Spyware / Malware / Virus Removal

Ping.exe / NetBT.sys Infection

18 min read

Looking for the outcome? Ask AI

ent Topic Starter

Post #1November 21, 2011, 9:47 PM UTC

I was infected with the same ping.exe / netbt.sys virus that so many are reporting. I've tried to cure it on my own with virus scanning, etc., but I'm sure there are still traces lurking. The last thing I did was to restore NetBT.sys and associated registry entries from another similar XP machine. This got me back on the Internet. The main thing that I'm noticing now is that something periodically shuts down AVG and Windows Defender. I'm afraid to run Firefox / IE because I think they might be what trigger it. I've installed Safari for a possibly safer alternative. I just downloaded OTL per your forum instructions and AVG identified it as a virus threat. Presumably a false positive, but at this point, I can't trust anything. So below are my DDS results instead. I've uploaded Attach.txt per DDS's instructions. By the way, I also have Spybot installed but it's not memory resident. I only run it occasionlly at times like this. I can uninstall if I must, but if it's not memory-resident, it should not interfere with other security software, right? Currently, scans by AVG, Windows Defender, MBAM, and Spybot are turning up no malware detections. Thanks! ———————————————————————- . DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 14:37:27.35 on Mon 11/21/2011 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_29 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.212 [GMT -6:00] . AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe C:\Program Files\Logitech\SetPointP\SetPoint.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE C:\Program Files\Dell Support\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe C:\Program Files\CapsUnlock\CapsUnlock.exe C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe C:\Program Files\AVG\AVG2012\avgwdsvc.exe C:\Program Files\AVG\AVG2012\avgnsx.exe C:\Program Files\AVG\AVG2012\avgrsx.exe C:\Program Files\AVG\AVG2012\avgcsrvx.exe C:\Program Files\AVG\AVG2012\avgui.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Safari\Safari.exe C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\TEXTPA~1\TextPad.exe C:\Documents and Settings\Bill Entwistle\Desktop\dds.scr . ============== Pseudo HJT Report =============== . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = ;*.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\bill entwistle\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [MusicManager] "c:\documents and settings\bill entwistle\local settings\application data\programs\google\musicmanager\MusicManager.exe" mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\Iaanotif.exe mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe" mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe" mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide StartupFolder: c:\docume~1\billen~1\startm~1\programs\startup\capsun~1.lnk - c:\program files\capsunlock\CapsUnlock.exe StartupFolder: c:\docume~1\billen~1\startm~1\programs\startup\flasht~1.lnk - c:\program files\flashtray pro\FlashTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\microt~1.lnk - c:\program files\microtek\scanwizard 5\ScannerFinder.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: internet Trusted Zone: netflix.com\www Trusted Zone: pandora.com DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1307775913765 DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177138576847 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177467272937 DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll Notify: igfxcui - igfxdev.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\program files\eudora\EuShlExt.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll mASetup: {621FCD24-4498-4324-A81E-07D331376EDF} - c:\program files\pixiepack codec pack\InstallerHelper.exe . ================= FIREFOX =================== . FF - ProfilePath - c:\docume~1\billen~1\applic~1\mozilla\firefox\profiles\6xnqpoll.default\ FF - prefs.js: browser.startup.homepage - about:blank FF - plugin: c:\documents and settings\bill entwistle\application data\facebook\npfbplugin_1_0_1.dll FF - plugin: c:\documents and settings\bill entwistle\application data\facebook\npfbplugin_1_0_3.dll FF - plugin: c:\documents and settings\bill entwistle\local settings\application data\google\update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248] R1 mfehidk;mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-1-16 213640] R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248] R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776] R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-9-25 189736] R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2011-5-16 10448] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134608] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720] S2 0258161238559076mcinstcleanup;0258161238559076mcinstcleanup; [x] S2 0327391238561196mcinstcleanup;0327391238561196mcinstcleanup; [x] S2 winmgmt32;Windows Management Instrumentation ;c:\windows\system32\msacm32.exe –> c:\windows\system32\msacm32.exe [?] S3 LW;LW;c:\docume~1\billen~1\locals~1\temp\lw.exe –> c:\docume~1\billen~1\locals~1\temp\LW.exe [?] S3 mferkdk;mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-3-30 34216] S3 notecable;NoteCable Driver (WDM);c:\windows\system32\drivers\notcable.sys –> c:\windows\system32\drivers\notcable.sys [?] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520] . =============== File Associations =============== . .txt=TextPad.txt . =============== Created Last 30 ================ . 2011-11-21 19:48:32 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-11-21 19:45:01 56200 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\{37e2011d-89ef-4a60-a709-f6a0637496a5}\offreg.dll 2011-11-21 08:21:27 2321288 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\backup\mpengine.dll 2011-11-21 08:21:15 6668624 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\windows defender\definition updates\{37e2011d-89ef-4a60-a709-f6a0637496a5}\mpengine.dll 2011-11-20 21:22:56 ——– d–h–w- C:\$AVG 2011-11-20 20:59:11 ——– d—–w- c:\docume~1\billen~1\applic~1\AVG2012 2011-11-20 20:57:56 ——– d–h–w- c:\docume~1\alluse~1\applic~1\Common Files 2011-11-20 20:56:18 ——– d—–w- c:\windows\system32\drivers\AVG 2011-11-20 20:56:18 ——– d—–w- c:\docume~1\alluse~1\applic~1\AVG2012 2011-11-20 20:55:04 ——– d—–w- c:\program files\AVG 2011-11-20 20:50:28 ——– d—–w- c:\docume~1\alluse~1\applic~1\MFAData 2011-11-20 20:39:55 ——– d—–w- c:\program files\Bonjour 2011-11-20 19:05:40 ——– d—–w- c:\program files\6A1DD 2011-11-20 19:05:04 ——– d—–w- c:\docume~1\billen~1\applic~1\14A6A 2011-11-20 19:05:03 ——– d—–w- c:\program files\LP 2011-11-20 19:04:45 ——– d—–w- c:\docume~1\billen~1\applic~1\Y0uuccS2ibF3nGa 2011-11-20 19:04:45 ——– d—–w- c:\docume~1\billen~1\applic~1\Q666dWWK8fR9hX 2011-11-20 19:04:36 ——– d—–w- c:\docume~1\billen~1\applic~1\adWWKK7fRL9hXqU 2011-11-20 19:04:35 ——– d—–w- c:\docume~1\billen~1\applic~1\V7ddEEK8g 2011-11-20 18:45:24 ——– d—–w- c:\program files\CyberFOX Software . ==================== Find3M ==================== . 2011-11-20 19:23:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-10-10 14:22:41 692736 —-a-w- c:\windows\system32\inetcomm.dll 2011-10-05 23:56:42 60304 ——w- c:\documents and settings\bill entwistle\g2mdlhlpx.exe 2011-10-03 11:06:03 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-10-03 08:37:52 73728 —-a-w- c:\windows\system32\javacpl.cpl 2011-09-28 07:06:50 599040 —-a-w- c:\windows\system32\crypt32.dll 2011-09-26 16:41:20 611328 ——w- c:\windows\system32\uiautomationcore.dll 2011-09-26 16:41:20 220160 —-a-w- c:\windows\system32\oleacc.dll 2011-09-26 16:41:14 20480 —-a-w- c:\windows\system32\oleaccrc.dll 2011-09-06 13:20:51 1858944 —-a-w- c:\windows\system32\win32k.sys 2011-08-31 05:05:04 83816 —-a-w- c:\windows\system32\dns-sd.exe 2011-08-31 05:05:04 73064 —-a-w- c:\windows\system32\dnssd.dll 2011-08-31 05:05:04 178536 —-a-w- c:\windows\system32\dnssdX.dll . ============= FINISH: 14:38:42.85 ===============

Attachments:

📎Attach.txt

NoodleTech

Post #2November 22, 2011, 5:34 PM UTC

Hi ent,

My name is NoodleTech. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Do not delete anything unless instructed to.
DO NOT use tools such as ComboFix without supervision.
Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Note to Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
These tools MUST be run With Admin Rights (Right click, choose "Run as Administrator")

===================================================

Spybot is pretty much obsolete nowadays so you can go ahead and uninstall it because it actually interferes with the programs we use. Let's see what we can dig up.

===================================================

Download aswMBR.exe ( 1.8mb ) to your desktop.

Double click the aswMBR.exe to run it.

When prompted to download the latest aswMBR definitions, click NO.

[external image: Posted Image]
Click the "Scan" button to start scan.

[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply.

===================================================

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

ent

Post #3November 22, 2011, 9:26 PM UTC

I uninstalled Spybot. The scans are below/attached. By the way, I discovered that it's hybernating, then un-hybernating that triggers a resurgence of virus detections. Thanks! ———- aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-11-22 13:49:05 —————————– 13:49:05.593 OS Version: Windows 5.1.2600 Service Pack 3 13:49:05.593 Number of processors: 2 586 0x605 13:49:05.593 ComputerName: TUCKER UserName: 13:49:14.296 Initialize success 13:49:53.000 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 13:49:53.000 Disk 0 Vendor: ST316081 3.AD Size: 152587MB BusType: 3 13:49:53.015 Disk 0 MBR read successfully 13:49:53.015 Disk 0 MBR scan 13:49:53.015 Disk 0 unknown MBR code 13:49:53.015 Disk 0 scanning sectors +312496380 13:49:53.093 Disk 0 scanning C:\WINDOWS\system32\drivers 13:50:00.468 Service scanning 13:50:01.484 Modules scanning 13:50:05.343 Disk 0 trace - called modules: 13:50:05.359 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 13:50:05.359 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86d79030] 13:50:05.359 3 CLASSPNP.SYS[f7530fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86d60030] 13:50:05.359 Scan finished successfully 13:50:23.640 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Bill Entwistle\Desktop\MBR.dat" 13:50:23.656 The log file has been saved successfully to "C:\Documents and Settings\Bill Entwistle\Desktop\aswMBR.txt" aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-11-22 13:55:55 —————————– 13:55:55.765 OS Version: Windows 5.1.2600 Service Pack 3 13:55:55.765 Number of processors: 2 586 0x605 13:55:55.765 ComputerName: TUCKER UserName: 13:55:56.078 Initialize success 13:56:01.453 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 13:56:01.453 Disk 0 Vendor: ST316081 3.AD Size: 152587MB BusType: 3 13:56:01.468 Disk 0 MBR read successfully 13:56:01.468 Disk 0 MBR scan 13:56:01.468 Disk 0 unknown MBR code 13:56:01.468 Disk 0 scanning sectors +312496380 13:56:01.546 Disk 0 scanning C:\WINDOWS\system32\drivers 13:56:07.187 Service scanning 13:56:08.109 Modules scanning 13:56:11.437 Disk 0 trace - called modules: 13:56:11.453 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 13:56:11.453 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86d79030] 13:56:11.453 3 CLASSPNP.SYS[f7530fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86d60030] 13:56:11.453 Scan finished successfully 13:56:27.093 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Bill Entwistle\Desktop\MBR.dat" 13:56:27.093 The log file has been saved successfully to "C:\Documents and Settings\Bill Entwistle\Desktop\aswMBR.txt"

Attachments:

📎Gmer.txt

NoodleTech

Post #4November 22, 2011, 9:59 PM UTC

Hi ent,

Please download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.
Accept the disclaimer and allow to update if it asks

[external image: Posted Image]

[external image: Posted Image]
When finished, it shall produce a log for you.
Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

ent

Post #5November 22, 2011, 11:31 PM UTC

That was confusing, but I have a log file. Combofix said that it found a RootKit.ZeroAccess infection that involved the tcp/ip stack. It required a reboot, then continued running over an empty desktop, then (I think) rebooted again, and continued running to produce the log. But in the process, I got virus detections from AVG claiming that these were malware:

c:\combofix'cf17789.3xe
c:\combofix\nircmd.3xe

I ignored these, on the assumption that they were a necessary part of combofix. When it was done generating the log, I got another virus detection in:

c:\combofix\handle.3xe

Since the log was successfully generated, I quarantined this one just in case. I hope these were acceptable decisions!

———-

ComboFix 11-11-22.01 - Bill Entwistle 11/22/2011 17:01:23.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.552 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Bill Entwistle\Desktop\Security Center.lnk
c:\documents and settings\Bill Entwistle\g2mdlhlpx.exe
c:\program files\LP
c:\program files\LP\CFC1\1CA5.tmp
c:\program files\LP\CFC1\1CA6.tmp
c:\program files\LP\CFC1\1CA7.tmp
c:\windows\$NtUninstallKB55870$
c:\windows\$NtUninstallKB55870$\2947235887
c:\windows\$NtUninstallKB55870$\4119146427\@
c:\windows\$NtUninstallKB55870$\4119146427\bckfg.tmp
c:\windows\$NtUninstallKB55870$\4119146427\cfg.ini
c:\windows\$NtUninstallKB55870$\4119146427\Desktop.ini
c:\windows\$NtUninstallKB55870$\4119146427\keywords
c:\windows\$NtUninstallKB55870$\4119146427\kwrd.dll
c:\windows\$NtUninstallKB55870$\4119146427\L\iahonoel
c:\windows\$NtUninstallKB55870$\4119146427\lsflt7.ver
c:\windows\$NtUninstallKB55870$\4119146427\U\00000001.@
c:\windows\$NtUninstallKB55870$\4119146427\U\00000002.@
c:\windows\$NtUninstallKB55870$\4119146427\U\00000004.@
c:\windows\$NtUninstallKB55870$\4119146427\U\80000000.@
c:\windows\$NtUninstallKB55870$\4119146427\U\80000004.@
c:\windows\$NtUninstallKB55870$\4119146427\U\80000032.@
c:\windows\CSC\d6
.
.
((((((((((((((((((((((((( Files Created from 2011-10-22 to 2011-11-22 )))))))))))))))))))))))))))))))
.
.
2011-11-22 19:48 . 2011-10-18 07:28 6668624 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{D7598BAA-21B9-447D-8437-1655871CB5D5}\mpengine.dll
2011-11-22 19:06 . 2011-11-22 19:11 ——– d—–w- C:\ad50495e293c0ecf77207ce935a5
2011-11-21 08:21 . 2011-10-18 07:28 6668624 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-11-21 08:20 . 2011-11-21 08:20 ——– d—–w- c:\program files\Windows Defender
2011-11-20 22:32 . 2011-11-20 22:32 ——– d—–w- c:\program files\Safari
2011-11-20 21:22 . 2011-11-20 21:22 ——– d—–w- C:\$AVG
2011-11-20 20:59 . 2011-11-20 20:59 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\AVG2012
2011-11-20 20:57 . 2011-11-20 20:57 ——– d–h–w- c:\documents and settings\All Users\Application Data\Common Files
2011-11-20 20:56 . 2011-11-22 18:57 ——– d—–w- c:\windows\system32\drivers\AVG
2011-11-20 20:56 . 2011-11-20 21:12 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG2012
2011-11-20 20:55 . 2011-11-20 20:55 ——– d—–w- c:\program files\AVG
2011-11-20 20:50 . 2011-11-22 18:58 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-11-20 20:39 . 2011-11-20 20:39 ——– d—–w- c:\program files\Bonjour
2011-11-20 20:34 . 2011-11-20 20:34 ——– d—–w- c:\program files\Apple Software Update
2011-11-20 20:31 . 2011-11-20 20:31 ——– d—–w- c:\program files\Common Files\Java
2011-11-20 19:05 . 2011-11-20 19:17 ——– d—–w- c:\program files\6A1DD
2011-11-20 19:05 . 2011-11-20 19:05 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\14A6A
2011-11-20 19:04 . 2011-11-20 19:04 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\Y0uuccS2ibF3nGa
2011-11-20 19:04 . 2011-11-20 19:04 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\Q666dWWK8fR9hX
2011-11-20 19:04 . 2011-11-20 19:04 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\adWWKK7fRL9hXqU
2011-11-20 19:04 . 2011-11-20 19:04 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\V7ddEEK8g
2011-11-20 18:45 . 2011-11-20 18:45 ——– d—–w- c:\program files\CyberFOX Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-20 23:37 . 2004-08-11 21:00 162816 —-a-w- c:\windows\system32\drivers\netbt.sys
2011-11-20 19:23 . 2011-06-09 03:15 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2004-08-11 21:12 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-10-07 12:23 . 2011-10-07 12:23 230608 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 12:21 . 2011-10-04 12:21 16720 —-a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-10-03 11:06 . 2011-03-10 09:13 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-03 08:37 . 2011-03-10 09:16 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-09-28 07:06 . 2004-08-11 21:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-26 16:41 . 2008-07-30 00:59 611328 ——w- c:\windows\system32\uiautomationcore.dll
2011-09-26 16:41 . 2004-08-11 21:00 220160 —-a-w- c:\windows\system32\oleacc.dll
2011-09-26 16:41 . 2004-08-11 21:00 20480 —-a-w- c:\windows\system32\oleaccrc.dll
2011-09-13 12:30 . 2011-09-13 12:30 32592 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-09-06 13:20 . 2004-08-11 21:00 1858944 —-a-w- c:\windows\system32\win32k.sys
2011-08-31 22:00 . 2011-07-16 19:47 22216 ——w- c:\windows\system32\drivers\mbam.sys
2011-08-31 05:05 . 2011-08-31 05:05 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-08-31 05:05 . 2011-08-31 05:05 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-08-31 05:05 . 2011-08-31 05:05 178536 —-a-w- c:\windows\system32\dnssdX.dll
2011-11-09 16:02 . 2011-07-04 00:05 134104 ——w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 68856]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"MusicManager"="c:\documents and settings\Bill Entwistle\Local Settings\Application Data\Programs\Google\MusicManager\MusicManager.exe" [2011-11-12 13222400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 282624]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\common~1\instal~1\update~1\isuspm.exe" [2004-07-27 221184]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-10-17 1197648]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-10-25 2415456]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Uninstall LastPass RunOnce.lnk - c:\documents and settings\Administrator\Application Data\lpuninstall.exe [2011-4-3 9319112]
.
c:\documents and settings\Bill Entwistle\Start Menu\Programs\Startup\
CapsUnlock.lnk - c:\program files\CapsUnlock\CapsUnlock.exe [2007-4-24 13312]
FlashTray.lnk - c:\program files\FlashTray Pro\FlashTray.exe [N/A]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Microtek Scanner Finder.lnk - c:\program files\Microtek\ScanWizard 5\ScannerFinder.exe [2008-1-14 344064]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Eudora\EuShlExt.dll" [2006-08-17 86016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ——w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"g:\\WS FTP\\WS_FTP95.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\TeraTerm\\ttermpro.exe"=
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
"c:\\Program Files\\Seagate\\SeagateManager\\FreeAgent Status\\stxmenumgr.exe"=
"c:\\Program Files\\Dell Support\\DSAgnt.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [7/11/2011 1:14 AM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/13/2011 6:30 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/7/2011 6:23 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 1:14 AM 295248]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [10/12/2011 6:25 AM 4433248]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 11:32 PM 189736]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [5/16/2011 10:12 PM 10448]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [7/11/2011 1:14 AM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [7/11/2011 1:14 AM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [10/4/2011 6:21 AM 16720]
S2 0258161238559076mcinstcleanup;0258161238559076mcinstcleanup; [x]
S2 0327391238561196mcinstcleanup;0327391238561196mcinstcleanup; [x]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S2 winmgmt32;Windows Management Instrumentation ;c:\windows\system32\msacm32.exe –> c:\windows\system32\msacm32.exe [?]
S3 LW;LW;c:\docume~1\BILLEN~1\LOCALS~1\Temp\LW.exe –> c:\docume~1\BILLEN~1\LOCALS~1\Temp\LW.exe [?]
S3 notecable;NoteCable Driver (WDM);c:\windows\system32\drivers\notcable.sys –> c:\windows\system32\drivers\notcable.sys [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 16:32 7680 ——w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 23:57]
.
2011-11-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3238264531-3539326320-3744746308-1005Core1cc945bae023cbe.job
- c:\documents and settings\Bill Entwistle\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-19 04:43]
.
2011-11-22 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-30 03:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: internet
Trusted Zone: netflix.com\www
Trusted Zone: pandora.com
TCP: DhcpNameServer = 192.168.1.254
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Bill Entwistle\Application Data\Mozilla\Firefox\Profiles\6xnqpoll.default\
FF - prefs.js: browser.startup.homepage - about:blank
.
.
——- File Associations ——-
.
.txt=TextPad.txt
.
- - - - ORPHANS REMOVED - - - -
.
Notify-NavLogon - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-22 17:11
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
@DACL=(02 0000)
@="bootstrap.application.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\.xaml\bootstrap]
@DACL=(02 0000)
@="bootstrap.xaml.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\.xbap\bootstrap]
@DACL=(02 0000)
@="bootstrap.xbap.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\.xps\bootstrap]
@DACL=(02 0000)
@="bootstrap.xps.1"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(716)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(3100)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\progra~1\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\windows\stsystra.exe
c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-11-22 17:18:38 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-22 23:18
.
Pre-Run: 26,171,006,976 bytes free
Post-Run: 26,375,630,848 bytes free
.
- - End Of File - - 86487FF4CA7B13CC7969977FBB9DC09C

NoodleTech

Post #6November 23, 2011, 4:35 AM UTC

Hi ent,

Yes, those files are part of ComboFix and shouldn't be quarantined. AVG was throwing false positives. ComboFix took care of that particularly nasty infection

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

RegLock:: 
[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
[HKEY_LOCAL_MACHINE\software\Classes\.xaml\bootstrap]
[HKEY_LOCAL_MACHINE\software\Classes\.xbap\bootstrap]
[HKEY_LOCAL_MACHINE\software\Classes\.xps\bootstrap]

DirLook::
c:\program files\6A1DD
c:\documents and settings\Bill Entwistle\Application Data\14A6A
c:\documents and settings\Bill Entwistle\Application Data\Y0uuccS2ibF3nGa
c:\documents and settings\Bill Entwistle\Application Data\Q666dWWK8fR9hX
c:\documents and settings\Bill Entwistle\Application Data\adWWKK7fRL9hXqU
c:\documents and settings\Bill Entwistle\Application Data\V7ddEEK8g

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

ent

Post #7November 23, 2011, 5:05 AM UTC

Combofix asked me if I wanted to update to a newer version and I declined.

By the way, for what it's worth, the latest version of AVG makes it somewhat difficult to disable it. It has an option for doing so, but you must choose between 5, 10, or 15 minutes, after which it automatically restarts. This combofix scan made it just in time, in about 13 or 14 minutes.

———-

ComboFix 11-11-22.01 - Bill Entwistle 11/22/2011 22:49:47.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.134 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bill Entwistle\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2011-10-23 to 2011-11-23 )))))))))))))))))))))))))))))))
.
.
2011-11-22 23:33 . 2011-11-22 23:33 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{D7598BAA-21B9-447D-8437-1655871CB5D5}\offreg.dll
2011-11-22 19:48 . 2011-10-18 07:28 6668624 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{D7598BAA-21B9-447D-8437-1655871CB5D5}\mpengine.dll
2011-11-22 19:06 . 2011-11-22 19:11 ——– d—–w- C:\ad50495e293c0ecf77207ce935a5
2011-11-21 08:21 . 2011-10-18 07:28 6668624 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-11-21 08:20 . 2011-11-21 08:20 ——– d—–w- c:\program files\Windows Defender
2011-11-20 22:32 . 2011-11-20 22:32 ——– d—–w- c:\program files\Safari
2011-11-20 21:22 . 2011-11-20 21:22 ——– d—–w- C:\$AVG
2011-11-20 20:59 . 2011-11-20 20:59 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\AVG2012
2011-11-20 20:57 . 2011-11-20 20:57 ——– d–h–w- c:\documents and settings\All Users\Application Data\Common Files
2011-11-20 20:56 . 2011-11-22 23:15 ——– d—–w- c:\windows\system32\drivers\AVG
2011-11-20 20:56 . 2011-11-20 21:12 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG2012
2011-11-20 20:55 . 2011-11-20 20:55 ——– d—–w- c:\program files\AVG
2011-11-20 20:50 . 2011-11-22 23:15 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-11-20 20:39 . 2011-11-20 20:39 ——– d—–w- c:\program files\Bonjour
2011-11-20 20:34 . 2011-11-20 20:34 ——– d—–w- c:\program files\Apple Software Update
2011-11-20 20:31 . 2011-11-20 20:31 ——– d—–w- c:\program files\Common Files\Java
2011-11-20 19:05 . 2011-11-20 19:17 ——– d—–w- c:\program files\6A1DD
2011-11-20 19:05 . 2011-11-20 19:05 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\14A6A
2011-11-20 19:04 . 2011-11-20 19:04 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\Y0uuccS2ibF3nGa
2011-11-20 19:04 . 2011-11-20 19:04 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\Q666dWWK8fR9hX
2011-11-20 19:04 . 2011-11-20 19:04 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\adWWKK7fRL9hXqU
2011-11-20 19:04 . 2011-11-20 19:04 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\V7ddEEK8g
2011-11-20 18:45 . 2011-11-20 18:45 ——– d—–w- c:\program files\CyberFOX Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-20 23:37 . 2004-08-11 21:00 162816 —-a-w- c:\windows\system32\drivers\netbt.sys
2011-11-20 19:23 . 2011-06-09 03:15 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2004-08-11 21:12 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-10-07 12:23 . 2011-10-07 12:23 230608 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 12:21 . 2011-10-04 12:21 16720 —-a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-10-03 11:06 . 2011-03-10 09:13 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-03 08:37 . 2011-03-10 09:16 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-09-28 07:06 . 2004-08-11 21:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-26 16:41 . 2008-07-30 00:59 611328 ——w- c:\windows\system32\uiautomationcore.dll
2011-09-26 16:41 . 2004-08-11 21:00 220160 —-a-w- c:\windows\system32\oleacc.dll
2011-09-26 16:41 . 2004-08-11 21:00 20480 —-a-w- c:\windows\system32\oleaccrc.dll
2011-09-13 12:30 . 2011-09-13 12:30 32592 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-09-06 13:20 . 2004-08-11 21:00 1858944 —-a-w- c:\windows\system32\win32k.sys
2011-08-31 22:00 . 2011-07-16 19:47 22216 ——w- c:\windows\system32\drivers\mbam.sys
2011-08-31 05:05 . 2011-08-31 05:05 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-08-31 05:05 . 2011-08-31 05:05 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-08-31 05:05 . 2011-08-31 05:05 178536 —-a-w- c:\windows\system32\dnssdX.dll
2011-11-09 16:02 . 2011-07-04 00:05 134104 ——w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\documents and settings\Bill Entwistle\Application Data\14A6A —-
.
2011-11-20 19:05 . 2011-11-20 19:08 2133 —-a-w- c:\documents and settings\Bill Entwistle\Application Data\14A6A\A1DD.4A6
.
—- Directory of c:\documents and settings\Bill Entwistle\Application Data\adWWKK7fRL9hXqU —-
.
.
—- Directory of c:\documents and settings\Bill Entwistle\Application Data\Q666dWWK8fR9hX —-
.
2011-11-20 19:04 . 2011-11-20 19:04 12878 —-a-w- c:\documents and settings\Bill Entwistle\Application Data\Q666dWWK8fR9hX\AV Protection 2011.ico
.
—- Directory of c:\documents and settings\Bill Entwistle\Application Data\V7ddEEK8g —-
.
.
—- Directory of c:\documents and settings\Bill Entwistle\Application Data\Y0uuccS2ibF3nGa —-
.
.
—- Directory of c:\program files\6A1DD —-
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 68856]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"MusicManager"="c:\documents and settings\Bill Entwistle\Local Settings\Application Data\Programs\Google\MusicManager\MusicManager.exe" [2011-11-12 13222400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 282624]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\common~1\instal~1\update~1\isuspm.exe" [2004-07-27 221184]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-10-17 1197648]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-10-25 2415456]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Uninstall LastPass RunOnce.lnk - c:\documents and settings\Administrator\Application Data\lpuninstall.exe [2011-4-3 9319112]
.
c:\documents and settings\Bill Entwistle\Start Menu\Programs\Startup\
CapsUnlock.lnk - c:\program files\CapsUnlock\CapsUnlock.exe [2007-4-24 13312]
FlashTray.lnk - c:\program files\FlashTray Pro\FlashTray.exe [N/A]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Microtek Scanner Finder.lnk - c:\program files\Microtek\ScanWizard 5\ScannerFinder.exe [2008-1-14 344064]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Eudora\EuShlExt.dll" [2006-08-17 86016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ——w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"g:\\WS FTP\\WS_FTP95.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\TeraTerm\\ttermpro.exe"=
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
"c:\\Program Files\\Seagate\\SeagateManager\\FreeAgent Status\\stxmenumgr.exe"=
"c:\\Program Files\\Dell Support\\DSAgnt.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [7/11/2011 1:14 AM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/13/2011 6:30 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/7/2011 6:23 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 1:14 AM 295248]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 11:32 PM 189736]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [5/16/2011 10:12 PM 10448]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [7/11/2011 1:14 AM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [7/11/2011 1:14 AM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [10/4/2011 6:21 AM 16720]
S2 0258161238559076mcinstcleanup;0258161238559076mcinstcleanup; [x]
S2 0327391238561196mcinstcleanup;0327391238561196mcinstcleanup; [x]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [10/12/2011 6:25 AM 4433248]
S2 winmgmt32;Windows Management Instrumentation ;c:\windows\system32\msacm32.exe –> c:\windows\system32\msacm32.exe [?]
S3 LW;LW;c:\docume~1\BILLEN~1\LOCALS~1\Temp\LW.exe –> c:\docume~1\BILLEN~1\LOCALS~1\Temp\LW.exe [?]
S3 notecable;NoteCable Driver (WDM);c:\windows\system32\drivers\notcable.sys –> c:\windows\system32\drivers\notcable.sys [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 16:32 7680 ——w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 23:57]
.
2011-11-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3238264531-3539326320-3744746308-1005Core1cc945bae023cbe.job
- c:\documents and settings\Bill Entwistle\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-19 04:43]
.
2011-11-22 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 01:20]
.
2011-11-22 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-30 03:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: internet
Trusted Zone: netflix.com\www
Trusted Zone: pandora.com
TCP: DhcpNameServer = 192.168.1.254
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Bill Entwistle\Application Data\Mozilla\Firefox\Profiles\6xnqpoll.default\
FF - prefs.js: browser.startup.homepage - about:blank
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-22 22:56
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(716)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(5576)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-11-22 22:59:23
ComboFix-quarantined-files.txt 2011-11-23 04:59
ComboFix2.txt 2011-11-22 23:18
.
Pre-Run: 26,389,483,520 bytes free
Post-Run: 26,373,316,608 bytes free
.
- - End Of File - - 7DE424C8D68B3AD4EA31D1744CCE4D23

NoodleTech

Post #8November 23, 2011, 5:56 AM UTC

Hi ent,

AVG isn't the greatest and it has issues with ComboFix. I would recommend uninstalling it and replacing it with Microsoft Security Essentials or Avira Antivirus.

Also, please do update ComboFix when it prompts you. There are a couple more things we need to clean up before I send you on your way.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

Folder::
c:\documents and settings\Bill Entwistle\Application Data\Y0uuccS2ibF3nGa
c:\documents and settings\Bill Entwistle\Application Data\Q666dWWK8fR9hX
c:\documents and settings\Bill Entwistle\Application Data\adWWKK7fRL9hXqU
c:\documents and settings\Bill Entwistle\Application Data\V7ddEEK8g

[external image: Posted Image]
Click the Browse button and search for the following file: c:\documents and settings\Bill Entwistle\Application Data\14A6A\A1DD.4A6
Click Open
Then click Send File
Please be patient while the file is scanned.
Once the scan results appear, please provide them in your next reply.

If it says already scanned – click "reanalyze now"

Please post the results in your next reply.

ent

Post #9November 23, 2011, 6:34 AM UTC

OK, here is the Virus Total analysis results, followed by the combofix log:

———-

Antivirus Version Last update Result
AhnLab-V3 2011.11.22.00 2011.11.22 -
AntiVir 7.11.18.11 2011.11.22 -
Antiy-AVL 2.0.3.7 2011.11.23 -
Avast 6.0.1289.0 2011.11.22 INI:Cycbot-gen [Trj]
AVG 10.0.0.1190 2011.11.22 -
BitDefender 7.2 2011.11.23 -
ByteHero 1.0.0.1 2011.11.14 -
CAT-QuickHeal 12.00 2011.11.22 -
ClamAV 0.97.3.0 2011.11.23 -
Commtouch 5.3.2.6 2011.11.23 -
Comodo 10783 2011.11.23 -
DrWeb 5.0.2.03300 2011.11.23 -
Emsisoft 5.1.0.11 2011.11.23 -
eSafe 7.0.17.0 2011.11.22 -
eTrust-Vet 37.0.9582 2011.11.22 -
F-Prot 4.6.5.141 2011.11.23 -
F-Secure 9.0.16440.0 2011.11.23 -
Fortinet 4.3.370.0 2011.11.23 -
GData 22 2011.11.23 INI:Cycbot-gen
Ikarus T3.1.1.109.0 2011.11.23 -
Jiangmin 13.0.900 2011.11.22 -
K7AntiVirus 9.119.5516 2011.11.22 -
Kaspersky 9.0.0.837 2011.11.23 -
McAfee 5.400.0.1158 2011.11.23 -
McAfee-GW-Edition 2010.1D 2011.11.22 -
Microsoft 1.7801 2011.11.23 -
NOD32 6652 2011.11.23 -
Norman 6.07.13 2011.11.22 -
nProtect 2011-11-22.01 2011.11.22 -
Panda 10.0.3.5 2011.11.22 -
PCTools 8.0.0.5 2011.11.23 -
Prevx 3.0 2011.11.23 -
Rising 23.85.02.01 2011.11.23 -
Sophos 4.71.0 2011.11.23 -
SUPERAntiSpyware 4.40.0.1006 2011.11.23 -
Symantec 20111.2.0.82 2011.11.23 -
TheHacker 6.7.0.1.347 2011.11.23 -
TrendMicro 9.500.0.1008 2011.11.23 -
TrendMicro-HouseCall 9.500.0.1008 2011.11.23 -
VBA32 3.12.16.4 2011.11.22 -
VIPRE 11122 2011.11.23 -
ViRobot 2011.11.22.4787 2011.11.23 -
VirusBuster 14.1.79.0 2011.11.22 -
MD5: 76164f21f6a98b4f9b4a627b4bce369a
SHA1: b629f023e48901b00256d99772630648845bc843
SHA256: bdc33733f89dc2293c4f7f4eaac0191213e87a98d416613c33eb6fbd83b12dc5
File size: 2133 bytes
Scan date: 2011-11-23 06:18:28 (UTC)

———-

ComboFix 11-11-22.03 - Bill Entwistle 11/23/2011 0:13.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.58 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bill Entwistle\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Bill Entwistle\Application Data\adWWKK7fRL9hXqU
c:\documents and settings\Bill Entwistle\Application Data\Q666dWWK8fR9hX
c:\documents and settings\Bill Entwistle\Application Data\Q666dWWK8fR9hX\AV Protection 2011.ico
c:\documents and settings\Bill Entwistle\Application Data\V7ddEEK8g
c:\documents and settings\Bill Entwistle\Application Data\Y0uuccS2ibF3nGa
.
.
((((((((((((((((((((((((( Files Created from 2011-10-23 to 2011-11-23 )))))))))))))))))))))))))))))))
.
.
2011-11-23 05:07 . 2011-11-23 05:11 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-11-22 23:33 . 2011-11-22 23:33 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{D7598BAA-21B9-447D-8437-1655871CB5D5}\offreg.dll
2011-11-22 19:48 . 2011-10-18 07:28 6668624 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{D7598BAA-21B9-447D-8437-1655871CB5D5}\mpengine.dll
2011-11-22 19:06 . 2011-11-22 19:11 ——– d—–w- C:\ad50495e293c0ecf77207ce935a5
2011-11-21 08:21 . 2011-10-18 07:28 6668624 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-11-21 08:20 . 2011-11-21 08:20 ——– d—–w- c:\program files\Windows Defender
2011-11-20 22:32 . 2011-11-20 22:32 ——– d—–w- c:\program files\Safari
2011-11-20 21:22 . 2011-11-20 21:22 ——– d—–w- C:\$AVG
2011-11-20 20:59 . 2011-11-20 20:59 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\AVG2012
2011-11-20 20:57 . 2011-11-20 20:57 ——– d–h–w- c:\documents and settings\All Users\Application Data\Common Files
2011-11-20 20:56 . 2011-11-22 23:15 ——– d—–w- c:\windows\system32\drivers\AVG
2011-11-20 20:56 . 2011-11-20 21:12 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG2012
2011-11-20 20:55 . 2011-11-20 20:55 ——– d—–w- c:\program files\AVG
2011-11-20 20:50 . 2011-11-22 23:15 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-11-20 20:39 . 2011-11-20 20:39 ——– d—–w- c:\program files\Bonjour
2011-11-20 20:34 . 2011-11-20 20:34 ——– d—–w- c:\program files\Apple Software Update
2011-11-20 20:31 . 2011-11-20 20:31 ——– d—–w- c:\program files\Common Files\Java
2011-11-20 19:05 . 2011-11-20 19:17 ——– d—–w- c:\program files\6A1DD
2011-11-20 19:05 . 2011-11-20 19:05 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\14A6A
2011-11-20 18:45 . 2011-11-20 18:45 ——– d—–w- c:\program files\CyberFOX Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-20 23:37 . 2004-08-11 21:00 162816 —-a-w- c:\windows\system32\drivers\netbt.sys
2011-11-20 19:23 . 2011-06-09 03:15 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2004-08-11 21:12 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-10-07 12:23 . 2011-10-07 12:23 230608 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 12:21 . 2011-10-04 12:21 16720 —-a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-10-03 11:06 . 2011-03-10 09:13 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-03 08:37 . 2011-03-10 09:16 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-09-28 07:06 . 2004-08-11 21:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-26 16:41 . 2008-07-30 00:59 611328 ——w- c:\windows\system32\uiautomationcore.dll
2011-09-26 16:41 . 2004-08-11 21:00 220160 —-a-w- c:\windows\system32\oleacc.dll
2011-09-26 16:41 . 2004-08-11 21:00 20480 —-a-w- c:\windows\system32\oleaccrc.dll
2011-09-13 12:30 . 2011-09-13 12:30 32592 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-09-06 13:20 . 2004-08-11 21:00 1858944 —-a-w- c:\windows\system32\win32k.sys
2011-08-31 22:00 . 2011-07-16 19:47 22216 ——w- c:\windows\system32\drivers\mbam.sys
2011-08-31 05:05 . 2011-08-31 05:05 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-08-31 05:05 . 2011-08-31 05:05 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-08-31 05:05 . 2011-08-31 05:05 178536 —-a-w- c:\windows\system32\dnssdX.dll
2011-11-09 16:02 . 2011-07-04 00:05 134104 ——w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 68856]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"MusicManager"="c:\documents and settings\Bill Entwistle\Local Settings\Application Data\Programs\Google\MusicManager\MusicManager.exe" [2011-11-12 13222400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 282624]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\common~1\instal~1\update~1\isuspm.exe" [2004-07-27 221184]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-10-17 1197648]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-10-25 2415456]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Uninstall LastPass RunOnce.lnk - c:\documents and settings\Administrator\Application Data\lpuninstall.exe [2011-4-3 9319112]
.
c:\documents and settings\Bill Entwistle\Start Menu\Programs\Startup\
CapsUnlock.lnk - c:\program files\CapsUnlock\CapsUnlock.exe [2007-4-24 13312]
FlashTray.lnk - c:\program files\FlashTray Pro\FlashTray.exe [N/A]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Microtek Scanner Finder.lnk - c:\program files\Microtek\ScanWizard 5\ScannerFinder.exe [2008-1-14 344064]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Eudora\EuShlExt.dll" [2006-08-17 86016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ——w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"g:\\WS FTP\\WS_FTP95.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\TeraTerm\\ttermpro.exe"=
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
"c:\\Program Files\\Seagate\\SeagateManager\\FreeAgent Status\\stxmenumgr.exe"=
"c:\\Program Files\\Dell Support\\DSAgnt.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [7/11/2011 1:14 AM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/13/2011 6:30 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/7/2011 6:23 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 1:14 AM 295248]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 11:32 PM 189736]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [5/16/2011 10:12 PM 10448]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [7/11/2011 1:14 AM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [7/11/2011 1:14 AM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [10/4/2011 6:21 AM 16720]
S2 0258161238559076mcinstcleanup;0258161238559076mcinstcleanup; [x]
S2 0327391238561196mcinstcleanup;0327391238561196mcinstcleanup; [x]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [10/12/2011 6:25 AM 4433248]
S2 winmgmt32;Windows Management Instrumentation ;c:\windows\system32\msacm32.exe –> c:\windows\system32\msacm32.exe [?]
S3 LW;LW;c:\docume~1\BILLEN~1\LOCALS~1\Temp\LW.exe –> c:\docume~1\BILLEN~1\LOCALS~1\Temp\LW.exe [?]
S3 notecable;NoteCable Driver (WDM);c:\windows\system32\drivers\notcable.sys –> c:\windows\system32\drivers\notcable.sys [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 16:32 7680 ——w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 23:57]
.
2011-11-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3238264531-3539326320-3744746308-1005Core1cc945bae023cbe.job
- c:\documents and settings\Bill Entwistle\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-19 04:43]
.
2011-11-22 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 01:20]
.
2011-11-22 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-30 03:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: internet
Trusted Zone: netflix.com\www
Trusted Zone: pandora.com
TCP: DhcpNameServer = 192.168.1.254
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Bill Entwistle\Application Data\Mozilla\Firefox\Profiles\6xnqpoll.default\
FF - prefs.js: browser.startup.homepage - about:blank
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-23 00:21
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(716)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
Completion time: 2011-11-23 00:23:55
ComboFix-quarantined-files.txt 2011-11-23 06:23
ComboFix2.txt 2011-11-23 04:59
ComboFix3.txt 2011-11-22 23:18
.
Pre-Run: 26,360,905,728 bytes free
Post-Run: 26,344,062,976 bytes free
.
- - End Of File - - 88AA113131514D356D06958068BA4729

NoodleTech

Post #10November 23, 2011, 6:42 AM UTC

Hi ent,

Thanks for the logs. How's your computer running now?

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

Folder::
c:\documents and settings\Bill Entwistle\Application Data\14A6A

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

ent

Post #11November 23, 2011, 7:19 AM UTC

The computer seems to be running OK at the moment. I actually haven't seen anything amiss since the last time I un-hybernated (this afternoon), and the system has been restarted several times since then.

Here are the logs:

———-

Results of screen317's Security Check version 0.99.28
Windows XP Service Pack 3 x86
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG 2012
ESET Online Scanner v3
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java™ 6 Update 29
Adobe Flash Player 11.1.102.55
Adobe Reader X (10.1.1)
Mozilla Firefox (8.0.)
Mozilla Thunderbird (8.0.)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
``````````End of Log````````````

———-

ComboFix 11-11-22.03 - Bill Entwistle 11/23/2011 0:56.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.118 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bill Entwistle\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Bill Entwistle\Application Data\14A6A
c:\documents and settings\Bill Entwistle\Application Data\14A6A\A1DD.4A6
.
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\userinit.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-10-23 to 2011-11-23 )))))))))))))))))))))))))))))))
.
.
2011-11-23 05:07 . 2011-11-23 05:11 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-11-22 19:48 . 2011-10-18 07:28 6668624 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{D7598BAA-21B9-447D-8437-1655871CB5D5}\mpengine.dll
2011-11-22 19:06 . 2011-11-22 19:11 ——– d—–w- C:\ad50495e293c0ecf77207ce935a5
2011-11-21 08:21 . 2011-10-18 07:28 6668624 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-11-21 08:20 . 2011-11-21 08:20 ——– d—–w- c:\program files\Windows Defender
2011-11-20 22:32 . 2011-11-20 22:32 ——– d—–w- c:\program files\Safari
2011-11-20 21:22 . 2011-11-20 21:22 ——– d—–w- C:\$AVG
2011-11-20 20:59 . 2011-11-20 20:59 ——– d—–w- c:\documents and settings\Bill Entwistle\Application Data\AVG2012
2011-11-20 20:57 . 2011-11-20 20:57 ——– d–h–w- c:\documents and settings\All Users\Application Data\Common Files
2011-11-20 20:56 . 2011-11-22 23:15 ——– d—–w- c:\windows\system32\drivers\AVG
2011-11-20 20:56 . 2011-11-20 21:12 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG2012
2011-11-20 20:55 . 2011-11-20 20:55 ——– d—–w- c:\program files\AVG
2011-11-20 20:50 . 2011-11-22 23:15 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-11-20 20:39 . 2011-11-20 20:39 ——– d—–w- c:\program files\Bonjour
2011-11-20 20:34 . 2011-11-20 20:34 ——– d—–w- c:\program files\Apple Software Update
2011-11-20 20:31 . 2011-11-20 20:31 ——– d—–w- c:\program files\Common Files\Java
2011-11-20 19:05 . 2011-11-20 19:17 ——– d—–w- c:\program files\6A1DD
2011-11-20 18:45 . 2011-11-20 18:45 ——– d—–w- c:\program files\CyberFOX Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-20 23:37 . 2004-08-11 21:00 162816 —-a-w- c:\windows\system32\drivers\netbt.sys
2011-11-20 19:23 . 2011-06-09 03:15 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2004-08-11 21:12 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-10-07 12:23 . 2011-10-07 12:23 230608 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2011-10-04 12:21 . 2011-10-04 12:21 16720 —-a-w- c:\windows\system32\drivers\AVGIDSShim.sys
2011-10-03 11:06 . 2011-03-10 09:13 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-03 08:37 . 2011-03-10 09:16 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-09-28 07:06 . 2004-08-11 21:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-26 16:41 . 2008-07-30 00:59 611328 ——w- c:\windows\system32\uiautomationcore.dll
2011-09-26 16:41 . 2004-08-11 21:00 220160 —-a-w- c:\windows\system32\oleacc.dll
2011-09-26 16:41 . 2004-08-11 21:00 20480 —-a-w- c:\windows\system32\oleaccrc.dll
2011-09-13 12:30 . 2011-09-13 12:30 32592 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-09-06 13:20 . 2004-08-11 21:00 1858944 —-a-w- c:\windows\system32\win32k.sys
2011-08-31 22:00 . 2011-07-16 19:47 22216 ——w- c:\windows\system32\drivers\mbam.sys
2011-08-31 05:05 . 2011-08-31 05:05 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-08-31 05:05 . 2011-08-31 05:05 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-08-31 05:05 . 2011-08-31 05:05 178536 —-a-w- c:\windows\system32\dnssdX.dll
2011-11-09 16:02 . 2011-07-04 00:05 134104 ——w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-11-22_23.11.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-11-23 07:05 . 2011-11-23 07:05 16384 c:\windows\temp\Perflib_Perfdata_7d0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 68856]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"MusicManager"="c:\documents and settings\Bill Entwistle\Local Settings\Application Data\Programs\Google\MusicManager\MusicManager.exe" [2011-11-12 13222400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 282624]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\common~1\instal~1\update~1\isuspm.exe" [2004-07-27 221184]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-10-17 1197648]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-10-25 2415456]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Uninstall LastPass RunOnce.lnk - c:\documents and settings\Administrator\Application Data\lpuninstall.exe [2011-4-3 9319112]
.
c:\documents and settings\Bill Entwistle\Start Menu\Programs\Startup\
CapsUnlock.lnk - c:\program files\CapsUnlock\CapsUnlock.exe [2007-4-24 13312]
FlashTray.lnk - c:\program files\FlashTray Pro\FlashTray.exe [N/A]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Microtek Scanner Finder.lnk - c:\program files\Microtek\ScanWizard 5\ScannerFinder.exe [2008-1-14 344064]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Eudora\EuShlExt.dll" [2006-08-17 86016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ——w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"g:\\WS FTP\\WS_FTP95.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\TeraTerm\\ttermpro.exe"=
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
"c:\\Program Files\\Seagate\\SeagateManager\\FreeAgent Status\\stxmenumgr.exe"=
"c:\\Program Files\\Dell Support\\DSAgnt.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [7/11/2011 1:14 AM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/13/2011 6:30 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/7/2011 6:23 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 1:14 AM 295248]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [10/12/2011 6:25 AM 4433248]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 6:09 AM 192776]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 11:32 PM 189736]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [5/16/2011 10:12 PM 10448]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [7/11/2011 1:14 AM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [7/11/2011 1:14 AM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [10/4/2011 6:21 AM 16720]
S2 0258161238559076mcinstcleanup;0258161238559076mcinstcleanup; [x]
S2 0327391238561196mcinstcleanup;0327391238561196mcinstcleanup; [x]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S2 winmgmt32;Windows Management Instrumentation ;c:\windows\system32\msacm32.exe –> c:\windows\system32\msacm32.exe [?]
S3 LW;LW;c:\docume~1\BILLEN~1\LOCALS~1\Temp\LW.exe –> c:\docume~1\BILLEN~1\LOCALS~1\Temp\LW.exe [?]
S3 notecable;NoteCable Driver (WDM);c:\windows\system32\drivers\notcable.sys –> c:\windows\system32\drivers\notcable.sys [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 16:32 7680 ——w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 23:57]
.
2011-11-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3238264531-3539326320-3744746308-1005Core1cc945bae023cbe.job
- c:\documents and settings\Bill Entwistle\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-19 04:43]
.
2011-11-23 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-30 03:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: internet
Trusted Zone: netflix.com\www
Trusted Zone: pandora.com
TCP: DhcpNameServer = 192.168.1.254
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Bill Entwistle\Application Data\Mozilla\Firefox\Profiles\6xnqpoll.default\
FF - prefs.js: browser.startup.homepage - about:blank
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-23 01:05
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(720)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(3800)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\progra~1\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\windows\stsystra.exe
c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-11-23 01:10:36 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-23 07:10
ComboFix2.txt 2011-11-23 06:23
ComboFix3.txt 2011-11-23 04:59
ComboFix4.txt 2011-11-22 23:18
.
Pre-Run: 26,357,989,376 bytes free
Post-Run: 26,339,725,312 bytes free
.
- - End Of File - - C45808D0EDD90E1593B14F612210002B

NoodleTech

Post #12November 23, 2011, 7:26 AM UTC

Hi ent,

Great to hear that!

A few of your programs are outdated and this makes your system more vulnerable to infection.

Click here to download Internet Explorer 8.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 7 Update 1.
Click on jre-7u1-windows-i586.exe if you are running 32-bit Windows or jre-7u1-windows-x64.exe if you are running 64-bit Windows.
After the download completes, close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Double click the Java setup file you just downloaded and follow the prompts to begin the installation.

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]

Under Temporary Internet Files, click the Settings… button
click the Delete Files button.
There are three options in the window to clear the cache - Leave all 3 Checked
- Downloaded Applets
  Downloaded Applications
  Other Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Settings
Click OK to leave the Java Control Panel.

===================================================

Download TFC to your desktop

Open the file and close any other windows.
It will close all programs itself when run, make sure to let it run uninterrupted.
Click the Start button to begin the process. The program should not take long to finish its job
Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

ent

Post #13November 23, 2011, 8:07 AM UTC

I rarely run Internet Explorer, but I upgraded to IE8. I updated Java and cleared the caches, and ran TFC and rebooted.

NoodleTech

Post #14November 23, 2011, 8:11 AM UTC

Great!

I'd like to have you run this scan to make sure we got everything.

Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.

ent

Post #15November 23, 2011, 10:11 AM UTC

Here's the only thing that ESET reported. This looks like a file quarantined by combofix? C:\Qoobox\Quarantine\C\Program Files\LP\CFC1\1CA5.tmp.vir a variant of Win32/Kryptik.VVP trojan It's late and I'm heading to bed now. I'll be back in touch tomorrow. Thanks for all your help!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Ping.exe / NetBT.sys Infection

✨ Ask AI

Ask AI