Sunyata
Hi Andrew,
That is the ComboFix output from two days ago. We need a fresh ComboFix run after you have applied the "Fixit" fix 
Spyware / Malware / Virus Removal
Subborn Virus
23 min read
aramage
Sorry. Here is the correct log.
ComboFix 11-10-10.02 - Andrew Ramage 10/10/2011 13:40:20.23.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.760.534 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-09-10 to 2011-10-10 )))))))))))))))))))))))))))))))
.
.
2011-10-10 15:36 . 2011-10-10 19:39 ——– d—–w- c:\windows\system32\CatRoot2
2011-10-09 03:27 . 2011-10-09 03:27 ——– d—–w- c:\program files\Common Files\Java
2011-10-09 03:09 . 2011-10-09 03:09 ——– d-sh–w- c:\documents and settings\Andrew Ramage.ANDREW-IJ5SIR06\IECompatCache
2011-10-09 03:08 . 2011-10-09 03:08 ——– d-sh–w- c:\documents and settings\Andrew Ramage.ANDREW-IJ5SIR06\PrivacIE
2011-10-09 03:01 . 2011-10-09 03:01 ——– d-sh–w- c:\documents and settings\Andrew Ramage.ANDREW-IJ5SIR06\IETldCache
2011-10-09 00:52 . 2011-10-09 00:53 ——– dc-h–w- c:\windows\ie8
2011-10-09 00:49 . 2010-10-18 11:10 7680 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2011-10-09 00:49 . 2011-06-23 18:36 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2011-10-09 00:49 . 2011-06-23 18:36 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2011-10-09 00:49 . 2011-06-23 18:36 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2011-10-07 22:25 . 2010-09-18 06:53 953856 -c—-w- c:\windows\system32\dllcache\mfc40u.dll
2011-10-07 22:08 . 2010-11-02 15:17 40960 -c—-w- c:\windows\system32\dllcache\ndproxy.sys
2011-10-07 21:58 . 2011-07-08 14:02 10496 -c—-w- c:\windows\system32\dllcache\ndistapi.sys
2011-10-07 03:42 . 2008-04-14 11:42 10752 ——w- c:\windows\system32\smtpapi.dll
2011-10-07 03:41 . 2008-04-14 11:42 346112 ——w- c:\windows\system32\windowscodecsext.dll
2011-10-07 03:41 . 2008-04-14 11:42 69120 ——w- c:\windows\system32\wlanapi.dll
2011-10-07 03:41 . 2008-04-14 11:42 276992 ——w- c:\windows\system32\wmphoto.dll
2011-10-07 03:34 . 2008-04-14 11:41 33792 -c—-w- c:\windows\system32\dllcache\custsat.dll
2011-10-07 03:29 . 2008-04-14 04:06 144384 ——w- c:\windows\system32\drivers\hdaudbus.sys
2011-10-07 03:29 . 2008-04-14 06:10 10240 ——w- c:\windows\system32\drivers\sffp_mmc.sys
2011-10-07 03:27 . 2006-12-29 06:31 19569 —-a-w- c:\windows\003237_.tmp
2011-10-05 02:35 . 2011-10-05 02:35 ——– d—–w- c:\program files\ESET
2011-10-02 03:55 . 2011-10-02 03:55 ——– d–h–w- c:\windows\system32\GroupPolicy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-09 09:12 . 2001-08-23 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-08-14 16:49 . 2011-08-14 16:49 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-19 11:05 . 2010-11-30 02:44 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-07-19 08:40 . 2010-11-30 02:44 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-07-15 13:29 . 2010-04-11 21:41 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 07:16 . 2011-09-22 02:39 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-10-09_04.29.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-10-10 16:10 . 2011-10-10 16:10 16384 c:\windows\temp\Perflib_Perfdata_6e0.dat
+ 2001-08-23 12:00 . 2011-03-04 06:37 420864 c:\windows\system32\vbscript.dll
- 2001-08-23 12:00 . 2009-03-08 10:33 726528 c:\windows\system32\jscript.dll
+ 2001-08-23 12:00 . 2011-03-04 06:37 726528 c:\windows\system32\jscript.dll
+ 2011-06-18 21:29 . 2011-04-30 03:01 758784 c:\windows\system32\dllcache\vgx.dll
+ 2011-03-04 06:45 . 2011-03-04 06:37 420864 c:\windows\system32\dllcache\vbscript.dll
- 2011-03-04 06:45 . 2009-03-08 10:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2011-03-04 06:45 . 2011-03-04 06:37 726528 c:\windows\system32\dllcache\jscript.dll
+ 2011-10-10 09:01 . 2009-03-08 10:33 759296 c:\windows\ie8updates\KB2544521-IE8\vgx.dll
+ 2011-10-10 09:01 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2544521-IE8\spuninst\updspapi.dll
+ 2011-10-10 09:01 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2544521-IE8\spuninst\spuninst.exe
+ 2011-10-10 09:01 . 2009-03-08 10:33 420352 c:\windows\ie8updates\KB2510531-IE8\vbscript.dll
+ 2011-10-10 09:01 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2510531-IE8\spuninst\updspapi.dll
+ 2011-10-10 09:01 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2510531-IE8\spuninst\spuninst.exe
+ 2011-10-10 09:01 . 2009-03-08 10:33 726528 c:\windows\ie8updates\KB2510531-IE8\jscript.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Info Center"="c:\program files\PCPitstop\Info Center\InfoCenter.exe" [2011-04-22 24216]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinPatrol]
2010-05-31 11:18 323976 ——w- c:\program files\BillP Studios\WinPatrol\WinPatrol.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
S1 MpKsl5388eab0;MpKsl5388eab0;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{69D83EC0-6F0E-4801-9F53-91248124A0D1}\MpKsl5388eab0.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{69D83EC0-6F0E-4801-9F53-91248124A0D1}\MpKsl5388eab0.sys [?]
S1 MpKsl74dcf5f8;MpKsl74dcf5f8;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3ECB611D-C551-479B-9E03-8BBBD234DAC9}\MpKsl74dcf5f8.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3ECB611D-C551-479B-9E03-8BBBD234DAC9}\MpKsl74dcf5f8.sys [?]
S1 MpKsl85811009;MpKsl85811009;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{457214B0-CFF9-4A60-8651-EEAA5E051D40}\MpKsl85811009.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{457214B0-CFF9-4A60-8651-EEAA5E051D40}\MpKsl85811009.sys [?]
S1 MpKsl8b92af3e;MpKsl8b92af3e;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8A383F76-EA25-41E6-BCFF-9B9C6258733A}\MpKsl8b92af3e.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8A383F76-EA25-41E6-BCFF-9B9C6258733A}\MpKsl8b92af3e.sys [?]
S1 MpKsla49157d2;MpKsla49157d2;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ADEB441D-89B7-4BA4-A86C-30C0FD0FE2BF}\MpKsla49157d2.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ADEB441D-89B7-4BA4-A86C-30C0FD0FE2BF}\MpKsla49157d2.sys [?]
S1 MpKslbf32a495;MpKslbf32a495;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E2BA8E3F-B62C-4737-B05F-81A5D1B00BB0}\MpKslbf32a495.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E2BA8E3F-B62C-4737-B05F-81A5D1B00BB0}\MpKslbf32a495.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/5/2010 11:44 PM 135664]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/5/2010 11:44 PM 135664]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 05:44]
.
2011-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 05:44]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\Andrew Ramage.ANDREW-IJ5SIR06\Application Data\Mozilla\Firefox\Profiles\x6e2lvkn.default\
FF - prefs.js: browser.startup.homepage - www.google.ca
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-10 13:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3556)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2011-10-10 13:48:58
ComboFix-quarantined-files.txt 2011-10-10 19:48
ComboFix2.txt 2011-10-10 16:26
ComboFix3.txt 2011-10-09 04:32
ComboFix4.txt 2011-10-08 16:12
ComboFix5.txt 2011-10-10 19:39
.
Pre-Run: 41,242,791,936 bytes free
Post-Run: 41,226,752,000 bytes free
.
- - End Of File - - A30A6760AE6CA1E197CB556924D24C9B
ComboFix 11-10-10.02 - Andrew Ramage 10/10/2011 13:40:20.23.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.760.534 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-09-10 to 2011-10-10 )))))))))))))))))))))))))))))))
.
.
2011-10-10 15:36 . 2011-10-10 19:39 ——– d—–w- c:\windows\system32\CatRoot2
2011-10-09 03:27 . 2011-10-09 03:27 ——– d—–w- c:\program files\Common Files\Java
2011-10-09 03:09 . 2011-10-09 03:09 ——– d-sh–w- c:\documents and settings\Andrew Ramage.ANDREW-IJ5SIR06\IECompatCache
2011-10-09 03:08 . 2011-10-09 03:08 ——– d-sh–w- c:\documents and settings\Andrew Ramage.ANDREW-IJ5SIR06\PrivacIE
2011-10-09 03:01 . 2011-10-09 03:01 ——– d-sh–w- c:\documents and settings\Andrew Ramage.ANDREW-IJ5SIR06\IETldCache
2011-10-09 00:52 . 2011-10-09 00:53 ——– dc-h–w- c:\windows\ie8
2011-10-09 00:49 . 2010-10-18 11:10 7680 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2011-10-09 00:49 . 2011-06-23 18:36 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2011-10-09 00:49 . 2011-06-23 18:36 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2011-10-09 00:49 . 2011-06-23 18:36 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2011-10-07 22:25 . 2010-09-18 06:53 953856 -c—-w- c:\windows\system32\dllcache\mfc40u.dll
2011-10-07 22:08 . 2010-11-02 15:17 40960 -c—-w- c:\windows\system32\dllcache\ndproxy.sys
2011-10-07 21:58 . 2011-07-08 14:02 10496 -c—-w- c:\windows\system32\dllcache\ndistapi.sys
2011-10-07 03:42 . 2008-04-14 11:42 10752 ——w- c:\windows\system32\smtpapi.dll
2011-10-07 03:41 . 2008-04-14 11:42 346112 ——w- c:\windows\system32\windowscodecsext.dll
2011-10-07 03:41 . 2008-04-14 11:42 69120 ——w- c:\windows\system32\wlanapi.dll
2011-10-07 03:41 . 2008-04-14 11:42 276992 ——w- c:\windows\system32\wmphoto.dll
2011-10-07 03:34 . 2008-04-14 11:41 33792 -c—-w- c:\windows\system32\dllcache\custsat.dll
2011-10-07 03:29 . 2008-04-14 04:06 144384 ——w- c:\windows\system32\drivers\hdaudbus.sys
2011-10-07 03:29 . 2008-04-14 06:10 10240 ——w- c:\windows\system32\drivers\sffp_mmc.sys
2011-10-07 03:27 . 2006-12-29 06:31 19569 —-a-w- c:\windows\003237_.tmp
2011-10-05 02:35 . 2011-10-05 02:35 ——– d—–w- c:\program files\ESET
2011-10-02 03:55 . 2011-10-02 03:55 ——– d–h–w- c:\windows\system32\GroupPolicy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-09 09:12 . 2001-08-23 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-08-14 16:49 . 2011-08-14 16:49 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-19 11:05 . 2010-11-30 02:44 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-07-19 08:40 . 2010-11-30 02:44 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-07-15 13:29 . 2010-04-11 21:41 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 07:16 . 2011-09-22 02:39 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-10-09_04.29.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-10-10 16:10 . 2011-10-10 16:10 16384 c:\windows\temp\Perflib_Perfdata_6e0.dat
+ 2001-08-23 12:00 . 2011-03-04 06:37 420864 c:\windows\system32\vbscript.dll
- 2001-08-23 12:00 . 2009-03-08 10:33 726528 c:\windows\system32\jscript.dll
+ 2001-08-23 12:00 . 2011-03-04 06:37 726528 c:\windows\system32\jscript.dll
+ 2011-06-18 21:29 . 2011-04-30 03:01 758784 c:\windows\system32\dllcache\vgx.dll
+ 2011-03-04 06:45 . 2011-03-04 06:37 420864 c:\windows\system32\dllcache\vbscript.dll
- 2011-03-04 06:45 . 2009-03-08 10:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2011-03-04 06:45 . 2011-03-04 06:37 726528 c:\windows\system32\dllcache\jscript.dll
+ 2011-10-10 09:01 . 2009-03-08 10:33 759296 c:\windows\ie8updates\KB2544521-IE8\vgx.dll
+ 2011-10-10 09:01 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2544521-IE8\spuninst\updspapi.dll
+ 2011-10-10 09:01 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2544521-IE8\spuninst\spuninst.exe
+ 2011-10-10 09:01 . 2009-03-08 10:33 420352 c:\windows\ie8updates\KB2510531-IE8\vbscript.dll
+ 2011-10-10 09:01 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2510531-IE8\spuninst\updspapi.dll
+ 2011-10-10 09:01 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2510531-IE8\spuninst\spuninst.exe
+ 2011-10-10 09:01 . 2009-03-08 10:33 726528 c:\windows\ie8updates\KB2510531-IE8\jscript.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Info Center"="c:\program files\PCPitstop\Info Center\InfoCenter.exe" [2011-04-22 24216]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinPatrol]
2010-05-31 11:18 323976 ——w- c:\program files\BillP Studios\WinPatrol\WinPatrol.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
S1 MpKsl5388eab0;MpKsl5388eab0;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{69D83EC0-6F0E-4801-9F53-91248124A0D1}\MpKsl5388eab0.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{69D83EC0-6F0E-4801-9F53-91248124A0D1}\MpKsl5388eab0.sys [?]
S1 MpKsl74dcf5f8;MpKsl74dcf5f8;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3ECB611D-C551-479B-9E03-8BBBD234DAC9}\MpKsl74dcf5f8.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3ECB611D-C551-479B-9E03-8BBBD234DAC9}\MpKsl74dcf5f8.sys [?]
S1 MpKsl85811009;MpKsl85811009;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{457214B0-CFF9-4A60-8651-EEAA5E051D40}\MpKsl85811009.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{457214B0-CFF9-4A60-8651-EEAA5E051D40}\MpKsl85811009.sys [?]
S1 MpKsl8b92af3e;MpKsl8b92af3e;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8A383F76-EA25-41E6-BCFF-9B9C6258733A}\MpKsl8b92af3e.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8A383F76-EA25-41E6-BCFF-9B9C6258733A}\MpKsl8b92af3e.sys [?]
S1 MpKsla49157d2;MpKsla49157d2;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ADEB441D-89B7-4BA4-A86C-30C0FD0FE2BF}\MpKsla49157d2.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{ADEB441D-89B7-4BA4-A86C-30C0FD0FE2BF}\MpKsla49157d2.sys [?]
S1 MpKslbf32a495;MpKslbf32a495;\??\c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E2BA8E3F-B62C-4737-B05F-81A5D1B00BB0}\MpKslbf32a495.sys –> c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E2BA8E3F-B62C-4737-B05F-81A5D1B00BB0}\MpKslbf32a495.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/5/2010 11:44 PM 135664]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/5/2010 11:44 PM 135664]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 05:44]
.
2011-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 05:44]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\Andrew Ramage.ANDREW-IJ5SIR06\Application Data\Mozilla\Firefox\Profiles\x6e2lvkn.default\
FF - prefs.js: browser.startup.homepage - www.google.ca
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-10 13:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3556)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2011-10-10 13:48:58
ComboFix-quarantined-files.txt 2011-10-10 19:48
ComboFix2.txt 2011-10-10 16:26
ComboFix3.txt 2011-10-09 04:32
ComboFix4.txt 2011-10-08 16:12
ComboFix5.txt 2011-10-10 19:39
.
Pre-Run: 41,242,791,936 bytes free
Post-Run: 41,226,752,000 bytes free
.
- - End Of File - - A30A6760AE6CA1E197CB556924D24C9B
Sunyata
Hi Andrew,
That looks much better
It is time to clean up our tools then:
Follow these steps to uninstall Combofix
The above procedure will:
Next, Please re-enable any security that was disabled.
Don't forget to re-install Microsoft Security Essentials.
Here are a few recomendations to help keep you malware-free:
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop
WOT has an addon available for both Firefox and IE.
Only run one Anti-Virus and Firewall program.
I would suggest you read:
PC Safety and Security–What Do I Need?
How to Prevent Malware
That looks much better
It is time to clean up our tools then:
From your desktop, please delete
- logs that we created
- MBR.dat
- MBR.zip
- aswMBR.exe
Follow these steps to uninstall Combofix
- Make sure your security programs are totally disabled.
- Click START then RUN
- Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.
The above procedure will:
- Implement some cleanup procedures.
- Reset System Restore.
Next, Please re-enable any security that was disabled.
Don't forget to re-install Microsoft Security Essentials.
Here are a few recomendations to help keep you malware-free:
Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt
- Change the Download unsigned ActiveX controls to Disable
- Change the Initialize and script ActiveX controls not marked as safe to Disable
- Change the Installation of desktop items to Prompt
- Change the Launching programs and files in an IFRAME to Prompt
- Change the Navigate sub-frames across different domains to Prompt
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop
WOT has an addon available for both Firefox and IE.
Only run one Anti-Virus and Firewall program.
I would suggest you read:
PC Safety and Security–What Do I Need?
How to Prevent Malware
aramage
Hello Sunyata,
I have completed everything that was mentioned, and the computer is running 100% better. Is there anything else that I need to do?
Thanks very much,
Andrew
Sunyata
Hi Andrew,
If there are no more issues with your machine, there is nothing more to do.
You are very welcome. I'm glad we could help.
Take care and safe computing 
CatByte
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI