What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected with Dropper trojan [Closed]

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hello guys!

I'm glad I remembered you guys and how much of a help you guys were before.
The other times my old XP computer wasn't really infected, but this time I think it is much more vulnerable.

Here's why:

This Xp computer is like 7 years old. So it is cranky in itself with its depreciating RAM.

It went through a lot of battles with viruses and usually not that bad.

Over this past year, we replaced our AVG Free (which we have used for a long time) with Alyac (Dr. Ahn's antivirus software).
It's a Korean anti-virus software that dominates the market in South Korea. First, I wanted to know if this software is any good at the States and if it does replacement, which one would fair better (like the AVG, Avast, or Avira)?

Recently there has been two notable trojan viruses that hit it quite hard multiple times - Exploit and Dropper.
So I wanted to know if this computer is still infected (especially if any rootkit is visible) and if it is part of a DDOS scheme.


So please help me out! :)

Here's the OTL:


OTL logfile created on: 12/12/2011 2:36:07 PM - Run 3
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\User\Desktop\Ed\Old
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.00 Mb Total Physical Memory | 307.00 Mb Available Physical Memory | 61.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2000 2000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.50 Gb Total Space | 37.35 Gb Free Space | 50.13% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-CD1C7E9FE0
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\User\Desktop\ALYac\AYUpdSrv.aye (ESTsoft Corp)
PRC - C:\Documents and Settings\User\Desktop\ALYac\AYAgent.aye (ESTsoft Corp)
PRC - C:\Documents and Settings\User\Desktop\ALYac\AYRTSrv.aye (ESTsoft Corp)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Documents and Settings\User\Desktop\Ed\Old\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Documents and Settings\User\Desktop\Ed\Old\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (ALYac_UpdSrv) – C:\Documents and Settings\User\Desktop\ALYac\AYUpdSrv.aye (ESTsoft Corp)
SRV - (ALYac_RTSrv) – C:\Documents and Settings\User\Desktop\ALYac\AYRTSrv.aye (ESTsoft Corp)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)


========== Driver Services (SafeList) ==========

DRV - (OMCI) – C:\WINDOWS\System32\DRIVERS\OMCI.SYS File not found
DRV - (MRESP50) – C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS File not found
DRV - (MRENDIS5) – C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS File not found
DRV - (MREMPR5) – C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS File not found
DRV - (MREMP50) – C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS File not found
DRV - (MBAMSwissArmy) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys File not found
DRV - (catchme) – C:\DOCUME~1\User\LOCALS~1\Temp\catchme.sys File not found
DRV - (Avgtdix) – C:\WINDOWS\System32\DRIVERS\avgtdix.sys File not found
DRV - (Avgrkx86) – C:\WINDOWS\System32\DRIVERS\avgrkx86.sys File not found
DRV - (AVGIDSEH) – C:\WINDOWS\System32\DRIVERS\AVGIDSEH.Sys File not found
DRV - (EstRtwIFDrv) – C:\WINDOWS\system32\drivers\EstRtw.sys (ESTsoft Corp)
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (IntelC52) – C:\WINDOWS\system32\drivers\IntelC52.sys (Intel Corporation)
DRV - (IntelC51) – C:\WINDOWS\system32\drivers\IntelC51.sys (Intel Corporation)
DRV - (IntelC53) – C:\WINDOWS\system32\drivers\IntelC53.sys (Intel Corporation)
DRV - (mohfilt) – C:\WINDOWS\system32\drivers\mohfilt.sys (Intel Corporation)
DRV - (senfilt) – C:\WINDOWS\system32\drivers\senfilt.sys (Creative Technology Ltd.)
DRV - (FsVga) – C:\WINDOWS\system32\drivers\fsvga.sys (Microsoft Corporation)
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 72 27 EA 21 0D 43 CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/02/21 20:49:26 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/06/04 12:34:29 | 000,000,000 | —D | M]


O1 HOSTS File: ([2011/06/01 17:01:38 | 000,391,228 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 127.0.0.1 www.123fporn.info
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 127.0.0.1 www.123haustiereundmehr.com
O1 - Hosts: 13493 more lines…
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [ALYac] C:\Documents and Settings\User\Desktop\ALYac\AYLaunch.exe (ESTsoft Corp)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O16 - DPF: {2AB1C516-6654-4D3A-B3D6-2185BBCEB409} https://webvpn.ucr.edu/+CSCOL+/csvrloader32.cab (Cisco SSL VPN Relay Loader)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/04 14:01:47 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (bootalyac.exe) - C:\WINDOWS\System32\bootalyac.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Unable to start service SrService!

========== Files/Folders - Created Within 30 Days ==========

[2011/12/12 12:21:59 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\ECRSC
[2011/12/11 18:24:23 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2011/12/09 16:22:11 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2011/12/08 21:09:17 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\EB5 Brochure
[2011/12/05 02:18:48 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Lee Kwang Soo
[2011/12/03 19:18:50 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\ECRSC
[2011/12/03 19:18:14 | 000,256,824 | —- | C] (ESTsoft Corp) – C:\WINDOWS\System32\drivers\EstRtw.sys
[2011/12/03 19:18:09 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\ECRSC
[2011/12/03 16:43:14 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\XXXXXXX
[2011/11/29 12:45:28 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Lobster
[2011/11/26 16:52:21 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\North Dakota Oil 11262011 by David
[2011/11/26 00:37:29 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\생수 성분분석표
[2011/11/25 17:25:55 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\LED
[2011/11/22 01:37:20 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Shon
[2011/11/22 00:28:04 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Pusan Development Master Plan
[2011/11/13 01:30:26 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\월마트 자료 장봉진
[1 C:\Documents and Settings\User\My Documents\*.tmp files -> C:\Documents and Settings\User\My Documents\*.tmp -> ]
[1 C:\Documents and Settings\User\Desktop\*.tmp files -> C:\Documents and Settings\User\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/12 14:00:31 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/12 14:00:25 | 000,000,992 | —- | M] () – C:\WINDOWS\System32\drivers\EstRtw.dat
[2011/12/12 13:58:48 | 000,000,522 | —- | M] () – C:\WINDOWS\System32\ayboot.ini
[2011/12/12 13:57:37 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/12 13:57:32 | 000,249,288 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/12 13:57:26 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2011/12/12 13:57:20 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/12 12:19:59 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\User\ntuser.ini
[2011/12/12 12:19:58 | 011,534,336 | -H– | M] () – C:\Documents and Settings\User\ntuser.dat
[2011/12/11 23:49:02 | 000,002,515 | —- | M] () – C:\Documents and Settings\User\Desktop\Microsoft Office Word 2007.lnk
[2011/12/11 23:47:15 | 000,000,162 | -H– | M] () – C:\Documents and Settings\User\Desktop\~$le for WWB.docx
[2011/12/11 23:12:18 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{76E16E09-C105-4570-A5F5-D26344601069}.job
[2011/12/09 19:57:56 | 000,213,504 | —- | M] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/09 19:37:14 | 000,056,928 | —- | M] () – C:\Documents and Settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2011/12/07 16:55:06 | 000,256,824 | —- | M] (ESTsoft Corp) – C:\WINDOWS\System32\drivers\EstRtw.sys
[2011/12/03 19:17:03 | 000,000,694 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\알약.lnk
[2011/11/28 00:46:30 | 000,041,329 | —- | M] () – C:\Documents and Settings\User\My Documents\LA-#503079-v1-K&L;_Gates_Indian_Law.pdf
[2011/11/26 15:20:35 | 000,002,473 | —- | M] () – C:\Documents and Settings\User\Desktop\Microsoft Office Excel 2007.lnk
[2011/11/25 18:31:51 | 000,002,483 | —- | M] () – C:\Documents and Settings\User\Desktop\Microsoft Office PowerPoint 2007.lnk
[2011/11/24 17:52:35 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/11/24 14:21:12 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/11/18 20:04:14 | 000,000,162 | -H– | M] () – C:\Documents and Settings\User\Desktop\~$tion Control Made Easy.docx
[1 C:\Documents and Settings\User\My Documents\*.tmp files -> C:\Documents and Settings\User\My Documents\*.tmp -> ]
[1 C:\Documents and Settings\User\Desktop\*.tmp files -> C:\Documents and Settings\User\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/12 13:57:17 | 000,249,288 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/11 23:47:15 | 000,000,162 | -H– | C] () – C:\Documents and Settings\User\Desktop\~$le for WWB.docx
[2011/12/03 19:21:42 | 000,000,992 | —- | C] () – C:\WINDOWS\System32\drivers\EstRtw.dat
[2011/12/03 19:19:01 | 000,000,522 | —- | C] () – C:\WINDOWS\System32\ayboot.ini
[2011/12/03 19:18:14 | 000,016,736 | —- | C] () – C:\WINDOWS\System32\bootalyac.exe
[2011/12/03 19:17:03 | 000,000,694 | —- | C] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\알약.lnk
[2011/11/28 00:46:33 | 000,041,329 | —- | C] () – C:\Documents and Settings\User\My Documents\LA-#503079-v1-K&L;_Gates_Indian_Law.pdf
[2011/11/24 17:52:34 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/11/18 20:04:14 | 000,000,162 | -H– | C] () – C:\Documents and Settings\User\Desktop\~$tion Control Made Easy.docx
[2010/06/10 20:07:14 | 000,000,690 | —- | C] () – C:\WINDOWS\wininit.ini
[2010/01/08 19:51:30 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2009/08/04 17:24:47 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll
[1997/11/17 16:13:16 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll

========== LOP Check ==========

[2010/10/23 16:12:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/23 14:46:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/12/30 21:03:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/03/24 21:10:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2011/05/07 18:03:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2010/11/26 16:09:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RapidTyping
[2010/11/20 16:34:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2010/10/23 16:13:17 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\AVG10
[2010/08/05 14:06:04 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\AVG9
[2011/09/15 14:43:12 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\DAEMON Tools Lite
[2011/06/04 12:30:56 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Dropbox
[2010/04/14 22:20:49 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\HNC
[2009/12/22 00:25:23 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\OpenOffice.org
[2010/11/26 16:09:55 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\RapidTyping
[2009/09/20 16:46:23 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Windows Search
[2011/12/11 23:12:18 | 000,000,420 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{76E16E09-C105-4570-A5F5-D26344601069}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/08/04 14:01:47 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/08/09 17:13:25 | 000,000,211 | —- | M] () – C:\Boot.bak
[2011/06/05 11:18:32 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2004/08/03 22:00:00 | 000,260,272 | -H– | M] () – C:\cmldr
[2009/08/04 14:01:47 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/08/04 14:01:47 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/08/04 14:01:47 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 04:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/08/04 18:33:10 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/12/12 13:57:16 | 2097,152,000 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/08/04 14:01:19 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2010/05/14 14:56:34 | 000,319,488 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpfpp02t.dll
[2008/07/06 02:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/08/04 06:49:38 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/08/04 06:49:38 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/08/04 06:49:38 | 000,872,448 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
"NoAutoUpdate" = 0

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-11-24 23:36:37
< End of report >


—– The extras.txt report didn't come out.

And I already took out 5 dropper viruses with Malwarebytes (full scan in safe mode)
Post #2
Hi RE-Ignite,

:welcome:

My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not delete anything unless instructed to.
  • DO NOT use tools such as ComboFix without supervision.
  • Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.
Note to Vista and Windows 7 users:
  • These tools MUST be run from the executable. (.exe) every time you run them
  • These tools MUST be run With Admin Rights (Right click, choose "Run as Administrator")
===================================================

To be honest, I don't know much about Alyac as we do not use it here in the States. I usually recommend Microsoft Security Essentials as it is free, effective, and uses minimal resources. Let's try and get you cleaned up.

===================================================

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
===================================================

Please download aswMBR to your desktop.
  • Double click the aswMBR.exe icon to run it
  • When asked if you want to download Avast's virus definitions please select Yes.
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.
Post #3
Thanks, NoodleTech.

I was hesitant of installing Alyac as my primary anti-virus software, and it seems I was right about my instincts. Since it's a Korea-based software, I figure that is meant for the internet provider there and its korean files. There are probably many different strategies that hackers and sites use in other nations, so having an American-based product/service is probably the way to go. However, this is just a random conjecture - I don't have much basis for it other than explaining it as a demographic lurking variable.

Here is my Mbam quick-scanned log:


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8358

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/12/2011 8:51:22 PM
mbam-log-2011-12-12 (20-51-21).txt

Scan type: Quick scan
Objects scanned: 171145
Time elapsed: 9 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

-===========
As you see right now, there are no viruses. Possibly due to the fact that I cleared them out in the last few scans, especially the full scan done in safe mode.


===============

And here is the aswMbr log:

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-12-12 17:46:21
—————————–
17:46:21.046 OS Version: Windows 5.1.2600 Service Pack 3
17:46:21.046 Number of processors: 1 586 0x401
17:46:21.046 ComputerName: USER-CD1C7E9FE0 UserName: User
17:46:27.265 Initialize success
17:53:25.062 AVAST engine defs: 11121201
17:56:41.187 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
17:56:41.187 Disk 0 Vendor: SAMSUNG_SP0802N TK100-28 Size: 76293MB BusType: 3
17:56:43.203 Disk 0 MBR read successfully
17:56:43.203 Disk 0 MBR scan
17:56:43.281 Disk 0 Windows XP default MBR code
17:56:43.296 Disk 0 scanning sectors +156232125
17:56:43.359 Disk 0 scanning C:\WINDOWS\system32\drivers
17:57:23.718 Service scanning
17:57:24.953 Modules scanning
17:57:30.015 Disk 0 trace - called modules:
17:57:30.031 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
17:57:30.031 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x823d2ab8]
17:57:30.046 3 CLASSPNP.SYS[f8582fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82369b58]
17:57:30.671 AVAST engine scan C:\WINDOWS
17:57:34.593 AVAST engine scan C:\WINDOWS\system32
18:00:18.703 AVAST engine scan C:\WINDOWS\system32\drivers
18:00:38.984 AVAST engine scan C:\Documents and Settings\User
18:24:02.046 AVAST engine scan C:\Documents and Settings\All Users
18:26:44.828 Scan finished successfully
18:27:02.218 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\User\Desktop\Ed\MBR.dat"
18:27:02.234 The log file has been saved successfully to "C:\Documents and Settings\User\Desktop\Ed\aswMBRnew.txt"

Thanks for your help! :D
Post #4
Hi RE-Ignite,

Thanks, NoodleTech.

No problem :)

I was hesitant of installing Alyac as my primary anti-virus software, and it seems I was right about my instincts. Since it's a Korea-based software, I figure that is meant for the internet provider there and its korean files. There are probably many different strategies that hackers and sites use in other nations, so having an American-based product/service is probably the way to go. However, this is just a random conjecture - I don't have much basis for it other than explaining it as a demographic lurking variable.

I can't give you a sure answer, but antivirus definitions are geared towards threats originating from any and all countries. Some of the most popular infections we see in the US were probably created in a foreign country. That being said, you should choose an antivirus software that works for you. I base my criteria for selection of an antivirus suite on detection rate, number of false positives, and resources consumed during normal use.

As you see right now, there are no viruses. Possibly due to the fact that I cleared them out in the last few scans, especially the full scan done in safe mode.

I'm sorry, I missed that line in your first post.

Let's dig a bit deeper to see if you have any remnants of an infection.

Please download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks

    [external image: Posted Image]

    [external image: Posted Image]
  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #5
Thanks.

So I ran ComboFix, but before I did that it said that I still have AVG FREE 2011 on.
I was pretty sure I removed that program, but when I did a thorough search on Windows, thousands of related files popped up.
So I clicked on one of the GUI files and the program came up.
It seems it was still available, but not really functioning because none of the components was present. So it was just the shell that was left.
Nevertheless, ComboFix noted that and still ran the scan.

Here are the results of the ComboFix scan:


ComboFix 11-12-12.02 - User 3/2011 Tue 13:46:58.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.949.82.1033.18.503.137 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\Ed\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: 알약 *Disabled/Updated* {B9431E5A-E196-4B6F-843A-10E01DB25461}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\User\My Documents\AA.tmp
c:\documents and settings\User\Start Menu\Programs\Windows XP Recovery
c:\documents and settings\User\WINDOWS
C:\drvrtmp
.
.
((((((((((((((((((((((((( Files Created from 2011-11-13 to 2011-12-13 )))))))))))))))))))))))))))))))
.
.
2011-12-12 20:21 . 2011-12-12 20:21 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\ECRSC
2011-12-04 03:21 . 2011-12-13 21:25 992 —-a-w- c:\windows\system32\drivers\EstRtw.dat
2011-12-04 03:18 . 2011-12-04 03:18 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\ECRSC
2011-12-04 03:18 . 2011-12-08 00:55 256824 —-a-w- c:\windows\system32\drivers\EstRtw.sys
2011-12-04 03:18 . 2011-09-21 02:33 16736 —-a-w- c:\windows\system32\bootalyac.exe
2011-12-04 03:18 . 2011-12-04 03:18 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\ECRSC
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-23 13:25 . 2004-08-04 12:00 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2004-08-04 12:00 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-04 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2004-08-04 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-04 12:00 385024 —-a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2004-08-04 12:00 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-04 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:33 . 2004-08-04 12:00 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2004-08-03 22:59 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2004-08-04 12:00 186880 —-a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2009-08-04 21:59 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2004-08-04 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2011-09-26 18:41 . 2008-07-30 02:59 611328 —-a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 18:41 . 2004-08-04 12:00 220160 —-a-w- c:\windows\system32\oleacc.dll
2011-09-26 18:41 . 2004-08-04 12:00 20480 —-a-w- c:\windows\system32\oleaccrc.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608]
"ALYac"="c:\documents and settings\User\Desktop\ALYac\AYLaunch.exe" [2011-12-08 245048]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0bootalyac.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ALYac_UpdSrv]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_TRAY]
2011-01-07 09:22 2747744 —-a-w- c:\program files\AVG\AVG10\avgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-11-26 05:41 136176 —-atw- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2009-11-19 00:13 54576 —-a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-09-20 16:32 77824 -c–a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-09-20 16:36 114688 -c–a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2005-09-20 16:35 94208 -c–a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Korean IME Migration]
2006-10-26 21:53 26400 -c–a-w- c:\progra~1\COMMON~1\MICROS~1\IME12\IMEKR\IMKRMIG.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-09-01 00:00 449608 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2004-08-04 12:00 455168 -c–a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2004-10-14 21:42 1404928 -c–a-w- c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SeaPort"=2 (0x2)
"BBSvc"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"ose"=3 (0x3)
"MBAMService"=2 (0x2)
"idsvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"odserv"=3 (0x3)
"avgwd"=2 (0x2)
"AVGIDSAgent"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqfxt08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=
"c:\\Documents and Settings\\User\\Desktop\\ALYac\\AYUpdSrv.aye"=
.
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [9/7/2010 2:48 AM 251728]
R1 EstRtwIFDrv;EstRtwIFDrv;c:\windows\system32\drivers\EstRtw.sys [12/3/2011 7:18 PM 256824]
R2 ALYac_RTSrv;ALYac RealTime Service;c:\documents and settings\User\Desktop\ALYac\AYRTSrv.aye [10/24/2011 3:09 AM 380728]
R2 ALYac_UpdSrv;ALYac Update Service;c:\documents and settings\User\Desktop\ALYac\AYUpdSrv.aye [10/24/2011 3:09 AM 657720]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/15/2010 11:26 AM 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/15/2010 11:26 AM 22216]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2011 3:14 PM 136176]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [8/19/2010 8:42 PM 123472]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [8/19/2010 8:42 PM 30288]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [8/19/2010 8:42 PM 26192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2011 3:14 PM 136176]
S4 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [1/6/2011 3:23 PM 6128720]
S4 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys –> c:\windows\system32\DRIVERS\AVGIDSEH.Sys [?]
S4 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys –> c:\windows\system32\DRIVERS\avgrkx86.sys [?]
S4 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys –> c:\windows\system32\DRIVERS\avgtdix.sys [?]
S4 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [10/22/2010 4:58 AM 265400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-28 23:14]
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-28 23:14]
.
2011-12-13 c:\windows\Tasks\User_Feed_Synchronization-{76E16E09-C105-4570-A5F5-D26344601069}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {2AB1C516-6654-4D3A-B3D6-2185BBCEB409} - hxxps://webvpn.ucr.edu/+CSCOL+/csvrloader32.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
MSConfigStartUp-AVG9_TRAY - c:\progra~1\AVG\AVG9\avgtray.exe
MSConfigStartUp-ayRmyfbCTPl - c:\documents and settings\All Users\Application Data\ayRmyfbCTPl.exe
MSConfigStartUp-pdfFactory Pro Dispatcher v3 - c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-13 13:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ALYac_RTSrv]
"ImagePath"="\"c:\documents and settings\User\Desktop\ALYac\AYRTSrv.aye\""
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ALYac_UpdSrv]
"ImagePath"="\"c:\documents and settings\User\Desktop\ALYac\AYUpdSrv.aye\""
.
Completion time: 2011-12-13 13:57:04
ComboFix-quarantined-files.txt 2011-12-13 21:57
.
Pre-Run: 39,175,544,832 bytes free
Post-Run: 39,395,745,792 bytes free
.
- - End Of File - - FF471BB89BA75413A4D54693069B9243

=====

It seems there are no hidden files so that means no rootkit viruses present?
Post #6
Hi RE-Ignite,

Looks like ComboFix did it's job and picked up a few remnants. You're right, there appears not to be any rootkits still lurking on your system.

As far as removing AVG, you can give this utility a shot:

Please download AppRemover and save it to your desktop.
  • Double click on AppRemover.exe to run it.
  • Uncheck "Enable anonymous usage statistics. No personal data will be recorded."
  • Click on the Next button.
  • Click on "Remove Security Application" or "Clean Up a Failed Uninstall" depending on what you want to do. (you want the failed uninstall)
  • Click on the Next button.
  • A scan begins, please wait. Once done, click on the Next button.
  • Now you should have a list of your installed programs, choose the one you want to remove and click on the Next button.
  • Follow the last step and reboot if asked to do so.
===================================================

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
===================================================
  • Please download Security Check by screen317 from here or here and save the file (called securitycheck.exe) to your desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box (NOTE: If you are running Vista or Win7 please Right click and select "Run as Administrator"..
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document in your next reply.
Post #7
Ok. Thanks, I will try them out. You also said out of all the anti-viruses that you recommend Microsoft Essentials right? How does AVG Free, Avira, and Avast compete with it?
Post #8
Hi RE-Ignite,

Yes, I recommend Microsoft Security Essentials.

Between MSE, Avira, and Avast, it's really a toss up and it comes down to what you value in an antivirus software package.

Give this review a read.

I don't recommend AVG because it conflicts with our tools.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI