Anonymouse
Edit double post.
Spyware / Malware / Virus Removal
Slow computer, certain commands not available
18 min read
Conspire
How is it running so far after the fix?
Anonymouse
Not much change in speed, and I still don't have access to my task manager. Is there anything I can do to double check that all the Trojans have been removed and I can access everything again?
Conspire
This is what I need you to do.
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
===================================================
Re-run Malwarebytes' Anti-Malware
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.
===================================================
On your next reply please post :
SystemLook log
MBAM log
Let me know if you have any problems in performing with the steps above or any questions you may have.
Good Day!
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
- Double-click SystemLook.exe to run it.
- Copy the content of the following codebox into the main textfield:
:filefind taskmgr.exe
- Click the Look button to start the scan.
- When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
===================================================
Re-run Malwarebytes' Anti-Malware
- Double-click MalwareBytes' (Note to Vista users, please right-click and select Run as Administrator.)
- Go to Update tab to update Malwarebytes' Anti-Malware
- Then click Check for Updates.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select Perform Quick Scan, then click Scan.
- When the scan is complete, click OK, then Show Results to view the results.
- Be sure that everything is checked, and click Remove Selected.
- When completed, a log will open in Notepad. Please copy and paste the log back into your next reply
- The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt - Or via the Logs tab when Malwarebytes' Anti-Malware is started.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.
===================================================
On your next reply please post :
SystemLook log
MBAM log
Let me know if you have any problems in performing with the steps above or any questions you may have.
Good Day!
Anonymouse
SystemLook 30.07.11 by jpshortstuff
Log created at 09:10 on 07/09/2011 by Hamza
Administrator - Elevation successful
========== filefind ==========
Searching for "taskmgr.exe"
C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\taskmgr.exe –a—- 135680 bytes [00:12 14/04/2008] [00:12 14/04/2008] 2CD1C3506A85B38E2D17E61ADED175C4
C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\taskmgr.exe –a—- 135680 bytes [00:12 14/04/2008] [00:12 14/04/2008] 2CD1C3506A85B38E2D17E61ADED175C4
-= EOF =-
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7670
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
9/7/2011 9:38:49 AM
mbam-log-2011-09-07 (09-38-49).txt
Scan type: Quick scan
Objects scanned: 201845
Time elapsed: 19 minute(s), 46 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Conspire
Tell me if this fix worked.
Please follow all previous instructions regarding security programs.
Open a new Notepad session
In the notepad
This will start ComboFix again.Close all browser/windows first.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
[external image: Posted Image]
Please follow all previous instructions regarding security programs.
Open a new Notepad session
- Click the Start button, click run
- in the run box type notepad
- click ok
- In the notepad, Click "Format" and be certain that Word Wrap is not checked.
- Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE
FCopy:: C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\taskmgr.exe | C:\Windows\System32\taskmgr.exe
In the notepad
- Click File, Save as…, and set the Save in to your Desktop
- In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
- Click save
This will start ComboFix again.Close all browser/windows first.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
[external image: Posted Image]
Anonymouse
I did it and I was even able to add the windows console, but the Combofix jumped right into doing a malware scan and I still can't access task manager.
Here is the log:
ComboFix 11-09-06.03 - Hamza 09/07/2011 12:51:31.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.362 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Hamza\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((( Files Created from 2011-08-07 to 2011-09-07 )))))))))))))))))))))))))))))))
.
.
2011-09-04 00:43 . 2011-09-04 00:43 388096 —-a-r- c:\documents and settings\Hamza\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-04 00:43 . 2011-09-04 00:43 ——– d—–w- c:\program files\Trend Micro
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 23:52 . 2011-06-13 19:53 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52 . 2011-06-13 19:53 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-09-28 23:37 . 2009-09-28 23:36 3096789 —-a-w- c:\program files\YouTubeDownloaderSetup251.exe
2009-09-16 00:41 . 2009-09-16 00:34 141402440 —-a-w- c:\program files\wlsetup-all.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-06_15.21.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-07 12:40 . 2011-09-07 12:40 16384 c:\windows\Temp\Perflib_Perfdata_2d8.dat
+ 2009-05-23 01:50 . 2011-09-06 20:18 49152 c:\windows\.jagex_cache_32\runescape\jagmisc.dll
- 2009-05-23 01:50 . 2011-09-06 13:40 49152 c:\windows\.jagex_cache_32\runescape\jagmisc.dll
- 2010-05-13 14:18 . 2011-09-06 13:40 81920 c:\windows\.jagex_cache_32\runescape\hw3d.dll
+ 2010-05-13 14:18 . 2011-09-06 20:18 81920 c:\windows\.jagex_cache_32\runescape\hw3d.dll
+ 2010-02-08 16:06 . 2011-09-06 20:18 937984 c:\windows\.jagex_cache_32\runescape\sw3d.dll
- 2010-02-08 16:06 . 2011-09-06 13:40 937984 c:\windows\.jagex_cache_32\runescape\sw3d.dll
+ 2009-05-23 01:50 . 2011-09-06 20:18 137216 c:\windows\.jagex_cache_32\runescape\jaggl.dll
- 2009-05-23 01:50 . 2011-09-06 13:40 137216 c:\windows\.jagex_cache_32\runescape\jaggl.dll
- 2010-05-13 14:18 . 2011-09-06 13:40 102400 c:\windows\.jagex_cache_32\runescape\jagdx.dll
+ 2010-05-13 14:18 . 2011-09-06 20:18 102400 c:\windows\.jagex_cache_32\runescape\jagdx.dll
+ 2010-05-13 14:18 . 2011-09-06 20:18 148992 c:\windows\.jagex_cache_32\runescape\jaclib.dll
- 2010-05-13 14:18 . 2011-09-06 13:40 148992 c:\windows\.jagex_cache_32\runescape\jaclib.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security\tbZon1.dll" [2010-12-26 2735200]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
2010-12-26 21:36 2735200 —-a-w- c:\program files\ZoneAlarm_Security\tbZon1.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security\tbZon1.dll" [2010-12-26 2735200]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{91DA5E8A-3318-4F8C-B67E-5964DE3AB546}"= "c:\program files\ZoneAlarm_Security\tbZon1.dll" [2010-12-26 2735200]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\\nTune.exe" [2004-11-18 532480]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"nwiz"="nwiz.exe" [2006-06-01 1519616]
"SoundMan"="SOUNDMAN.EXE" [2005-01-11 73728]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"1utccag.exe"="c:\program files\User Time Control\utccag.exe" [2008-07-17 2158592]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2011-03-27 2071904]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 86016]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-09-02 1043968]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2010-09-02 738808]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk.disabled [2008-9-19 1527]
Privoxy.lnk.disabled [2008-9-17 829]
usb7100 Startup.lnk - c:\program files\Cordless USB Phone\Vtech Cordless Phone Suite.exe [2007-10-11 562688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-15 23:07 12536 —-a-w- c:\windows\system32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"SmartGuardian"=c:\program files\ITE\Smart Guardian\ITESmart.exe
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" /hide
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\NGM\\NGM.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/1/2008 9:05 PM 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/1/2008 9:05 PM 243152]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 7:07 PM 308136]
R2 Dynex DX-WGPDTC WLService;Dynex Wireless G Enhanced Adapter Service;c:\program files\Dynex Wireless G Enhanced Adapter\WLService.exe [9/16/2008 9:36 PM 49152]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [9/2/2010 8:26 AM 26872]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [9/2/2010 8:26 AM 493048]
S2 UserTimeControl;User Time Control service;c:\program files\User Time Control\utccsr.exe [9/1/2008 9:09 PM 1099264]
S3 iteio;iteio;\??\c:\windows\system32\drivers\iteio.sys –> c:\windows\system32\drivers\iteio.sys [?]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [5/30/2010 2:19 PM 14336]
S3 PsSdk30;PsSdk30;\??\c:\windows\system32\Drivers\PsSdk30.drv –> c:\windows\system32\Drivers\PsSdk30.drv [?]
S3 RkPavproc1;RkPavproc1;\??\c:\windows\system32\drivers\RkPavproc1.sys –> c:\windows\system32\drivers\RkPavproc1.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ssl.scroogle.org
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\documents and settings\Hamza\Application Data\Mozilla\Firefox\Profiles\vasdycly.default\
FF - prefs.js: browser.search.selectedEngine - YouTube Video Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\AVG\AVG9\Firefox
FF - Ext: ZoneAlarm Security Engine: {FFB96CC1-7EB3-449D-B827-DB661701C6BB} - c:\program files\CheckPoint\ZAForceField\TrustChecker
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - Ext: Bloody Vikings!: [removed] - %profile%\extensions\[removed]
FF - Ext: Adblock Plus Pop-up Addon: [removed] - %profile%\extensions\[removed]
FF - Ext: Enlarge your link!: [removed] - %profile%\extensions\[removed]
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: ReloadEvery: {888d99e7-e8b5-46a3-851e-1ec45da1e644} - %profile%\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-07 12:57
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk30]
"ImagePath"="\??\c:\windows\system32\Drivers\PsSdk30.drv"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(968)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(1028)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'explorer.exe'(3896)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Completion time: 2011-09-07 13:00:52
ComboFix-quarantined-files.txt 2011-09-07 17:00
ComboFix2.txt 2011-09-06 15:29
.
Pre-Run: 9,989,423,104 bytes free
Post-Run: 9,975,508,992 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 0588FA6A462663117EEE0EBEABAC2F92
Here is the log:
ComboFix 11-09-06.03 - Hamza 09/07/2011 12:51:31.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.362 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Hamza\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((( Files Created from 2011-08-07 to 2011-09-07 )))))))))))))))))))))))))))))))
.
.
2011-09-04 00:43 . 2011-09-04 00:43 388096 —-a-r- c:\documents and settings\Hamza\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-04 00:43 . 2011-09-04 00:43 ——– d—–w- c:\program files\Trend Micro
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 23:52 . 2011-06-13 19:53 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52 . 2011-06-13 19:53 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-09-28 23:37 . 2009-09-28 23:36 3096789 —-a-w- c:\program files\YouTubeDownloaderSetup251.exe
2009-09-16 00:41 . 2009-09-16 00:34 141402440 —-a-w- c:\program files\wlsetup-all.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-06_15.21.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-07 12:40 . 2011-09-07 12:40 16384 c:\windows\Temp\Perflib_Perfdata_2d8.dat
+ 2009-05-23 01:50 . 2011-09-06 20:18 49152 c:\windows\.jagex_cache_32\runescape\jagmisc.dll
- 2009-05-23 01:50 . 2011-09-06 13:40 49152 c:\windows\.jagex_cache_32\runescape\jagmisc.dll
- 2010-05-13 14:18 . 2011-09-06 13:40 81920 c:\windows\.jagex_cache_32\runescape\hw3d.dll
+ 2010-05-13 14:18 . 2011-09-06 20:18 81920 c:\windows\.jagex_cache_32\runescape\hw3d.dll
+ 2010-02-08 16:06 . 2011-09-06 20:18 937984 c:\windows\.jagex_cache_32\runescape\sw3d.dll
- 2010-02-08 16:06 . 2011-09-06 13:40 937984 c:\windows\.jagex_cache_32\runescape\sw3d.dll
+ 2009-05-23 01:50 . 2011-09-06 20:18 137216 c:\windows\.jagex_cache_32\runescape\jaggl.dll
- 2009-05-23 01:50 . 2011-09-06 13:40 137216 c:\windows\.jagex_cache_32\runescape\jaggl.dll
- 2010-05-13 14:18 . 2011-09-06 13:40 102400 c:\windows\.jagex_cache_32\runescape\jagdx.dll
+ 2010-05-13 14:18 . 2011-09-06 20:18 102400 c:\windows\.jagex_cache_32\runescape\jagdx.dll
+ 2010-05-13 14:18 . 2011-09-06 20:18 148992 c:\windows\.jagex_cache_32\runescape\jaclib.dll
- 2010-05-13 14:18 . 2011-09-06 13:40 148992 c:\windows\.jagex_cache_32\runescape\jaclib.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security\tbZon1.dll" [2010-12-26 2735200]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
2010-12-26 21:36 2735200 —-a-w- c:\program files\ZoneAlarm_Security\tbZon1.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security\tbZon1.dll" [2010-12-26 2735200]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{91DA5E8A-3318-4F8C-B67E-5964DE3AB546}"= "c:\program files\ZoneAlarm_Security\tbZon1.dll" [2010-12-26 2735200]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\\nTune.exe" [2004-11-18 532480]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"nwiz"="nwiz.exe" [2006-06-01 1519616]
"SoundMan"="SOUNDMAN.EXE" [2005-01-11 73728]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"1utccag.exe"="c:\program files\User Time Control\utccag.exe" [2008-07-17 2158592]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2011-03-27 2071904]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 86016]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-09-02 1043968]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2010-09-02 738808]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk.disabled [2008-9-19 1527]
Privoxy.lnk.disabled [2008-9-17 829]
usb7100 Startup.lnk - c:\program files\Cordless USB Phone\Vtech Cordless Phone Suite.exe [2007-10-11 562688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-15 23:07 12536 —-a-w- c:\windows\system32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"SmartGuardian"=c:\program files\ITE\Smart Guardian\ITESmart.exe
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" /hide
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\NGM\\NGM.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/1/2008 9:05 PM 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/1/2008 9:05 PM 243152]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 7:07 PM 308136]
R2 Dynex DX-WGPDTC WLService;Dynex Wireless G Enhanced Adapter Service;c:\program files\Dynex Wireless G Enhanced Adapter\WLService.exe [9/16/2008 9:36 PM 49152]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [9/2/2010 8:26 AM 26872]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [9/2/2010 8:26 AM 493048]
S2 UserTimeControl;User Time Control service;c:\program files\User Time Control\utccsr.exe [9/1/2008 9:09 PM 1099264]
S3 iteio;iteio;\??\c:\windows\system32\drivers\iteio.sys –> c:\windows\system32\drivers\iteio.sys [?]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [5/30/2010 2:19 PM 14336]
S3 PsSdk30;PsSdk30;\??\c:\windows\system32\Drivers\PsSdk30.drv –> c:\windows\system32\Drivers\PsSdk30.drv [?]
S3 RkPavproc1;RkPavproc1;\??\c:\windows\system32\drivers\RkPavproc1.sys –> c:\windows\system32\drivers\RkPavproc1.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ssl.scroogle.org
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\documents and settings\Hamza\Application Data\Mozilla\Firefox\Profiles\vasdycly.default\
FF - prefs.js: browser.search.selectedEngine - YouTube Video Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\AVG\AVG9\Firefox
FF - Ext: ZoneAlarm Security Engine: {FFB96CC1-7EB3-449D-B827-DB661701C6BB} - c:\program files\CheckPoint\ZAForceField\TrustChecker
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - Ext: Bloody Vikings!: [removed] - %profile%\extensions\[removed]
FF - Ext: Adblock Plus Pop-up Addon: [removed] - %profile%\extensions\[removed]
FF - Ext: Enlarge your link!: [removed] - %profile%\extensions\[removed]
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: ReloadEvery: {888d99e7-e8b5-46a3-851e-1ec45da1e644} - %profile%\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-07 12:57
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk30]
"ImagePath"="\??\c:\windows\system32\Drivers\PsSdk30.drv"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(968)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(1028)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'explorer.exe'(3896)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Completion time: 2011-09-07 13:00:52
ComboFix-quarantined-files.txt 2011-09-07 17:00
ComboFix2.txt 2011-09-06 15:29
.
Pre-Run: 9,989,423,104 bytes free
Post-Run: 9,975,508,992 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 0588FA6A462663117EEE0EBEABAC2F92
Conspire
Before I move on to other way I will need to check the integrity of your system files.
SFC – System File Checker Workaround
Please try this workaround (you will need your Windows® XP SP2 CD).
(In the event that you do not have a Windows® XP CD with SP2, you will need to 'borrow' one from a friend or colleague, as the manufacturer's "Recovery Discs" will not work in this instance.)
Insert the Windows® XP CD in your drive. (Hold down the Shift Key to prevent it from starting.)
Go Start > Run …in the box type in sfc /scannow …please take note of the space between the sfc and the /.
This is the System File Checker…it will scan all the Windows® core system files to ensure that they are in their respective correct places, and if not replace them from the CD.
During the scan you may be asked to Insert the CD, if this happens just go retry and let it do its thing.
One important point: While sfc is running, it is not advisable to do any other work, or have any browsers/programs running on the computer, until the scan is complete. (This process will generally take around 45-65 minutes to complete).
SFC – System File Checker Workaround
Please try this workaround (you will need your Windows® XP SP2 CD).
(In the event that you do not have a Windows® XP CD with SP2, you will need to 'borrow' one from a friend or colleague, as the manufacturer's "Recovery Discs" will not work in this instance.)
Insert the Windows® XP CD in your drive. (Hold down the Shift Key to prevent it from starting.)
Go Start > Run …in the box type in sfc /scannow …please take note of the space between the sfc and the /.
This is the System File Checker…it will scan all the Windows® core system files to ensure that they are in their respective correct places, and if not replace them from the CD.
During the scan you may be asked to Insert the CD, if this happens just go retry and let it do its thing.
One important point: While sfc is running, it is not advisable to do any other work, or have any browsers/programs running on the computer, until the scan is complete. (This process will generally take around 45-65 minutes to complete).
Anonymouse
Unfortunately I don't have it, I've moved around a lot since getting this computer. I'll try and get a hold of some friends and see if they have an extra, but if not is there no way for me to retain task manager?
Conspire
The SFC is one of the way that I could think of getting back your task manager.
We can try to replace the file manually but I need to know when you are trying to open task manager, does it say something like Task Manager has been disabled by your administrator?
Anonymouse
It just says "Windows can not find 'taskmgr" when I try and run it, and there's no message whatsoever when I try opening it with ctrl+alt+delete.
Conspire
Ok if that's the case, most likely that your task manager is missing. We will do this manually.
Get the copy from this location and grab the taskmgr.exe as bolded : C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\taskmgr.exe
Then paste the copied file to this location right after the slash : C:\Windows\System32\
Reboot once done.
Get the copy from this location and grab the taskmgr.exe as bolded : C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\taskmgr.exe
Then paste the copied file to this location right after the slash : C:\Windows\System32\
Reboot once done.
Anonymouse
It worked! I can now access it again, thank you VERY much man! You really came through for me on this whole thing.
Should I uninstall the DDS, GMER, unhooker, combofix, and delete all the logs?
Conspire
You're welcome 
We will perform a clean up procedure and this will help delete most if not all of the tools and logs we had. Go ahead and remove it if it doesn't remove the logs.
Follow these steps to uninstall Combofix
===================================================
Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.
————————————————————————————————————–
MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.
Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.
SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Hopefully this should take care of your problems! Good luck.
Do you have any questions or problems to ask? Please do not hesitate to do so.
**Please respond this one more time to ensure it is resolved and close this topic.
We will perform a clean up procedure and this will help delete most if not all of the tools and logs we had. Go ahead and remove it if it doesn't remove the logs.
Follow these steps to uninstall Combofix
- Click START then RUN
- Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.
Combofix /Uninstall[external image: Posted Image]
===================================================
Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.
————————————————————————————————————–
MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.
Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.
SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
- How Did I Get Infected In The First Place? by TonyKlein
- How to Prevent Malware by miekiemoes
- PC Safety and Security–What Do I Need?
To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
- WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an add-on available for both Firefox and IE.
- SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
- MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
- Download Host.zip and Save it to your Desktop.
- Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
- Follow the prompts and click 'Finish'.
- This will open the newly created hosts folder on your Desktop.
- Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
- Once updated you should see another prompt that the task was completed.
Hopefully this should take care of your problems! Good luck.
Do you have any questions or problems to ask? Please do not hesitate to do so.
**Please respond this one more time to ensure it is resolved and close this topic.
Anonymouse
It uninstalled combofix but not the others, so I just deleted them off my desktop which I assume means they're now gone since they're not in the program list.
Thanks for the tips! I use Firefox and have internet explorer blocked because I much prefer Firefox's security extensions like noscript, should I still be getting those updates?
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI