What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Multiple viruses on Windows XP

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
ComboFix Log - run in normal mode:

ComboFix 11-09-23.03 - Margaret McLeod 09/24/2011 8:10.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2693 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Total Protection Service *Enabled* {259FBE35-46BE-45F3-8F2F-4DB67BBBC614}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse
.
.
((((((((((((((((((((((((( Files Created from 2011-08-24 to 2011-09-24 )))))))))))))))))))))))))))))))
.
.
2011-09-24 12:17 . 2011-09-24 12:17 ——– d—–w- c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory
2011-09-24 12:16 . 2011-09-24 12:16 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\offreg.dll
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\c7fEL8gTZjCkVzN
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\EdWK8fRL9TwUeIt
2011-09-24 03:02 . 2011-09-24 03:02 28752 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys
2011-09-24 01:50 . 2011-09-24 01:50 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-09-24 01:49 . 2011-09-24 01:49 ——– d—–w- c:\windows\system32\uWK7fEL9gXjCkBz
2011-09-24 01:49 . 2011-09-24 01:49 ——– d—–w- C:\z5sWJ7fELg
2011-09-23 19:31 . 2011-09-12 23:14 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\mpengine.dll
2011-09-23 01:31 . 2011-09-23 01:31 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2011-09-22 22:27 . 2011-09-22 22:27 ——– d-sh–w- c:\documents and settings\Administrator\IECompatCache
2011-09-22 22:20 . 2011-09-22 22:20 ——– d-sh–w- c:\documents and settings\David McLeod\IECompatCache
2011-09-22 22:17 . 2011-09-22 22:17 ——– d-sh–w- c:\documents and settings\Visitor\IECompatCache
2011-09-22 22:16 . 2011-09-22 22:16 ——– d—–w- c:\documents and settings\Visitor\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-09-22 21:39 . 2011-09-22 21:39 ——– d—–w- c:\documents and settings\David McLeod\Application Data\Malwarebytes
2011-09-22 13:45 . 2011-09-22 13:45 1324 —-a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\d3d9caps.tmp
2011-09-21 20:22 . 2011-09-21 20:22 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-09-21 20:14 . 2011-09-23 00:18 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Yct
2011-09-21 20:14 . 2011-09-21 20:30 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Asmedem
2011-08-25 14:01 . 2011-09-07 00:56 ——– d—–w- c:\program files\FileZilla FTP Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-14 11:14 . 2011-05-16 21:17 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-12 23:14 . 2010-11-22 02:42 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-09-09 09:12 . 2004-08-11 22:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-08-31 21:00 . 2010-11-21 04:43 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-12 02:44 . 2011-08-23 06:37 7152464 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-15 13:29 . 2004-08-11 22:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-11 22:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2009-01-01 15:01 . 2009-01-01 15:00 7518240 —-a-w- c:\program files\Firefox Setup 3.0.5.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-24_03.37.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-24 12:16 . 2011-09-24 12:16 16384 c:\windows\temp\Perflib_Perfdata_50c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-22 16132608]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE" [2003-07-08 99840]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-18 148888]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-01-16 181544]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2006-11-23 151552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-03-08 273544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Margaret McLeod\Start Menu\Programs\Startup\
Epson printer Registration.lnk - d:\e_reg\EpsonReg.EXE [N/A]
Password Safe.lnk - c:\program files\Password Safe\pwsafe.exe [2009-12-7 2355200]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-10 113664]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-8-26 450560]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2008-8-10 114688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-23 02:23 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2008-08-26 23:55 20480 —-a-w- c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [1/16/2009 4:31 PM 161064]
S1 ikemqrcy;ikemqrcy;\??\c:\windows\system32\drivers\ikemqrcy.sys –> c:\windows\system32\drivers\ikemqrcy.sys [?]
S1 MpKsl9952cec8;MpKsl9952cec8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys [?]
S1 MpKslb548383c;MpKslb548383c;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys [9/23/2011 11:02 PM 28752]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]
.
2011-09-24 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2011-09-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-16 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost;*.local
Trusted Zone: intuit.com\ttlc
Trusted Zone: mcafee.com
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = [removed] [removed] [removed]
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-24 08:17
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(736)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
.
- - - - - - - > 'explorer.exe'(3800)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Completion time: 2011-09-24 08:21:26 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-24 12:21
ComboFix2.txt 2011-09-24 03:39
ComboFix3.txt 2010-11-21 06:50
.
Pre-Run: 708,331,945,984 bytes free
Post-Run: 708,306,763,776 bytes free
.
- - End Of File - - F77700F315FA243AC3EE3AF3D475F83D
Post #17
Hi MagCindy,

How is your computer running at the moment?

Please copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

http://forums.whatthetech.com/index.php?showtopic=120524

DirLook::
c:\windows\system32\uWK7fEL9gXjCkBz
C:\z5sWJ7fELg

Driver::
ikemqrcy

Collect::
c:\windows\system32\drivers\ikemqrcy.sys

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste
Post #18
Hi, NoodleTech,

The send/receive lights on the modem are not blinking constantly any more. The PC also does not seem to run constantly like before.

Two odd things, though….all the laptops are still getting a message from Google requiring we enter a CAPTCHA because of the number of inquiries coming from our ip address. This is not consistent, but does still seem to pop up from time to time. Also, I noticed when ComboFix ran this time, an old piece of software PWSAFE that I had removed seemed to pop up again…..Still being cautious until you tell me things look better.

Here's the latest log (ComboFix promoted me to update to the latest code which I did. It ran, rebooted and then created the log):

ComboFix 11-09-24.04 - Margaret McLeod 09/24/2011 17:29:21.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2762 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Margaret McLeod\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Total Protection Service *Enabled* {259FBE35-46BE-45F3-8F2F-4DB67BBBC614}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_ikemqrcy
.
.
((((((((((((((((((((((((( Files Created from 2011-08-24 to 2011-09-24 )))))))))))))))))))))))))))))))
.
.
2011-09-24 21:36 . 2011-09-24 21:36 ——– d—–w- c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory
2011-09-24 21:35 . 2011-09-24 21:35 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\offreg.dll
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\c7fEL8gTZjCkVzN
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\EdWK8fRL9TwUeIt
2011-09-24 03:02 . 2011-09-24 03:02 28752 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys
2011-09-24 01:50 . 2011-09-24 01:50 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-09-24 01:49 . 2011-09-24 01:49 ——– d—–w- c:\windows\system32\uWK7fEL9gXjCkBz
2011-09-24 01:49 . 2011-09-24 01:49 ——– d—–w- C:\z5sWJ7fELg
2011-09-23 19:31 . 2011-09-12 23:14 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\mpengine.dll
2011-09-23 01:31 . 2011-09-23 01:31 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2011-09-22 22:27 . 2011-09-22 22:27 ——– d-sh–w- c:\documents and settings\Administrator\IECompatCache
2011-09-22 22:20 . 2011-09-22 22:20 ——– d-sh–w- c:\documents and settings\David McLeod\IECompatCache
2011-09-22 22:17 . 2011-09-22 22:17 ——– d-sh–w- c:\documents and settings\Visitor\IECompatCache
2011-09-22 22:16 . 2011-09-22 22:16 ——– d—–w- c:\documents and settings\Visitor\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-09-22 21:39 . 2011-09-22 21:39 ——– d—–w- c:\documents and settings\David McLeod\Application Data\Malwarebytes
2011-09-22 13:45 . 2011-09-22 13:45 1324 —-a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\d3d9caps.tmp
2011-09-21 20:22 . 2011-09-21 20:22 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-09-21 20:14 . 2011-09-23 00:18 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Yct
2011-09-21 20:14 . 2011-09-21 20:30 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Asmedem
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-14 11:14 . 2011-05-16 21:17 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-12 23:14 . 2010-11-22 02:42 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-09-09 09:12 . 2004-08-11 22:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-08-31 21:00 . 2010-11-21 04:43 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-12 02:44 . 2011-08-23 06:37 7152464 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-15 13:29 . 2004-08-11 22:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-11 22:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2009-01-01 15:01 . 2009-01-01 15:00 7518240 —-a-w- c:\program files\Firefox Setup 3.0.5.exe
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\windows\system32\uWK7fEL9gXjCkBz —-
.
.
—- Directory of C:\z5sWJ7fELg —-
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-24_03.37.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-24 21:35 . 2011-09-24 21:35 16384 c:\windows\temp\Perflib_Perfdata_4c4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-22 16132608]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE" [2003-07-08 99840]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-18 148888]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-01-16 181544]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2006-11-23 151552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-03-08 273544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Margaret McLeod\Start Menu\Programs\Startup\
Epson printer Registration.lnk - d:\e_reg\EpsonReg.EXE [N/A]
Password Safe.lnk - c:\program files\Password Safe\pwsafe.exe [2009-12-7 2355200]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-10 113664]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-8-26 450560]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2008-8-10 114688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-23 02:23 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2008-08-26 23:55 20480 —-a-w- c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [1/16/2009 4:31 PM 161064]
S1 MpKsl9952cec8;MpKsl9952cec8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys [?]
S1 MpKslb548383c;MpKslb548383c;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys [9/23/2011 11:02 PM 28752]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]
.
2011-09-24 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2011-09-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-16 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost;*.local
Trusted Zone: intuit.com\ttlc
Trusted Zone: mcafee.com
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = [removed] [removed] [removed]
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-24 17:36
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(732)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
.
- - - - - - - > 'explorer.exe'(2304)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Completion time: 2011-09-24 17:40:09 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-24 21:40
ComboFix2.txt 2011-09-24 12:21
ComboFix3.txt 2011-09-24 03:39
ComboFix4.txt 2010-11-21 06:50
.
Pre-Run: 708,313,051,136 bytes free
Post-Run: 708,207,357,952 bytes free
.
- - End Of File - - E87547EBFA24BE9E4F0D483299509D0E
Post #19
Hi MagCindy,

That is a good sign. Your logs are looking good. No malware is appearing in them.

Can you take a screenshot of the "CAPTCHA" message and upload it with your next post? I'm not sure what you are talking about.

Also, where did you see the PWSAFE popup? Do you mean you see the program in the ComboFix log?

===================================================

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

Folder::
c:\windows\system32\uWK7fEL9gXjCkBz
C:\z5sWJ7fELg
Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

===================================================

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
  • Go to Start > Control Panel > Add/Remove Programs
  • Remove ALL instances of Adobe Reader
  • Re-boot your computer if required.
  • Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader
  • Make sure you uncheck Yes, install McAfee Security Scan Plus - optional.
Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.

===================================================

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 7.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the pull down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 7 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7-windows-i586.exe to install the newest version.
Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]
  • Under Temporary Internet Files, click the Settings… button
  • click the Delete Files button.
  • There are three options in the window to clear the cache - Leave all 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Settings
  • Click OK to leave the Java Control Panel.
Post #20 last edited
I am going to run your next instructions. I got the Google message and captured a screen shot which I am uploading here. The PW Safe popped up at the bottom of the screen. I had gone out and done a 'remove' from the Remove Software utility in Windows before I contacted you. I just thought it odd that it appeared again. No, it did not show up in the log.[attachment removed]
Post #21
When ComboFix started to run, that's when the Password Safe showed up in the Task Bar.

I pasted the Google captcha in the previous message..

Here is the latest ComboFix log:

ComboFix 11-09-24.04 - Margaret McLeod 09/24/2011 19:56:11.7.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2590 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Margaret McLeod\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Total Protection Service *Enabled* {259FBE35-46BE-45F3-8F2F-4DB67BBBC614}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse
c:\windows\system32\uWK7fEL9gXjCkBz
C:\z5sWJ7fELg
.
.
((((((((((((((((((((((((( Files Created from 2011-08-25 to 2011-09-25 )))))))))))))))))))))))))))))))
.
.
2011-09-25 00:04 . 2011-09-25 00:04 ——– d—–w- c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory
2011-09-25 00:00 . 2011-09-25 00:00 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0F762C2F-5DFC-41B1-AAEC-8C3F918F5D1F}\offreg.dll
2011-09-24 21:46 . 2011-09-12 23:14 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0F762C2F-5DFC-41B1-AAEC-8C3F918F5D1F}\mpengine.dll
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\c7fEL8gTZjCkVzN
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\EdWK8fRL9TwUeIt
2011-09-24 01:50 . 2011-09-24 01:50 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-09-23 01:31 . 2011-09-23 01:31 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2011-09-22 22:27 . 2011-09-22 22:27 ——– d-sh–w- c:\documents and settings\Administrator\IECompatCache
2011-09-22 22:20 . 2011-09-22 22:20 ——– d-sh–w- c:\documents and settings\David McLeod\IECompatCache
2011-09-22 22:17 . 2011-09-22 22:17 ——– d-sh–w- c:\documents and settings\Visitor\IECompatCache
2011-09-22 22:16 . 2011-09-22 22:16 ——– d—–w- c:\documents and settings\Visitor\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-09-22 21:39 . 2011-09-22 21:39 ——– d—–w- c:\documents and settings\David McLeod\Application Data\Malwarebytes
2011-09-22 13:45 . 2011-09-22 13:45 1324 —-a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\d3d9caps.tmp
2011-09-21 20:22 . 2011-09-21 20:22 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-09-21 20:14 . 2011-09-23 00:18 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Yct
2011-09-21 20:14 . 2011-09-21 20:30 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Asmedem
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-14 11:14 . 2011-05-16 21:17 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-12 23:14 . 2010-11-22 02:42 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-09-09 09:12 . 2004-08-11 22:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-08-31 21:00 . 2010-11-21 04:43 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-12 02:44 . 2011-08-23 06:37 7152464 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-15 13:29 . 2004-08-11 22:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-11 22:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2009-01-01 15:01 . 2009-01-01 15:00 7518240 —-a-w- c:\program files\Firefox Setup 3.0.5.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-24_03.37.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-25 00:01 . 2011-09-25 00:01 16384 c:\windows\temp\Perflib_Perfdata_4b0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-22 16132608]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE" [2003-07-08 99840]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-18 148888]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-01-16 181544]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2006-11-23 151552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-03-08 273544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Margaret McLeod\Start Menu\Programs\Startup\
Epson printer Registration.lnk - d:\e_reg\EpsonReg.EXE [N/A]
Password Safe.lnk - c:\program files\Password Safe\pwsafe.exe [2009-12-7 2355200]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-10 113664]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-8-26 450560]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2008-8-10 114688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-23 02:23 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2008-08-26 23:55 20480 —-a-w- c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [1/16/2009 4:31 PM 161064]
S1 MpKsl9952cec8;MpKsl9952cec8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys [?]
S1 MpKslb548383c;MpKslb548383c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]
.
2011-09-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2011-09-25 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-25 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-25 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-16 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost;*.local
Trusted Zone: intuit.com\ttlc
Trusted Zone: mcafee.com
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = [removed] [removed] [removed]
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-24 20:04
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(732)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
.
- - - - - - - > 'explorer.exe'(116)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Completion time: 2011-09-24 20:07:46 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-25 00:07
ComboFix2.txt 2011-09-24 21:40
ComboFix3.txt 2011-09-24 12:21
ComboFix4.txt 2011-09-24 03:39
ComboFix5.txt 2011-09-24 23:55
.
Pre-Run: 708,164,853,760 bytes free
Post-Run: 708,149,354,496 bytes free
.
- - End Of File - - 1C74D98AD22DF78B3DB8CF824D81313C
Post #22
Hi MagCindy,

I removed your attachment because it was exposing your IP address. I did some research on this Google issue and it seems like the issue affects people on specific ISPs. Although it is coincidental that you are getting this after having had some nasty malware on your computer…

In any case, I wouldn't worry too much about the warning. See if it disappears over the course of a few weeks, otherwise you can post a thread over at the Google forums. They will know more about the issue as I have seen quite a few threads related to it over there.

Have you updated Java and Adobe yet? It is important that you do because you had a few Java exploits/infections lurking on your system.

Before I give you the all clear, I need you to update and run a quick scan with MalwareBytes again.

Please run Malwarebytes' Anti-Malware.
  • Click the Update tab, then click Check for Updates.
  • If an update is found, it will download and install the latest version.
  • Next, click Scanner, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
===================================================

I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start.  The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button.  The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.
Post #23
I did not see an option to prevent the installation of McAffee Security Scan Plus…… For Java, I was not sure which Windows platform to choose: Windows x86 Online 0.85 MB jre-7-windows-i586-iftw.exe Windows x86 Offline 19.26 MB jre-7-windows-i586.exe Windows x64 20.34 MB jre-7-windows-x64.exe .
Post #25
I followed the instructions you gave, but it looks like there may still be something in Java Cache…..Here are the two logs you requested.

Malware Bytes:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7793

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

9/24/2011 9:35:12 PM
mbam-log-2011-09-24 (21-35-12).txt

Scan type: Quick scan
Objects scanned: 238971
Time elapsed: 2 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)




Eset log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=66508c6881d9354ba5d5d9b515ff6c1c
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-25 02:12:17
# local_time=2011-09-24 10:12:17 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 72900811 72900811 0 0
# compatibility_mode=1024 16777215 100 0 29906666 29906666 0 0
# compatibility_mode=5891 16776869 42 87 0 20673102 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=106038
# found=2
# cleaned=0
# scan_time=1870
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\35\766c55a3-48c2e0af a variant of Win32/Kryptik.TDW trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\0.10867668676404774.exe.vir a variant of Win32/Kryptik.TDW trojan (unable to clean) 00000000000000000000000000000000 I
Post #29
I am running the online ESET scanner… Should I be downloading instead? I do not see a button for 'install', but there is a download. So far, it has found one occurrance again….will post the log when complete.
Post #30
I tried to remove all three options when cleaning out Java cache, but all but the first were greyed out and I could not select them.

Here is the second log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=66508c6881d9354ba5d5d9b515ff6c1c
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-25 02:12:17
# local_time=2011-09-24 10:12:17 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 72900811 72900811 0 0
# compatibility_mode=1024 16777215 100 0 29906666 29906666 0 0
# compatibility_mode=5891 16776869 42 87 0 20673102 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=106038
# found=2
# cleaned=0
# scan_time=1870
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\35\766c55a3-48c2e0af a variant of Win32/Kryptik.TDW trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\0.10867668676404774.exe.vir a variant of Win32/Kryptik.TDW trojan (unable to clean) 00000000000000000000000000000000 I
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=66508c6881d9354ba5d5d9b515ff6c1c
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-25 03:50:46
# local_time=2011-09-24 11:50:46 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 72906722 72906722 0 0
# compatibility_mode=1024 16777215 100 0 29912577 29912577 0 0
# compatibility_mode=5891 16776869 42 87 0 20679013 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=105437
# found=2
# cleaned=0
# scan_time=1870
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\35\766c55a3-48c2e0af a variant of Win32/Kryptik.TDW trojan (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\0.10867668676404774.exe.vir a variant of Win32/Kryptik.TDW trojan (unable to clean) 00000000000000000000000000000000 I

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI