What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

zero access rootkit infection [Solved]

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello amitemurray

question: why doesn't System Restore ever work on my XP laptop?

We can look into that in depth when we get back to your laptop. In the meanwhile, have a look here:
http://www.bleepingcomputer.com/tutorials/…e-guide/#enable



P2P - I see you have P2P software ( limewire and frostwire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.

If you choose to leave them on the machine, please refrain from using them while we are cleaning the machine to prevent further infection.


Next, we need to run an OTL Fix

  • Please reopen [external image: Posted Image].
  • Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

    :Services

:OTL
FF - prefs.js..extensions.enabledItems: [removed]:1.2
[2011/04/03 21:14:39 | 000,000,000 | —D | M] (Search Toolbar) – C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\[removed]
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O4 - HKLM..\Run: [] File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found 
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe File not found
O9 - Extra 'Tools' menuitem : &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe File not found
[2012/01/05 20:56:44 | 000,000,000 | —D | C] – C:\Windows\TEMP
[2012/01/05 20:40:21 | 000,000,000 | —D | C] – C:\Users\Patrick\AppData\Local\temp(67)
[2011/12/15 03:08:29 | 000,000,000 | —D | C] – C:\42fd4bfb158e7429c5aa41
[2012/01/05 20:15:20 | 000,010,114 | -HS- | M] () – C:\ProgramData\15wsyw72s701ub5lg7xwn23k2o2v66202upu6846f6xi08

:Commands
[purity]
[emptytemp]
[Reboot]

  • Push [external image: Posted Image]
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click [external image: Posted Image].
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


It is odd that both machines are infected simultaneously. Have you carried files back and forth between the laptop and the desktop with a thumb drive?
How is the machine behaving? Are there any issues?
Post #17
Hi Sunyata,
Thank you for your P2P recommendations. I was not aware those programs were on the machine, and they have been deleted.

Yes, it is quite a coincidence that both machines got infected, and no, files were not being carried back and forth (except when you were working with me–files like OTL, aswMBR, Farbar, etc.).

This machine is behaving normally. The first time I ran the fix on OTL it froze, but then I ran it again (using Run as Adminstrator) and it finished. Here is the log:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Prefs.js: [removed]:1.2 removed from extensions.enabledItems
Folder C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\eht8wzm6.default\extensions\[removed]\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
File C:\Program Files\Search Toolbar\SearchToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{9D425283-D487-4337-BAB6-AB8354A81457} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
File C:\Program Files\Search Toolbar\SearchToolbar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{9D425283-D487-4337-BAB6-AB8354A81457} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
File C:\Program Files\Search Toolbar\SearchToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}\ not found.
C:\Windows\TEMP folder moved successfully.
Folder C:\Users\Patrick\AppData\Local\temp(67)\ not found.
Folder C:\42fd4bfb158e7429c5aa41\ not found.
File C:\ProgramData\15wsyw72s701ub5lg7xwn23k2o2v66202upu6846f6xi08 not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Margaret
->Temp folder emptied: 212056 bytes
->Temporary Internet Files folder emptied: 2351200 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Patrick
->Temp folder emptied: 243621537 bytes
->Temporary Internet Files folder emptied: 189124845 bytes
->Java cache emptied: 1180801 bytes
->FireFox cache emptied: 93101178 bytes
->Google Chrome cache emptied: 40181487 bytes
->Apple Safari cache emptied: 184324096 bytes
->Flash cache emptied: 2381992 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 1204366782 bytes

Total Files Cleaned = 1,870.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 01082012_091243
Post #18
Hello amitemurray

This machine is behaving normally.

:thumbup:

Then we should sweep for leftovers…

Scan For Malware:

Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.



Do An Online Scan For Viruses:

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window. ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as MyEsetScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
In your next reply please post the logs created by Malwarebytes and the ESET Online Scan.
Post #19
Hi Sunyata, Malwarebytes is acting a little strange. It froze, so I uninstalled it and re-installed it. Here are both logs: Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.08.03 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 8.0.6001.19170 Margaret :: FAMLIYPC [limited] 1/8/2012 3:11:51 PM mbam-log-2012-01-08 (15-11-51).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 152218 Time elapsed: 4 minute(s), 12 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Program Files\Unlocker\eBay_shortcuts_1016.exe (Adware.Clicker) -> Delete on reboot. (end) C:\$Recycle.Bin\S-1-5-21-4253253780-2263761584-637675255-1001\$RGWZAP1.exe a variant of Win32/InstallCore.D application C:\Program Files\Unlocker\eBay_shortcuts_1016.exe Win32/Adware.ADON application C:\Program Files\YTD Setup\trafficplace-us-2-silent.exe Win32/Toolbar.Zugo application C:\Qoobox\Quarantine\C\Users\Margaret\AppData\Local\toi.exe.vir a variant of Win32/Kryptik.YMK trojan
Post #21
Hello amitemurray

One more thing–on the AVG, I was able to de-activate the Resident Shield, but not the Anti-Virus or the Anti-Spyware.

We are OK with this as long as the tools keep running.

Please run another OTL fix

  • Please reopen [external image: Posted Image].
  • Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

    :Services

:Files
C:\$Recycle.Bin\S-1-5-21-4253253780-2263761584-637675255-1001\$RGWZAP1.exe
C:\Program Files\YTD Setup\trafficplace-us-2-silent.exe

:Commands
[Reboot]

  • Push [external image: Posted Image]
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click [external image: Posted Image].
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

Your Java is out of date…

Please download JavaRa and unzip it to its own folder

  • Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista or Windows 7), pick the language of your choice and click "Select".
  • Then click "Remove Older Versions".
  • Accept any prompts.
  • Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista or Windows 7) again and select "Search For Updates".
  • Select "Update Using Sun Java's Website".
  • Then click "Search" and click on the "Open Webpage" button.
  • Download and install the latest Java Runtime Environment (JRE) version for your computer.


Update Adobe Reader

Your version of Adobe Reader is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.
  • Go to Add/Remove Programs and remove all versions of Adobe Reader.
  • Click here to download the latest version of Adobe Reader.
Post #22
Hi Sunyata, Java and Adobe updated. Latest OTL log: ========== SERVICES/DRIVERS ========== ========== FILES ========== C:\$Recycle.Bin\S-1-5-21-4253253780-2263761584-637675255-1001\$RGWZAP1.exe moved successfully. C:\Program Files\YTD Setup\trafficplace-us-2-silent.exe moved successfully. ========== COMMANDS ========== OTL by OldTimer - Version 3.2.31.0 log created on 01082012_202617
Post #23
Hello amitemurray

Your desktop looks to be ALL CLEAN.
We will just clean up our tools here, then we can finish with the laptop…



Please delete from your desktop:
  • The logs we created
  • aswmbr.exe
  • DDS.scr

Follow these steps to uninstall Combofix

  • Make sure your security programs are totally disabled.
  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.
[external image: Posted Image]

The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Next, Please re-enable any security that was disabled.


Next,

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep it updated and use it regularly.
ESET online scan can be removed via add/remove programs.

Post #25
Hello amitemurray

Thank you, Sunyata!
All of your instructions in post #23 have been followed. The desktop is working great. On to the laptop!

You are welcome. Our pleasure, I'm sure. :thumbup:

You had mentioned problems with System Restore on this laptop. Your DDS "Extras.txt" log shows that you have many restore points created.
It also shows that you have an automated Checkpoint after an OTL scan on 1/5/2012.
So is System Restore working ok now?
Here is a link that describes some conditions where an automated System Restore Checkpoint is not created:
http://windowsxp.mvps.org/checkpoints.htm

First lets get a look at that AutoUpdate thing you've got in your uninstall list:

Please download SystemLook by jpshortstuff from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :reg
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AutoUpdate /sub

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt


Next,

Please re-run FSS.exe
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.


Next,

Please re-run ComboFix:

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

http://forums.whatthetech.com/index.php?showtopic=121865&st=0&gopid=767473&#entry767473

DDS::
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - 

Collect::
C:\Documents and Settings\Murray Quin\My Documents\8a2DcUY.exe

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


In your next post, please include:
  • SystemLook.txt
  • FSS.txt
  • The ComboFix log
Post #26
Hi Sunyata,
It's great to be back working on my computer! System Restore worked for me for the first time. I did the same things I always have…??

ComboFix did something it never did before–submit files for analysis.

SystemLook 30.07.11 by jpshortstuff
Log created at 18:09 on 09/01/2012 by Murray Quin
Administrator - Elevation successful

========== reg ==========

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AutoUpdate]
(Unable to open key - key not found)

-= EOF =-



Farbar Service Scanner
Ran by [removed] (administrator) on 09-01-2012 at 18:13:29
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
aswTdi(11) Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3)
0x0C000000040000000100000002000000030000000B000000560000000900000005000000060000
0007000000080000000A000000
IpSec Tag value is correct.

**** End of log ****


ComboFix 12-01-05.04 - Murray Quin 01/09/2012 18:29:08.11.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.213 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Murray Quin\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
file zipped: c:\documents and settings\Murray Quin\My Documents\8a2DcUY.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-12-10 to 2012-01-10 )))))))))))))))))))))))))))))))
.
.
2012-01-09 23:56 . 2012-01-09 23:56 ——– d—–w- c:\windows\system32\wbem\Repository
2012-01-06 21:51 . 2012-01-06 21:51 ——– d—–w- c:\documents and settings\Murray Quin\Application Data\Free-backup.info
2012-01-06 21:42 . 2012-01-06 21:42 ——– d—–w- c:\documents and settings\Murray Quin\Application Data\ZipGenius
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-28 18:01 . 2010-11-06 13:58 41184 —-a-w- c:\windows\avastSS.scr
2011-11-28 18:01 . 2010-11-06 13:58 199816 —-a-w- c:\windows\system32\aswBoot.exe
2011-11-28 17:53 . 2011-09-12 10:43 435032 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2010-11-06 13:59 314456 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2010-11-06 13:58 34392 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2010-11-06 13:58 52952 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2010-11-06 13:58 111320 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-11-28 17:51 . 2010-11-06 13:58 105176 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-11-28 17:51 . 2010-11-06 13:59 20568 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-11-28 17:48 . 2010-11-06 13:58 30808 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-11-23 13:25 . 2005-08-16 10:18 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-15 20:29 . 2010-10-30 14:06 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-11-01 16:07 . 2005-08-16 10:18 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-31 23:43 . 2005-08-16 10:18 832512 —-a-w- c:\windows\system32\wininet.dll
2011-10-31 23:43 . 2005-08-16 10:18 78336 —-a-w- c:\windows\system32\ieencode.dll
2011-10-31 23:43 . 2005-08-16 10:18 1830912 —-a-w- c:\windows\system32\inetcpl.cpl
2011-10-31 23:43 . 2005-08-16 10:18 17408 —-a-w- c:\windows\system32\corpol.dll
2011-10-28 05:31 . 2005-08-16 10:18 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:33 . 2005-08-16 10:18 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2004-08-04 04:59 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-14 23:38 . 2005-08-16 10:18 456192 —-a-w- c:\windows\system32\encdec.dll
2006-11-23 03:04 . 2005-06-19 00:47 231258 —-a-w- c:\program files\pikachu.exe
2011-11-11 10:01 . 2011-05-04 11:04 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-22_16.41.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-10 00:47 . 2012-01-10 00:47 16384 c:\windows\Temp\Perflib_Perfdata_54c.dat
+ 2005-08-16 10:18 . 2012-01-06 01:59 61488 c:\windows\system32\perfc009.dat
- 2005-08-16 10:18 . 2011-12-22 16:34 61488 c:\windows\system32\perfc009.dat
+ 2008-09-07 11:57 . 2008-04-13 19:19 75264 c:\windows\system32\drivers\ipsec.sys
- 2005-08-16 10:18 . 2008-04-13 19:19 75264 c:\windows\system32\drivers\ipsec.sys
+ 2008-09-07 11:57 . 2008-04-13 19:19 75264 c:\windows\system32\dllcache\ipsec.sys
+ 2005-08-16 10:18 . 2012-01-06 01:59 400090 c:\windows\system32\perfh009.dat
- 2005-08-16 10:18 . 2011-12-22 16:34 400090 c:\windows\system32\perfh009.dat
+ 2008-09-17 02:13 . 2012-01-09 23:57 4956208 c:\windows\system32\Restore\rstrlog.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Murray Quin^Start Menu^Programs^Startup^Moo0 Magnifier 1.10.lnk]
backup=c:\windows\pss\Moo0 Magnifier 1.10.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 17:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2005-08-06 03:05 344064 —-a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2006-11-01 17:48 1392640 —-a-w- c:\windows\system32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 11:20 122940 —-a-w- c:\windows\system32\DLA\DLACTRLW.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 16:43 248040 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\rundisabled]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Dell Wireless Manager UI"=c:\windows\system32\WLTRAY
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [9/12/2011 4:43 AM 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/6/2010 7:59 AM 314456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/6/2010 7:59 AM 20568]
S2 gupdate1c999ed12312ca2;Google Update Service (gupdate1c999ed12312ca2);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2009 3:39 PM 133104]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2009 3:39 PM 133104]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
2012-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-28 21:39]
.
2012-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-28 21:39]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/?ilc=17
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: motive.com\pattta.att
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 192.168.2.1
DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} - hxxp://tcapps.selu.edu/timecentre/Common/pvcombo.cab
DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} - hxxp://tcapps.selu.edu/timecentre/Common/iemenu.cab
FF - ProfilePath - c:\documents and settings\Murray Quin\Application Data\Mozilla\Firefox\Profiles\xjnvebmq.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z128&form=ZGAADF&install_date=20111123&q=
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-09 18:49
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
.
C:\## aswSnx private storage
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(908)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(276)
c:\windows\system32\WININET.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Google\Update\1.3.21.79\GoogleCrashHandler.exe
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\program files\Apoint\HidFind.exe
c:\program files\Apoint\Apntex.exe
.
**************************************************************************
.
Completion time: 2012-01-09 18:56:18 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-10 00:56
ComboFix2.txt 2012-01-06 12:19
ComboFix3.txt 2011-12-27 23:39
ComboFix4.txt 2011-12-27 21:19
ComboFix5.txt 2012-01-10 00:22
.
Pre-Run: 11,818,328,064 bytes free
Post-Run: 11,870,867,456 bytes free
.
- - End Of File - - 13C0C67D4E94A0281AC4F2DDA6021D2B
Upload was successful
Post #27
Hello amitemurray

It's great to be back working on my computer!

:thumbup: We are thrilled for ya!

System Restore worked for me for the first time. I did the same things I always have…??

It looks to me like your last OTL scan fixed things up for you automatically.

ComboFix did something it never did before–submit files for analysis.

sUBs, the author of ComboFix :notworthy:, likes to investigate evil files that somehow slip his net.




We still want to see what your AutoUpdate install is all about, but we have to dig a little deeper (this may take awhile):
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :reg
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall /sub

:regfind
AutoUpdate

:filefind
*AutoUpdate*

:folderfind
*AutoUpdate*

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Next we want to sweep for any stragglers that might be lurking…

Scan For Malware:

Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.



Do An Online Scan For Viruses:

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window. ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as MyEsetScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
In your next reply please post the logs created by SystemLook, Malwarebytes and the ESET Online Scan.

Post #28
Hi Sunyata, I really appreciate your help. While I was running the Malwarebytes scan a warning popped up from Avast about stopping a rootkit. Here is the log from Avast: Files scanned/infectd: 1430/1 Last file scanned: C:\Documents and Settings\Murray Quin\Recent\mbam-log-2012-01-10 (16-45-44).lnk Last file infected: c:\WINDOWS\PEV.exe |>[PECompact] ******** Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.10.06 Windows XP Service Pack 3 x86 NTFS Internet Explorer 7.0.5730.11 Murray Quin :: DCCB7L91 [administrator] 1/10/2012 4:45:44 PM mbam-log-2012-01-10 (16-45-44).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 239594 Time elapsed: 15 minute(s), 51 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) *******here is the MyEsetScan.txt C:\Documents and Settings\Murray Quin\Application Data\Sun\Java\Deployment\cache\6.0\17\a6b54d1-5a3708c9 a variant of Java/Agent.DZ trojan C:\Documents and Settings\Murray Quin\Application Data\Sun\Java\Deployment\cache\6.0\6\511051c6-7a03b2dd a variant of Java/Agent.DZ trojan C:\Documents and Settings\Murray Quin\Application Data\Sun\Java\Deployment\cache\6.0\8\1a03c108-60649a2a a variant of Java/Agent.DZ trojan C:\Qoobox\Quarantine\[4]-Submit_2012-01-09_18.28.39.zip a variant of Win32/Kryptik.YCD trojan C:\Qoobox\Quarantine\C\Documents and Settings\Murray Quin\Local Settings\Application Data\gml.exe.vir a variant of Win32/Kryptik.YCD trojan C:\Qoobox\Quarantine\C\Program Files\StartNow Toolbar\StartNowToolbarUninstall.exe.vir Win32/Toolbar.Zugo application C:\Qoobox\Quarantine\C\Program Files\StartNow Toolbar\Toolbar32.dll.vir a variant of Win32/Toolbar.Zugo application C:\Qoobox\Quarantine\C\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe.vir a variant of Win32/Toolbar.Zugo application C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP21\A0004371.exe a variant of Win32/Kryptik.YCD trojan C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP29\A0007880.exe a variant of Win32/InstallCore.D application I zipped the SystemLook log and attached it.

Attachments:

  • [attachment removed: SystemLook.zip]
Post #29
Hello amitemurray

a warning popped up from Avast about stopping a rootkit

Not to worry. The warning is about a piece of one of our tools. Our tools often look like malware to various scanners.

[external image: Posted Image]Your Java is out of date.
Java™ 6 Update 26 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now.
An update should begin; > follow the prompts.


Clear Java cache

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup) If you do not see the icon, look to your left and click 'Switch to Classic View'.

  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked

    Applications and Applets
    Trace and Log Files

  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.

…and let's get a fresh DDS log
  • Double click DDS.scr to run it and wait for the scan to finish
  • When finished DDS.txt will open
  • A small while later, a prompt will open. Answer Yes
  • DDS will continue scanning
  • When done, Attach.txt will open
  • Post DDS.txt and attach Attach.txt
How is your laptop behaving? Are there any issues?
Post #30
Hi Sunyata,

How is your laptop behaving? Are there any issues?


Laptop is behaving normally. No issues.

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 5:19:52.25 on Wed 01/11/2012
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_30
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.115 [GMT -6:00]
.
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\1.3.21.79\GoogleCrashHandler.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Documents and Settings\Murray Quin\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/?ilc=17
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: CIEDownload Object: {67bcf957-85fc-4036-8dc4-d4d80e00a77b} - c:\program files\smart technologies\smart notebook\NotebookPlugin.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\googleafe\GoogleAE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: motive.com\pattta.att
Trusted Zone: motive.com\patttbc.att
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://echat.bellsouth.net/sdccommon/download/tgctlcm.cab
DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} - hxxp://tcapps.selu.edu/timecentre/Common/pvcombo.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} - hxxp://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} - hxxp://tcapps.selu.edu/timecentre/Common/iemenu.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} - hxxp://tcapps.selu.edu/viewer/activeXViewer/activexviewer.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - file:///C:/Documents%20and%20Settings/Patrick%20Quin/Local%20Settings/Application%20Data/Oberon%20Media/Oberon%20Games%20Host/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\murray~1\applic~1\mozilla\firefox\profiles\xjnvebmq.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - www.yahoo.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z128&form=ZGAADF&install_date=20111123&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-9-12 435032]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-11-6 314456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-11-6 20568]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-9-12 44768]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S2 gupdate1c999ed12312ca2;Google Update Service (gupdate1c999ed12312ca2);c:\program files\google\update\GoogleUpdate.exe [2009-2-28 133104]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-2-28 133104]
.
=============== Created Last 30 ================
.
2012-01-10 23:14:01 ——– d—–w- c:\program files\ESET
2012-01-10 22:15:45 548864 —-a-w- c:\program files\mozilla firefox\msvcp80.dll
2012-01-10 22:15:45 479232 —-a-w- c:\program files\mozilla firefox\msvcm80.dll
2012-01-10 22:15:45 43992 —-a-w- c:\program files\mozilla firefox\mozutils.dll
2012-01-10 22:15:44 626688 —-a-w- c:\program files\mozilla firefox\msvcr80.dll
2012-01-09 23:56:38 ——– d—–w- c:\windows\system32\wbem\repository\FS
2012-01-09 23:56:38 ——– d—–w- c:\windows\system32\wbem\Repository
2012-01-06 21:51:59 ——– d—–w- c:\docume~1\murray~1\applic~1\Free-backup.info
2012-01-06 21:42:33 ——– d—–w- c:\docume~1\murray~1\applic~1\ZipGenius
.
==================== Find3M ====================
.
2011-11-28 18:01:25 41184 —-a-w- c:\windows\avastSS.scr
2011-11-23 13:25:32 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-15 20:29:56 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-11-10 11:54:13 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-11-10 09:27:10 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-11-01 16:07:10 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-31 23:43:21 832512 —-a-w- c:\windows\system32\wininet.dll
2011-10-31 23:43:21 78336 —-a-w- c:\windows\system32\ieencode.dll
2011-10-31 23:43:21 1830912 —-a-w- c:\windows\system32\inetcpl.cpl
2011-10-31 23:43:20 17408 —-a-w- c:\windows\system32\corpol.dll
2011-10-28 05:31:48 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:33:08 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52:03 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-14 23:38:00 456192 —-a-w- c:\windows\system32\encdec.dll
2006-11-23 03:04:29 231258 —-a-w- c:\program files\pikachu.exe
.
============= FINISH: 5:21:28.59 ===============

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI