If you are using a version of Firefox browser that is earlier than Firefox 4, then you should restart your browser in order to finish the process disabling or removing the add-ons completely from your browser. If you are using Firefox 4, then a restart of the browser is not required, but however, it happens sometimes that a restart is required even in Firefox 4 to disable or remove a specific add-on.

Let me know if this helped at all.
Post #27
I'm sorry - again - about the hiatus. I looked for the Firefox menu button, but, whatever I clicked, no 'Context menu' appeared. I therefore clicked on tools, from where I opened Add-ons. There was a section for Plugins: is that the same thing? I have disabled all of them, but the problem still exists (videos downloaded from tudou.com are also freezing a lot, too). I haven't tried too hard with IE, as I never use it. Could IE affect Firefox? Both of them regularly show a 'Program Not Responding' message in the blue border at the top. Thank you. Nick
Post #28
Hello NickM,

Sorry about all the problems your having.

Could IE affect Firefox?

No IE will not have any effect on Firefox.

Please read this on how to disable add-ons in safemode.

When I did a search on tudou.com it looks like a lot of people complaining about the videos freezing. I don't see any Malware in your logs. Lets see if disabling the add-ons will help, if not then will try something else.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI