What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

searchqu.com405

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello apti2de,

That is fine you downloaded Microsoft Security Essentials. :thumbup: I'm going through your log now.we're almost done. We will remove the tools I had you downloaded later. How is the computer running now after running Combofix?
Post #18
Hello apti2de,

Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please

====================
NEXT


ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Summary of the logs I need from you in your next post:
Malwarebytes log
ESET log
Post #19
Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.12.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 RobertWiedemann :: EASTWOOD-8D7477 [administrator] 1/12/2012 6:45:24 PM mbam-log-2012-01-12 (18-54-34).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 241815 Time elapsed: 6 minute(s), 43 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Documents and Settings\RobertWiedemann\My Documents\Downloads\WeatherBlink.exe (Adware.FunWeb) -> No action taken. (end)
Post #20
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinVBlu.zip Win32/Bagle.gen.zip worm C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZangoShoppingReport9.zip Win32/Bagle.gen.zip worm C:\Documents and Settings\All Users.WINDOWS\Application Data\{ACFC9F59-F1AE-43D2-8CFE-E2F1E0F82ABA}\SavevidSetupV2.res a variant of Win32/Toolbar.SearchSuite application C:\Documents and Settings\RobertWiedemann\My Documents\Downloads\registrybooster.exe Win32/RegistryBooster application C:\Documents and Settings\RobertWiedemann\My Documents\Downloads\SavevidSetupV2.exe a variant of Win32/Toolbar.SearchSuite application C:\Documents and Settings\RobertWiedemann\My Documents\Downloads\WeatherBlink.exe a variant of Win32/AdInstaller application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP535\A0051948.exe a variant of Win32/AdInstaller application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP535\A0052201.exe a variant of Win32/AdInstaller application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP576\A0054989.dll Win32/Toolbar.Zugo application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056577.dll a variant of Win32/Toolbar.MyWebSearch.A application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056582.dll probably a variant of Win32/Toolbar.MyWebSearch.F application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056583.dll probably a variant of Win32/Toolbar.MyWebSearch.B application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056586.dll a variant of Win32/Toolbar.MyWebSearch.P application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056591.dll a variant of Win32/Toolbar.MyWebSearch application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056596.dll a variant of Win32/Toolbar.MyWebSearch.P application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056613.dll a variant of Win32/Toolbar.SearchSuite application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056614.exe a variant of Win32/Toolbar.SearchSuite application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056615.dll probably a variant of Win32/Toolbar.SearchSuite application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056623.dll a variant of Win32/Toolbar.SearchSuite application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056624.dll a variant of Win32/Toolbar.SearchSuite application C:\System Volume Information\_restore{F677DC24-84DA-44B2-B284-E3422CF97F42}\RP582\A0056625.dll probably a variant of Win32/Toolbar.SearchSuite application
Post #21
As I was closing the anti malware program it told that the scan was still in progress but I thought it was done. I'm not sure if I screwed it up. Let me know. Sorry
Post #23
Hi apti2de,

Some of the files ESET found are in Spybot Recovery and System restore which we will remove when we clean up the tools we used.

Should you wish to remove the files in Spybot.
Open Spbybot Search and Destroy by double clicking icon in All Programs, or on desktop
Or left click Spybot icon in systray near the clock lower right corner of your screen.
Click on Recovery on left side of window.
Check all items in white box
Click on Red X on toolbar.
Close Spybot S&D
================
Next


Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\All Users.WINDOWS\Application Data\{ACFC9F59-F1AE-43D2-8CFE-E2F1E0F82ABA}\SavevidSetupV2.res
C:\Documents and Settings\RobertWiedemann\My Documents\Downloads\registrybooster.exe
C:\Documents and Settings\RobertWiedemann\My Documents\Downloads\SavevidSetupV2.exe
C:\Documents and Settings\RobertWiedemann\My Documents\Downloads\WeatherBlink.exe


Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Summary of the logs I need from you in your next post:
Combofix log
MBAM log
let me know if you have any more issues
Post #24
ComboFix 12-01-13.05 - RobertWiedemann 01/13/2012 18:39:35.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.543 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\RobertWiedemann\My Documents\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\documents and settings\All Users.WINDOWS\Application Data\{ACFC9F59-F1AE-43D2-8CFE-E2F1E0F82ABA}\SavevidSetupV2.res"
"c:\documents and settings\RobertWiedemann\My Documents\Downloads\registrybooster.exe"
"c:\documents and settings\RobertWiedemann\My Documents\Downloads\SavevidSetupV2.exe"
"c:\documents and settings\RobertWiedemann\My Documents\Downloads\WeatherBlink.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users.WINDOWS\Application Data\{ACFC9F59-F1AE-43D2-8CFE-E2F1E0F82ABA}\SavevidSetupV2.res
c:\documents and settings\RobertWiedemann\My Documents\Downloads\registrybooster.exe
c:\documents and settings\RobertWiedemann\My Documents\Downloads\SavevidSetupV2.exe
c:\documents and settings\RobertWiedemann\My Documents\Downloads\WeatherBlink.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-12-13 to 2012-01-13 )))))))))))))))))))))))))))))))
.
.
2012-01-13 23:12 . 2012-01-13 23:12 29904 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{75F7A068-B01E-4914-88FC-9F8D66E4807B}\MpKsl0b8d70f2.sys
2012-01-13 23:12 . 2012-01-13 23:12 56200 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{75F7A068-B01E-4914-88FC-9F8D66E4807B}\offreg.dll
2012-01-13 23:12 . 2011-11-21 07:47 6823496 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{75F7A068-B01E-4914-88FC-9F8D66E4807B}\mpengine.dll
2012-01-13 23:03 . 2012-01-13 23:03 ——– d—–w- c:\windows\LastGood
2012-01-13 00:04 . 2012-01-13 00:04 ——– d—–w- c:\program files\ESET
2012-01-12 23:43 . 2012-01-12 23:43 ——– d—–w- c:\documents and settings\RobertWiedemann\Application Data\Malwarebytes
2012-01-12 23:42 . 2012-01-12 23:42 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2012-01-12 23:42 . 2012-01-12 23:43 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-01-12 23:42 . 2011-12-10 20:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-01-12 23:01 . 2011-11-21 07:47 6823496 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-01-10 23:33 . 2012-01-10 23:34 ——– d—–w- c:\program files\Microsoft Security Client
2012-01-09 22:41 . 2012-01-09 22:41 ——– d—–w- C:\_OTL
2012-01-03 23:26 . 2001-08-17 18:48 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2012-01-03 23:26 . 2001-08-17 18:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2012-01-03 23:26 . 2008-04-13 18:45 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2012-01-03 23:26 . 2008-04-13 18:45 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2011-12-31 08:18 . 2011-12-31 08:18 ——– d—–w- c:\documents and settings\RobertWiedemann\AppData
2011-12-16 01:02 . 2011-12-16 01:02 ——– d—–w- c:\documents and settings\RobertWiedemann\Application Data\DVDVideoSoft
2011-12-16 01:02 . 2011-12-16 01:02 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2011-12-16 01:02 . 2011-12-16 01:02 ——– d—–w- c:\program files\DVDVideoSoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-09 07:59 . 2011-06-05 05:42 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-25 21:57 . 2004-08-04 10:00 293376 —-a-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25 . 2004-08-04 10:00 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-18 12:35 . 2004-08-04 10:00 60416 —-a-w- c:\windows\system32\packager.exe
2011-11-04 19:20 . 2006-03-04 03:33 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-04 10:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2004-08-04 10:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-04 10:00 385024 —-a-w- c:\windows\system32\html.iec
2011-11-03 15:28 . 2004-08-04 10:00 386048 —-a-w- c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2004-08-04 10:00 1292288 —-a-w- c:\windows\system32\quartz.dll
2011-11-01 16:07 . 2004-08-04 10:00 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-04 10:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2005-03-30 01:21 2148864 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2005-03-30 01:01 2027008 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2004-08-04 10:00 186880 —-a-w- c:\windows\system32\encdec.dll
2011-11-28 21:24 . 2011-11-10 23:09 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-10_23.14.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-13 23:01 . 2012-01-13 23:01 16384 c:\windows\Temp\Perflib_Perfdata_624.dat
- 2004-08-04 10:00 . 2012-01-10 21:57 76732 c:\windows\system32\perfc009.dat
+ 2004-08-04 10:00 . 2012-01-13 23:05 76732 c:\windows\system32\perfc009.dat
- 2004-08-04 10:00 . 2008-04-14 00:11 23040 c:\windows\system32\mciseq.dll
+ 2004-08-04 10:00 . 2011-10-14 14:47 23040 c:\windows\system32\mciseq.dll
+ 2011-11-18 12:35 . 2011-11-18 12:35 60416 c:\windows\system32\dllcache\packager.exe
+ 2011-10-14 14:47 . 2011-10-14 14:47 23040 c:\windows\system32\dllcache\mciseq.dll
- 2004-08-04 10:00 . 2008-04-14 00:12 176128 c:\windows\system32\winmm.dll
+ 2004-08-04 10:00 . 2011-10-14 14:47 176128 c:\windows\system32\winmm.dll
- 2004-08-04 10:00 . 2012-01-10 21:57 456898 c:\windows\system32\perfh009.dat
+ 2004-08-04 10:00 . 2012-01-13 23:05 456898 c:\windows\system32\perfh009.dat
+ 2010-04-09 05:32 . 2010-10-19 20:51 222080 c:\windows\system32\MpSigStub.exe
+ 2011-04-18 18:18 . 2011-04-18 18:18 165648 c:\windows\system32\drivers\MpFilter.sys
+ 2010-06-18 17:45 . 2011-11-25 21:57 293376 c:\windows\system32\dllcache\winsrv.dll
- 2010-06-18 17:45 . 2011-06-20 17:44 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2011-10-14 14:47 . 2011-10-14 14:47 176128 c:\windows\system32\dllcache\winmm.dll
+ 2011-11-03 15:28 . 2011-11-03 15:28 386048 c:\windows\system32\dllcache\qdvd.dll
+ 2012-01-10 23:34 . 2012-01-10 23:34 785920 c:\windows\Installer\5c79e4.msi
+ 2012-01-10 23:34 . 2012-01-10 23:34 483840 c:\windows\Installer\5c79de.msi
+ 2012-01-10 23:33 . 2012-01-10 23:33 301056 c:\windows\Installer\5c79d9.msi
+ 2009-02-17 05:17 . 2011-11-03 15:28 1292288 c:\windows\system32\dllcache\quartz.dll
+ 2009-02-18 19:59 . 2012-01-11 23:14 52128560 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pareto_Update"="c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe" [2009-01-13 189808]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-31 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-31 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-30 138008]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-08-20 1368064]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-06-15 47408]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 MpKsl0b8d70f2;MpKsl0b8d70f2;c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{75F7A068-B01E-4914-88FC-9F8D66E4807B}\MpKsl0b8d70f2.sys [1/13/2012 6:12 PM 29904]
R2 ptumlcmsvc;PTUML290 Connection Manager Service;c:\windows\system32\ptumlcmsvc.exe [2/15/2011 10:35 PM 106496]
R3 PTUMLBUS;PTUML USB Composite Device Driver;c:\windows\system32\drivers\PTUMLBUS.sys [8/7/2011 8:41 PM 59792]
R3 PTUMLCVsp;PANTECH UML290 Connection Manager Port;c:\windows\system32\drivers\PTUMLCVsp.sys [8/7/2011 8:41 PM 168208]
R3 PTUMLMdm;PANTECH UML290;c:\windows\system32\drivers\PTUMLMdm.sys [8/7/2011 8:41 PM 168208]
R3 PTUMLNET;PANTECH UML290 WWAN;c:\windows\system32\drivers\PTUMLNET.sys [8/7/2011 8:41 PM 80912]
R3 PTUMLNVsp;PANTECH UML290 NMEA Port;c:\windows\system32\drivers\PTUMLNVsp.sys [8/7/2011 8:41 PM 168848]
R3 PTUMLRMNET;PANTECH UML290 RMNET Service;c:\windows\system32\drivers\PTUMLRMNET.sys [8/7/2011 8:42 PM 60432]
R3 PTUMLVsp;PANTECH UML290 Diagnostic Port;c:\windows\system32\drivers\PTUMLVsp.sys [8/7/2011 8:41 PM 168208]
R3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 7:29 PM 32408]
S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\DRIVERS\PTDUBus.sys –> c:\windows\system32\DRIVERS\PTDUBus.sys [?]
S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\DRIVERS\PTDUMdm.sys –> c:\windows\system32\DRIVERS\PTDUMdm.sys [?]
S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\DRIVERS\PTDUVsp.sys –> c:\windows\system32\DRIVERS\PTDUVsp.sys [?]
S3 PTDUWFLT;PTDUWWAN Filter Driver;c:\windows\system32\DRIVERS\PTDUWFLT.sys –> c:\windows\system32\DRIVERS\PTDUWFLT.sys [?]
S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\DRIVERS\PTDUWWAN.sys –> c:\windows\system32\DRIVERS\PTDUWWAN.sys [?]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL0B8D70F2
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 22:57]
.
2012-01-13 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 20:39]
.
2012-01-13 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]
.
2012-01-12 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
2012-01-08 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - {A69A551A-1AAE-4B67-8C2E-52F8B8A19504} - c:\program files\Superfish\Window Shopper\SuperfishIEAddon.dll
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\documents and settings\RobertWiedemann\Application Data\Mozilla\Firefox\Profiles\jcgqccuk.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/p/1.html?_bc=1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-13 18:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(468)
c:\windows\system32\netprovcredman.dll
.
Completion time: 2012-01-13 18:51:03
ComboFix-quarantined-files.txt 2012-01-13 23:50
ComboFix2.txt 2012-01-10 23:18
.
Pre-Run: 3,069,829,120 bytes free
Post-Run: 3,052,019,712 bytes free
.
- - End Of File - - 01849EACC9C0C6EA52F32805067E766F
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.12.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
RobertWiedemann :: EASTWOOD-8D7477 [administrator]

1/12/2012 6:45:24 PM
mbam-log-2012-01-12 (18-54-34).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 241815
Time elapsed: 6 minute(s), 43 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Documents and Settings\RobertWiedemann\My Documents\Downloads\WeatherBlink.exe (Adware.FunWeb) -> No action taken.

(end)
By the way! cannot find spybot
Post #25
Hi apti2de,

By the way! cannot find spybot

Its ok the bad files or in quarantine so no worries.
Do you have anymore issues? please let me know in your next reply.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Click your start button > Control Panel
  • If it isn't all ready please set the View by to small icons
  • Locate Java (32 bit) (it looks like a coffee cup) in the list
  • right click it and click "Run as administrator"
  • Click the Update tab
  • Click update now

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 9. - Deutsch first. Be sure to move any PDF documents to another folder first though.
Post #26
Ok. All done. What do you want me to do with all of those programs we downloaded? What should I keep? What can I use? And by the way, of the myriad of emails I get everyday, yours seems to be the only useful one. I think it's great what you guys are doing and would like to contribute if I can. I'm telling everybody about you.
Post #27
Hi apti2de, :wavey:

Thank you for the kind words. :) If you would like to contribute you can go to the link below and Thank you. :)
http://www.whatthetech.com/donate/

Time for some house cleaning

Follow these steps to uninstall Combofix


* Click START Search
* Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.
(Note: There is a space between the ..X and the /U that needs to be there.)

[external image: Posted Image]
============================
Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.


    To remove aswMBR, righ click aswMBR.exe on your desktop the click delete, do the same for aswMBR.txt

    MalwareBytes, and ESET are all good anti-malware programs you may keep, be sure to update before scanning.
    ============================
    Here are some tips to reduce the potential for spyware infection in the future:

    Now that you appear clean, :thumbup: please follow these simple steps in order to keep your computer clean and secure:

    Now Set a New Restore Point to prevent possible reinfection from an old one    . Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

    The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then go to Start > Run and type: Cleanmgr
  • Click "OK".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.


1. Make your Internet Explorer More Secure
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt.
  • Change the Download unsigned ActiveX controls to Disable.
  • Change the Initialise and script ActiveX controls not marked as safe to Disable.
  • Change the Installation of desktop items to Prompt.
  • Change the Launching programs and files in an IFRAME to Prompt.
  • Change the Navigate sub-frames across different domains to Prompt.
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here

5. MVPS HOSTS FILE replaces
  • your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Download Host.zip and Save it to your Desktop.
  • Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
  • Follow the prompts and click 'Finish'.
  • This will open the newly created hosts folder on your Desktop.
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  • Once updated you should see another prompt that the task was completed.

Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Good luck, happy computing and stay clean! :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI