What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Multiple viruses on Windows XP

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Hi MagCindy,

Let's just go ahead and script this out with ComboFix.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

Folder::
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0
Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe



Then post the results log using Copy / Paste
Post #32
ComboFix 11-09-24.04 - Margaret McLeod 09/25/2011 8:16.8.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2666 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Margaret McLeod\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Total Protection Service *Enabled* {259FBE35-46BE-45F3-8F2F-4DB67BBBC614}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\13\db3550d-5fe61978
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\13\db3550d-5fe61978.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\17\37f69d1-6385c90d
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\17\37f69d1-6385c90d.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\2\49a4e0c2-226ef746
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\2\49a4e0c2-226ef746.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\30\7af2a89e-514f99af
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\30\7af2a89e-514f99af.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\35\766c55a3-48c2e0af
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\35\766c55a3-48c2e0af.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\36\84b7364-3fe04517.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\37\10906365-25ca5ead
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\37\10906365-25ca5ead.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\52\62385c74-48e7cddb
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\52\62385c74-48e7cddb.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\58\12e7273a-508b9379
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\58\12e7273a-508b9379.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\61\35a654fd-571973a7
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\61\35a654fd-571973a7.idx
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\109f8672-26bf2912.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\16d9422c-488d142a.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\20075fa8-5f1d7db7.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\2c2e4944-724e77ce.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\2c44d1e8-7c80634f.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\3f7b243d-702b18f9.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\3faeee45-444c1cda.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\40843ae8-55ede997.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\41a77c16-58bb5ed0.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\41c56d43-4cf7bbda.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\47d5b5c3-725def16.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\4801207c-19e1464a.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\63f53c90-3bf706eb.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\6bf8cb44-60dbe6d8.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\6d776b57-37c34732.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\b0fa4b3-373d42dd.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\host\fd22139-338b40fe.hst
c:\documents and settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\lastAccessed
.
.
((((((((((((((((((((((((( Files Created from 2011-08-25 to 2011-09-25 )))))))))))))))))))))))))))))))
.
.
2011-09-25 12:28 . 2011-09-25 12:28 ——– d—–w- c:\documents and settings\Margaret McLeod\Local Settings\Application Data\ApplicationHistory
2011-09-25 12:22 . 2011-09-25 12:22 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0F762C2F-5DFC-41B1-AAEC-8C3F918F5D1F}\offreg.dll
2011-09-25 01:38 . 2011-09-25 01:38 ——– d—–w- c:\program files\ESET
2011-09-25 01:30 . 2011-09-25 01:30 ——– d—–w- c:\documents and settings\Margaret McLeod\Local Settings\Application Data\Sun
2011-09-25 01:28 . 2011-09-25 01:28 ——– d—–w- c:\program files\Common Files\Java
2011-09-25 01:25 . 2011-09-25 01:25 544656 —-a-w- c:\windows\system32\deployJava1.dll
2011-09-25 01:25 . 2011-09-25 01:25 128000 —-a-w- c:\windows\system32\javacpl.cpl
2011-09-24 21:46 . 2011-09-12 23:14 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0F762C2F-5DFC-41B1-AAEC-8C3F918F5D1F}\mpengine.dll
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\c7fEL8gTZjCkVzN
2011-09-24 03:02 . 2011-09-24 03:02 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\EdWK8fRL9TwUeIt
2011-09-24 01:50 . 2011-09-24 01:50 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer
2011-09-23 01:31 . 2011-09-23 01:31 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2011-09-22 22:27 . 2011-09-22 22:27 ——– d-sh–w- c:\documents and settings\Administrator\IECompatCache
2011-09-22 22:20 . 2011-09-22 22:20 ——– d-sh–w- c:\documents and settings\David McLeod\IECompatCache
2011-09-22 22:17 . 2011-09-22 22:17 ——– d-sh–w- c:\documents and settings\Visitor\IECompatCache
2011-09-22 22:16 . 2011-09-22 22:16 ——– d—–w- c:\documents and settings\Visitor\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-09-22 21:57 . 2011-09-22 21:57 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-09-22 21:39 . 2011-09-22 21:39 ——– d—–w- c:\documents and settings\David McLeod\Application Data\Malwarebytes
2011-09-22 13:45 . 2011-09-22 13:45 1324 —-a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\d3d9caps.tmp
2011-09-21 20:22 . 2011-09-21 20:22 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2011-09-21 20:14 . 2011-09-23 00:18 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Yct
2011-09-21 20:14 . 2011-09-21 20:30 ——– d—–w- c:\documents and settings\Margaret McLeod\Application Data\Asmedem
2011-09-05 17:04 . 2011-09-05 17:04 183696 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-14 11:14 . 2011-05-16 21:17 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-12 23:14 . 2010-11-22 02:42 7269712 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-09-09 09:12 . 2004-08-11 22:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-08-31 21:00 . 2010-11-21 04:43 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-12 02:44 . 2011-08-23 06:37 7152464 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-15 13:29 . 2004-08-11 22:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-11 22:00 10496 —-a-w- c:\windows\system32\drivers\ndistapi.sys
2009-01-01 15:01 . 2009-01-01 15:00 7518240 —-a-w- c:\program files\Firefox Setup 3.0.5.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-09-24_03.37.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-25 12:22 . 2011-09-25 12:22 16384 c:\windows\temp\Perflib_Perfdata_518.dat
+ 2011-06-06 16:55 . 2011-06-06 16:55 17304 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\ViewerPS.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 35736 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\reader_sl.exe
+ 2011-06-06 16:55 . 2011-06-06 16:55 88992 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\PDFPrevHndlr.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 94608 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\eula.exe
+ 2011-06-06 16:55 . 2011-06-06 16:55 49064 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\acrotextextractor.exe
+ 2011-06-06 16:55 . 2011-06-06 16:55 17824 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AcroRd32Info.exe
+ 2011-06-06 16:55 . 2011-06-06 16:55 63912 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\acroiehelpershim.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 64928 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AcroIEHelper.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 63384 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\Acrofx32.dll
+ 2011-09-25 01:25 . 2011-09-25 01:25 214408 c:\windows\system32\javaws.exe
+ 2011-09-25 01:25 . 2011-09-25 01:25 173960 c:\windows\system32\javaw.exe
+ 2011-09-25 01:25 . 2011-09-25 01:25 173960 c:\windows\system32\java.exe
+ 2011-09-25 01:28 . 2011-09-25 01:28 176640 c:\windows\Installer\1ca0a.msi
+ 2011-09-25 01:25 . 2011-09-25 01:25 937984 c:\windows\Installer\1ca05.msi
+ 2011-06-06 16:55 . 2011-06-06 16:55 249232 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\sqlite.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 394136 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\pdfshell.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 103848 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\PDFPrevHndlrShim.exe
+ 2011-06-06 16:55 . 2011-06-06 16:55 183696 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\nppdf32.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 104344 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AiodLite.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 102808 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AcroRdIF.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 755088 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AcroPDF.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 296344 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\acrobroker.exe
+ 2011-06-06 16:55 . 2011-06-06 16:55 205720 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\a3dutils.dll
+ 2011-09-25 01:06 . 2011-09-25 01:06 2295808 c:\windows\Installer\1a1b40.msi
+ 2011-06-06 16:55 . 2011-06-06 16:55 2215312 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\rt3d.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 6543768 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\authplay.dll
+ 2011-06-06 16:55 . 2011-06-06 16:55 1240992 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AdobeCollabSync.exe
+ 2011-06-06 16:55 . 2011-06-06 16:55 1480600 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AcroRd32.exe
+ 2011-09-05 21:51 . 2011-09-05 21:51 13135872 c:\windows\Installer\1a1b41.msp
+ 2011-06-06 16:55 . 2011-06-06 16:55 24731544 c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AcroRd32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-22 16132608]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE" [2003-07-08 99840]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-01-16 181544]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2006-11-23 151552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-03-08 273544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Margaret McLeod\Start Menu\Programs\Startup\
Epson printer Registration.lnk - d:\e_reg\EpsonReg.EXE [N/A]
Password Safe.lnk - c:\program files\Password Safe\pwsafe.exe [2009-12-7 2355200]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-10 113664]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-8-26 450560]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]
TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2008-8-10 114688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-23 02:23 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
2008-08-26 23:55 20480 —-a-w- c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [1/16/2009 4:31 PM 161064]
S1 MpKsl9952cec8;MpKsl9952cec8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{F7F001FF-81B8-4AB2-9F9A-D05F6A997F2F}\MpKsl9952cec8.sys [?]
S1 MpKslb548383c;MpKslb548383c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6533F1CB-CBAD-4778-B796-2C00DBDEC7B3}\MpKslb548383c.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]
.
2011-09-25 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2011-09-25 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-25 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-25 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-16 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-09-04 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2871720974-1768929416-890385414-1008.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = localhost;*.local
Trusted Zone: intuit.com\ttlc
Trusted Zone: mcafee.com
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = [removed] [removed] [removed]
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-25 08:28
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(732)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
.
- - - - - - - > 'explorer.exe'(1208)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Completion time: 2011-09-25 08:31:38 - machine was rebooted
ComboFix-quarantined-files.txt 2011-09-25 12:31
ComboFix2.txt 2011-09-25 00:07
ComboFix3.txt 2011-09-24 21:40
ComboFix4.txt 2011-09-24 12:21
ComboFix5.txt 2011-09-25 12:15
.
Pre-Run: 707,442,290,688 bytes free
Post-Run: 707,418,898,432 bytes free
.
- - End Of File - - CA380C380CBA89B009F96E32385695C8
Post #34 last edited
No, I have Windows Essentials and run MalwareBytes and Spybot from time to time. I think McAfee was installed on the Dell when I bought it, but I thought it had been removed.
Post #35
Hi MagCindy,

Your computer appears to be clean. Let's clean up the tools we used and send you on your way.

Please delete the following programs from your desktop: DDS, GMER, aswMBR, TDSSKiller.

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

===================================================

Download TFC to your desktop
  • Open the file and close any other windows.
  • It will close all programs itself when run, make sure to let it run uninterrupted.
  • Click the Start button to begin the process. The program should not take long to finish its job
  • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean
===================================================

UPDATES
It is very important that you get all of the critical updates for your Operating System and applications. Keeping your OS and applications up to date will help make you less susceptible to attacks by Trojans and viruses.

It's a good idea to have Windows Update automatically download and install updates as they become available.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.


Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.


SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
  • How to Prevent Malware by miekiemoes
  • PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop

WOT has an add-on available for both Firefox and IE.

  • SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
  • MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Download Host.zip and Save it to your Desktop.
  • Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
  • Follow the prompts and click 'Finish'.
  • This will open the newly created hosts folder on your Desktop.
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  • Once updated you should see another prompt that the task was completed.
Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically. 

Hopefully this should take care of your problems! Good luck.

Do you have any further questions? 

**Please respond one more time to confirm your problem is resolved so I can close this thread.
Post #36
NoodleTech I have followed all of your final instructions. Should I delete or uninstall TFC? The only odd thing I have now is that Password Safe is still showing on my Taskbar. When I uninstalled in last week, I did so through Add/Remove programs. Everytime I ran ComboFix it seemed to trigger it and move it from the 'running applications' in the Taskbar to an open window. I did a little research last night and others seem to have this problem as well. It looks like I need to install a Firewall as well….any recommendations for anything that runs well with Microsoft Essentials? I REALLY appreciate your help and your diligence on helping me clean my machine. I think this is the best team on the internet!!!!!! Thank you again!
Post #37
Hi MagCindy,

Thanks for the kind words. It is my pleasure :)

You may keep TFC for future use when you need to clear temp files.

I'm not too sure about the Password Safe issue… Personally have never used it so unfortunately I cannot advise you. You can try posting the issue at the Windows Forum and see what they come up with.

As for a firewall, the built in Windows firewall is fine as long as you are using a router. I personally use the Windows firewall because it is built into the operating system and thus takes up less resources. You can follow these instructions to enable it.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI