Spyware / Malware / Virus Removal

PING.EXE Max CPU Usage/Google Redirect [Solved]

18 min read

Looking for the outcome? Ask AI

Praveen Topic Starter

Post #1January 6, 2012, 3:39 PM UTC

Greetings

!

This has also been asked in this thread. But may be I'm a bit sceptical & worried to follow the instructions since our logs slightly differ.

As the title says I get high CPU usage becuase of the ping.exe process and also redirections when I try to click a link from the Google Search Results. I don't use any other search engines and also dont use any other browsers often than IE 8. So I have the redirection issue only when I'm using IE and not Chrome. I never use FIrefox. I'm guessing the source of the infection was a spam link that was sent via an email that looked like a genuine LinkedIn email alert. I tried running a full scan on Malwarebytes and also on Mcafee but with no success. Thaks very much in advance for putting your precious time into this.

Here are the required reports:

——-
OTL
——-

Extras.txt
———

OTL Extras logfile created on: 06/01/2012 12:10:03 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Malwarebyte Logs
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 1.61 Gb Available Physical Memory | 53.73% Memory free
5.99 Gb Paging File | 4.72 Gb Available in Paging File | 78.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 33.87 Gb Free Space | 45.45% Space Free | Partition Type: NTFS

Computer Name: A-GIFT-FROM-HBI | User Name: Praveen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{014E482A-0C27-47E3-BA82-307E9DCA2F47}" = HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7
"{01C79EF3-DE84-4B56-B638-8BEA0D507506}" = Microsoft XNA Game Studio 4.0 (XnaLiveProxy)
"{05D08C4D-58A2-438B-A419-EE994E64E15D}" = B110
"{07EEE598-5F21-4B57-B40B-46592625B3D9}" = Zune Language Pack (PTB)
"{08C84CC6-E7FD-4B2D-BBF9-B02CC90EE031}" = Microsoft XNA Game Studio 4.0 (Shared Components)
"{0C328B4F-6DEE-4061-A681-A4E576D3D0E9}" = Visual Web Service Client
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{28E77D33-0E23-47D1-9AD1-EAB86E466893}" = Map Editor
"{2A9DFFD8-4E09-4B91-B957-454805B0D7C4}" = Zune Language Pack (CHS)
"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
"{3589A659-F732-4E65-A89A-5438C332E59D}" = Zune Language Pack (ELL)
"{36F100B5-0F20-4F56-A156-6744DE52B02D}" = Send HTTP Tool
"{3F4EB5FE-B5BE-4069-A5A8-6D9262E1B379}" = Microsoft XNA Game Studio 4.0 Documentation
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{494367EC-82A9-4C0D-A788-74A967998E8C}" = FXCM Trading Station
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51C839E1-2BE4-4E77-A1BA-CCEA5DAFA741}" = Zune Language Pack (KOR)
"{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}" = Cisco Systems VPN Client 5.0.04.0300
"{565E7B0E-B76B-4EAD-9753-F1E72A5CF12E}" = HPAppStudio
"{57C51D56-B287-4C11-9192-EC3C46EF76A4}" = Zune Language Pack (RUS)
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5C93E291-A1CC-4E51-85C6-E194209FCDB4}" = Zune Language Pack (PTG)
"{5DEFD397-4012-46C3-B6DA-E8013E660772}" = Zune Language Pack (NOR)
"{5EE6E987-1B79-4A93-832B-27472C7D1579}" = WPF Toolkit February 2010 (Version 3.5.50211.1)
"{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
"{6740BCB0-5863-47F4-80F4-44F394DE4FE2}" = Zune Language Pack (NLD)
"{68BD57D3-D606-411E-A7E0-3EB6EA5660F6}" = Microsoft XNA Game Studio 4.0 (Redists)
"{6B33492E-FBBC-4EC3-8738-09E16E395A10}" = Zune Language Pack (ESP)
"{6EB931CD-A7DA-4A44-B74A-89C8EB50086F}" = Zune Language Pack (SVE)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73BE04D9-BA0E-4BAF-9C9D-677278BDB3DC}" = Microsoft XNA Game Studio 4.0 (ARP entry)
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{76BA306B-2AA0-47C0-AB6B-F313AB56C136}" = Zune Language Pack (MSL)
"{8960A0A1-BB5A-479E-92CF-65AB9D684B43}" = Zune Language Pack (PLK)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B112338-2B08-4851-AF84-E7CAD74CEB32}" = Zune Language Pack (DAN)
"{8C496FBF-DB4A-468D-A3A1-15E127382218}" = Microsoft XNA Game Studio 4.0 (Visual Studio)
"{8E4B1BE8-DCF3-4B90-A726-B28107442623}" = SolutionCenter
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" =
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile Device Center
"{92317FD2-8A6B-4CEE-B03D-18CA3244E157}" = Windows Phone Intro Video (ENU)
"{928EE567-49F9-4082-A7B3-9BB82CD3C0FE}" = Microsoft Office Communicator 2007 R2
"{92ECE3F9-591E-4C12-8A62-B9FCE38BF646}" = Zune Language Pack (IND)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-0052-0409-0000-0000000FF1CE}" = Microsoft Visio Viewer 2010
"{9B75648B-6C30-4A0D-9DE6-0D09D20AF5A5}" = Zune
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A5A53EA8-A11E-49F0-BDF5-AE536426A31A}" = Zune Language Pack (CHT)
"{A8F2E50B-86E2-4D96-9BD2-9758BCC6F9B3}" = Zune Language Pack (CSY)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = T-Mobile Mobile Broadband Manager
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.7
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B4870774-5F3A-46D9-9DFE-06FB5599E26B}" = Zune Language Pack (FIN)
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B6EC7388-E277-4A5B-8C8F-71067A41BA64}" = TextPad 5
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BBFB2E59-B0DB-42C8-8F4D-CF4E85471667}" = Toolbox
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BE236D9A-52EC-4A17-82DA-84B5EAD31E3E}" = Zune Language Pack (DEU)
"{C5D37FFA-7483-410B-982B-91E93FD3B7DA}" = Zune Language Pack (ITA)
"{C68D33B1-0204-4EBE-BC45-A6E432B1D13A}" = Zune Language Pack (FRA)
"{C6BE19C6-B102-4038-B2A6-1C313872DBB4}" = Zune Language Pack (HUN)
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CBA80824-BCC0-4050-B2FE-7254EAD1C0DD}" = Advanced HTTP Request Automaton
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C3}" = WinZip 15.5
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D8A781C9-3892-4E2E-9320-480CF896CFBB}" = Zune Language Pack (JPN)
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{F2CB8C3C-9C9E-4FAB-9067-655601C5F748}" = Windows Mobile Device Updater Component
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F80BD4BC-06B8-488E-A62E-C4755013DD71}" = Network
"{F88E2E04-7EF5-488C-8E38-C94EB808458E}" = PS_AIO_07_B110_SW_Min
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"9461-7119-9489-9274" = soapUI Pro 4.0.1 4.0.1
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced JPEG Compressor_is1" = Advanced JPEG Compressor 2011
"AVSVideoConverter" = AVSVideoConverter
"BeyondCompare3_is1" = Beyond Compare Version 3.1.11
"CCleaner" = CCleaner
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ExamDiff_is1" = ExamDiff 1.7
"Free Hide Folder" = Free Hide Folder
"Free Video Flip and Rotate_is1" = Free Video Flip and Rotate version 1.8.13.908
"FXCM Trading Station" = FXCM Trading Station
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Photo Creations" = HP Photo Creations
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"Java Web Start" = Java Web Start
"JRE 1.3.1_01" = Java 2 Runtime Environment Standard Edition v1.3.1_01
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
"Mapper" = Map Editor
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Mozilla Firefox 5.0 (x86 en-US)" = Mozilla Firefox 5.0 (x86 en-US)
"MSC" = McAfee Total Protection
"Open Video Joiner_is1" = Open Video Joiner version 3.3.0.0
"Shop for HP Supplies" = Shop for HP Supplies
"ST6UNST #1" = Ascii Codes
"Sterling Integrator Standards" = Sterling Integrator Standards
"TeamViewer 7" = TeamViewer 7
"TomTom HOME" = TomTom HOME 2.8.2.2264
"Totalcmd" = Total Commander (Remove or Repair)
"VLC media player" = VLC media player 1.1.11
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"WordWeb" = WordWeb
"XNA Game Studio 4.0" = Microsoft XNA Game Studio 4.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Zune" = Zune

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"ActiveTouchMeetingClient" = WebEx
"Google Chrome" = Google Chrome
"Modeler-pacrs979-10000" = Modeler-pacrs979-10000
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Praveen

Post #2January 6, 2012, 3:41 PM UTC

OTL.txt attached with this post since its 86KB.

Attachments:

📎OTL.Txt

Praveen

Post #3January 6, 2012, 3:42 PM UTC

————————
HijackThis Log
————————

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:27:59, on 06/01/2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16912)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\TextPad 5\TextPad.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Malwarebyte Logs\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120105224541.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [WordWeb] "C:\Program Files\WordWeb\wweb32.exe" -startup
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-21-933742835-676889697-3988407338-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ukfreetrial.webex.com/client/T27LD/…ex/ieatgpc1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\mcsniepl.dll
O20 - Winlogon Notify: nykkygy - C:\Windows\system32\config\systemprofile\AppData\Local\nykkygy.dll (file missing)
O23 - Service: McAfee Application Installer Cleanup (0310831325849593) (0310831325849593mcinstcleanup) - McAfee, Inc. - C:\Windows\TEMP\031083~1.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Windows\system32\mfevtps.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: UI Assistant Service - Unknown owner - C:\Program Files\T-Mobile Broadband Manager\T-Mobile Mobile Broadband Manager\AssistantServices.exe

–
End of file - 8947 bytes

Praveen

Post #4January 6, 2012, 3:44 PM UTC

————————
DDS.txt
————————

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_22
Run by [removed] at 12:30:28 on 2012-01-06
.
============== Running Processes ===============
.
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GR469A~1.DLL
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20120105224541.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
mRun: []
mRun: [WordWeb] "c:\program files\wordweb\wweb32.exe" -startup
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Open using &Advanced JPEG Compressor - c:\program files\advanced jpeg compressor\ajcieex.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: mswsock.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.3.1/jinstall-131_01-win.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://ukfreetrial.webex.com/client/T27LD/webex/ieatgpc1.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{B9993165-B959-46FF-B513-120AD8E42CAD} : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{B9993165-B959-46FF-B513-120AD8E42CAD}\244564F4E4 : DhcpNameServer = 192.168.22.22 192.168.22.23
TCP: Interfaces\{B9993165-B959-46FF-B513-120AD8E42CAD}\244584F6D65684572623D233B42374 : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{B9993165-B959-46FF-B513-120AD8E42CAD}\3797E6362756F6E613 : DhcpNameServer = 10.6.40.50 10.6.40.53 10.1.0.50 10.1.0.51
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GRA32A~1.DLL
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Notify: nykkygy - c:\windows\system32\config\systemprofile\appdata\local\nykkygy.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GR469A~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\praveen\appdata\roaming\mozilla\firefox\profiles\qr0ilu45.default\
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\vlc\npvlc.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\users\praveen\appdata\local\google\update\1.3.21.79\npGoogleUpdate3.dll
.
—- FIREFOX POLICIES —-
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2012-01-06 12:05:21 ——– d—–w- C:\Malwarebyte Logs
2012-01-05 22:45:35 28760 —-a-w- c:\program files\mozilla firefox\ScriptFF.dll
2012-01-05 22:09:57 ——– d—–w- c:\program files\SiteAdvisor
2012-01-05 16:11:31 ——– d—–w- c:\users\praveen\.java
2012-01-01 23:39:02 ——– d—–w- c:\windows\system32\EventProviders
2011-12-23 08:29:05 ——– d—–w- c:\users\praveen\appdata\roaming\Icpe
2011-12-22 23:35:01 ——– d—–w- c:\program files\VLC
2011-12-22 15:49:09 ——– d—–w- c:\users\praveen\appdata\roaming\DVDVideoSoft
2011-12-22 15:48:59 ——– d—–w- c:\program files\Video Flip and Rotate
2011-12-22 15:48:59 ——– d—–w- c:\program files\common files\DVDVideoSoft
2011-12-20 11:40:48 6823496 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{7f0ad6c5-2b99-4bba-9c4e-a4c1ab84e159}\mpengine.dll
2011-12-16 16:34:16 ——– d—–w- C:\T1
2011-12-14 03:23:47 ——– d-sh–w- C:\found.000
2011-12-13 20:48:56 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-13 20:48:29 2340352 —-a-w- c:\windows\system32\win32k.sys
2011-12-13 20:48:25 38912 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-13 20:46:36 3957104 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-13 20:46:36 3901808 —-a-w- c:\windows\system32\ntoskrnl.exe
.
==================== Find3M ====================
.
2012-01-02 19:32:49 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-10 15:24:06 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-06 17:25:42 150856 —-a-w- c:\windows\system32\mfevtps.exe
2011-11-05 04:35:50 981504 —-a-w- c:\windows\system32\wininet.dll
2011-11-05 04:34:15 44544 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-05 03:28:41 386048 —-a-w- c:\windows\system32\html.iec
2011-11-05 02:55:38 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-15 12:16:16 9608 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2011-10-15 12:16:16 87656 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2011-10-15 12:16:16 64880 —-a-w- c:\windows\system32\drivers\mfenlfk.sys
2011-10-15 12:16:16 59456 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2011-10-15 12:16:16 57600 —-a-w- c:\windows\system32\drivers\cfwids.sys
2011-10-15 12:16:16 464176 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2011-10-15 12:16:16 338176 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2011-10-15 12:16:16 180816 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2011-10-15 12:16:16 165680 —-a-w- c:\windows\system32\drivers\mfewfpk.sys
2011-10-15 12:16:16 121256 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2011-10-15 05:48:52 534528 —-a-w- c:\windows\system32\EncDec.dll
.
============= FINISH: 12:49:47.72 ===============

oldman960

Post #5January 7, 2012, 1:47 AM UTC

Hi Praveen, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Right click on ComboFix.exe, click Run as Administrator & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log and a new HJT (hijackthis) log.

Thanks

Praveen

Post #6January 7, 2012, 1:27 PM UTC

Thank you oldman for the response and I'll keep those points in my mind…. Here is the ComboFix log file: ComboFix 12-01-06.03 - Praveen 07/01/2012 12:36:31.1.2 - x86 Running from: c:\users\[removed]\Desktop\ComboFix.exe * Created a new restore point * Resident AV is active . . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\sooi832.bin c:\sooi832.bin\5272743E6DB1FEF c:\windows\$NtUninstallKB31434$\1468149064\@ c:\windows\$NtUninstallKB31434$\1468149064\bckfg.tmp c:\windows\$NtUninstallKB31434$\1468149064\cfg.ini c:\windows\$NtUninstallKB31434$\1468149064\Desktop.ini c:\windows\$NtUninstallKB31434$\1468149064\keywords c:\windows\$NtUninstallKB31434$\1468149064\kwrd.dll c:\windows\$NtUninstallKB31434$\1468149064\L\xadqgnnk c:\windows\$NtUninstallKB31434$\1468149064\U\00000001.@ c:\windows\$NtUninstallKB31434$\1468149064\U\00000002.@ c:\windows\$NtUninstallKB31434$\1468149064\U\00000004.@ c:\windows\$NtUninstallKB31434$\1468149064\U\80000000.@ c:\windows\$NtUninstallKB31434$\1468149064\U\80000004.@ c:\windows\$NtUninstallKB31434$\1468149064\U\80000032.@ c:\windows\$NtUninstallKB31434$\1735022843 c:\windows\pkunzip.pif c:\windows\pkzip.pif c:\windows\system32\spool\prtprocs\w32x86\x5pp.dll c:\windows\$NtUninstallKB31434$ . . . . Failed to delete . . ((((((((((((((((((((((((( Files Created from 2011-12-07 to 2012-01-07 ))))))))))))))))))))))))))))))) . . 2012-01-07 12:48 . 2012-01-07 13:15 ——– d—–w- c:\users\Praveen\AppData\Local\temp 2012-01-07 12:48 . 2012-01-07 12:48 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-01-07 12:32 . 2009-07-13 23:11 80896 —-a-w- c:\windows\system32\drivers\i8042prt.sys 2012-01-06 14:37 . 2012-01-06 14:37 ——– d—–w- c:\users\Praveen\AppData\Roaming\HPAppData 2012-01-06 12:05 . 2012-01-07 12:25 ——– d—–w- C:\Malwarebyte Logs 2012-01-05 22:45 . 2011-12-06 17:22 28760 —-a-w- c:\program files\Mozilla Firefox\ScriptFF.dll 2012-01-05 22:09 . 2012-01-05 22:41 ——– d—–w- c:\program files\SiteAdvisor 2012-01-05 16:11 . 2012-01-05 16:11 ——– d—–w- c:\users\Praveen\.java 2012-01-01 23:39 . 2012-01-01 23:39 ——– d—–w- c:\windows\system32\EventProviders 2011-12-23 08:29 . 2011-12-24 06:33 ——– d—–w- c:\users\Praveen\AppData\Roaming\Icpe 2011-12-22 23:35 . 2011-12-22 23:37 ——– d—–w- c:\users\Praveen\AppData\Roaming\vlc 2011-12-22 23:35 . 2011-12-22 23:35 ——– d—–w- c:\program files\VLC 2011-12-22 15:49 . 2011-12-22 15:49 ——– d—–w- c:\users\Praveen\AppData\Roaming\DVDVideoSoft 2011-12-22 15:48 . 2011-12-22 15:49 ——– d—–w- c:\program files\Video Flip and Rotate 2011-12-22 15:48 . 2011-12-22 15:49 ——– d—–w- c:\program files\Common Files\DVDVideoSoft 2011-12-20 11:40 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7F0AD6C5-2B99-4BBA-9C4E-A4C1AB84E159}\mpengine.dll 2011-12-16 16:34 . 2012-01-05 23:52 ——– d—–w- C:\T1 2011-12-14 03:23 . 2011-12-14 03:23 ——– d—–w- C:\found.000 2011-12-13 20:48 . 2011-11-05 04:30 2048 —-a-w- c:\windows\system32\tzres.dll 2011-12-13 20:48 . 2011-11-24 04:23 2340352 —-a-w- c:\windows\system32\win32k.sys 2011-12-13 20:48 . 2011-10-26 04:25 38912 —-a-w- c:\windows\system32\csrsrv.dll 2011-12-13 20:46 . 2011-10-26 04:42 3901808 —-a-w- c:\windows\system32\ntoskrnl.exe 2011-12-13 20:46 . 2011-10-26 04:42 3957104 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-12-11 21:43 . 2011-12-11 21:43 ——– d—–w- c:\users\Guest . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-01-02 19:32 . 2011-08-11 08:44 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-12-10 15:24 . 2010-09-28 18:41 20464 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-06-28 20:25 . 2011-05-10 19:21 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2011-04-14 14:08 . 2012-01-05 21:20 24376 —-a-w- c:\program files\mozilla firefox\components\Scriptff.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WordWeb"="c:\program files\WordWeb\wweb32.exe" [2009-11-08 65216] "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-11-22 1318816] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nykkygy] 2011-12-30 19:05 11264 —-a-w- c:\windows\System32\config\systemprofile\AppData\Local\nykkygy.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk backup=c:\windows\pss\VPN Client.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2011-03-30 04:59 937920 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-09-07 22:58 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Communicator] 2008-12-16 22:05 5160288 —-a-w- c:\program files\Microsoft Office Communicator\communicator.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2011-09-10 22:28 136176 —-atw- c:\users\Praveen\AppData\Local\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] 2007-01-01 21:22 3739648 —-a-w- c:\users\Praveen\AppData\Roaming\Google\Google Talk\googletalk.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] 2006-10-26 23:47 31016 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2009-11-18 15:13 54576 —-a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)] 2011-12-24 17:50 981680 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2011-12-24 17:50 460872 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)] 2011-12-24 17:50 981680 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] 2010-06-01 09:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-05-14 11:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe] 2011-04-22 12:21 247728 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIExec] 2009-07-16 13:42 132608 —-a-w- c:\program files\T-Mobile Broadband Manager\T-Mobile Mobile Broadband Manager\UIExec.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center] 2007-05-31 09:21 648072 —-a-w- c:\windows\WindowsMobile\wmdc.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher] 2011-08-05 12:29 159456 —-a-w- c:\program files\Zune\ZuneLauncher.exe . R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-28 136176] R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-27 214904] R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-10-15 57600] R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-28 136176] R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2009-05-22 9728] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-10-15 87656] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-30 1343400] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520] R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 268512] S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2011-10-15 64880] S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-10-15 165680] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-27 214904] S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-27 214904] S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-12-06 160608] S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-12-06 150856] S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832] S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592] S2 UI Assistant Service;UI Assistant Service;c:\program files\T-Mobile Broadband Manager\T-Mobile Mobile Broadband Manager\AssistantServices.exe [2009-07-16 241664] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464] S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-10-15 338176] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336] S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920] . . — Other Services/Drivers In Memory — . *NewlyCreated* - IPNAT *Deregistered* - BMLoad *Deregistered* - mfeavfk01 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPService REG_MULTI_SZ HPSLPSVC HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr . Contents of the 'Scheduled Tasks' folder . 2012-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-09-28 19:01] . 2012-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-09-28 19:01] . 2012-01-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-933742835-676889697-3988407338-1000Core.job - c:\users\Praveen\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-14 22:28] . 2012-01-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-933742835-676889697-3988407338-1000UA.job - c:\users\Praveen\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-14 22:28] . . ——- Supplementary Scan ——- . uStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Open using &Advanced JPEG Compressor - c:\program files\Advanced JPEG Compressor\ajcieex.htm TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Praveen\AppData\Roaming\Mozilla\Firefox\Profiles\qr0ilu45.default\ FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false . - - - - ORPHANS REMOVED - - - - . MSConfigStartUp-SiteAdvisor - c:\program files\SiteAdvisor\6172\SiteAdv.exe MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe MSConfigStartUp-UJ7J2I3XWGVE4JZWPNW - c:\sooi832.bin\CA0A4982F17.exe MSConfigStartUp-{73F04CF2-6103-4973-C1A5-0ADBEF79FA44} - c:\users\Praveen\AppData\Roaming\Yxeg\oxigzuq.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\windows\system32\WUDFHost.exe c:\program files\Cisco Systems\VPN Client\cvpnd.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\McAfee\SystemCore\mcshield.exe c:\program files\Common Files\McAfee\SystemCore\mfefire.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\taskhost.exe c:\windows\system32\conhost.exe c:\progra~1\mcafee.com\agent\mcagent.exe . ************************************************************************** . Completion time: 2012-01-07 13:17:46 - machine was rebooted ComboFix-quarantined-files.txt 2012-01-07 13:17 . Pre-Run: 36,062,130,176 bytes free Post-Run: 35,695,239,168 bytes free . - - End Of File - - B2199FD6380B12CB06278F974F656283

Praveen

Post #7January 7, 2012, 1:28 PM UTC

Here is the new HJT log file:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:25:29, on 07/01/2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16912)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\wuauclt.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\Explorer.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
C:\Program Files\TextPad 5\TextPad.exe
C:\Malwarebyte Logs\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120105224541.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [WordWeb] "C:\Program Files\WordWeb\wweb32.exe" -startup
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-21-933742835-676889697-3988407338-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ukfreetrial.webex.com/client/T27LD/…ex/ieatgpc1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\mcsniepl.dll
O20 - Winlogon Notify: nykkygy - C:\Windows\system32\config\systemprofile\AppData\Local\nykkygy.dll (file missing)
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Windows\system32\mfevtps.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
O23 - Service: UI Assistant Service - Unknown owner - C:\Program Files\T-Mobile Broadband Manager\T-Mobile Mobile Broadband Manager\AssistantServices.exe

–
End of file - 8454 bytes

Thank you again oldman……

oldman960

Post #8January 7, 2012, 4:58 PM UTC

Hi Praveen,

I need some information on some files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click on this link

VirusTotal

copy and paste the following one at a time, into the upload a file box (if you can't copy and paste the filepath please use the browse button. The first file path may look like 2 paths but is actually only one)

C:\Qoobox\Quarantine\c\windows\system32\spool\prtprocs\w32x86\x5pp.dll

c:\windows\system32\drivers\i8042prt.sys

scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. . Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.

Next

We'll use combofix again but run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\windows\System32\config\systemprofile\AppData\Local\nykkygy.dll

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nykkygy]

::Folder
c:\windows\$NtUninstallKB31434$

::DirLook
c:\users\Praveen\AppData\Roaming\Yxeg

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Please post back with

VirusTotal result
combofix log

How's the computer?

Thanks

Praveen

Post #9January 10, 2012, 4:31 PM UTC

Hello again oldman…

Here are the results of the VirusTotal:

C:\Qoobox\Quarantine\c\windows\system32\spool\prtprocs\w32x86\x5pp.dll.vir. x5pp.dll.vir is the only file in the directory and I wasn't able to locate the file x5pp.dll.

File name: x5pp.dll.vir
Submission date: 2012-01-10 16:08:16 (UTC)
Current status: queued (#1) queued (#1) analysing finished

Result: 0/ 43 (0.0%)

Antivirus Version Last Update Result
AhnLab-V3 2012.01.10.03 2012.01.10 -
AntiVir 7.11.20.222 2012.01.10 -
Antiy-AVL 2.0.3.7 2012.01.10 -
Avast 6.0.1289.0 2012.01.10 -
AVG 10.0.0.1190 2012.01.10 -
BitDefender 7.2 2012.01.10 -
ByteHero 1.0.0.1 2011.12.31 -
CAT-QuickHeal 12.00 2012.01.10 -
ClamAV 0.97.3.0 2012.01.10 -
Commtouch 5.3.2.6 2012.01.10 -
Comodo 11233 2012.01.10 -
DrWeb 5.0.2.03300 2012.01.10 -
Emsisoft 5.1.0.11 2012.01.10 -
eSafe 7.0.17.0 2012.01.09 -
eTrust-Vet 37.0.9673 2012.01.10 -
F-Prot 4.6.5.141 2012.01.09 -
F-Secure 9.0.16440.0 2012.01.10 -
Fortinet 4.3.388.0 2012.01.10 -
GData 22 2012.01.10 -
Ikarus T3.1.1.109.0 2012.01.10 -
Jiangmin 13.0.900 2012.01.10 -
K7AntiVirus 9.124.5897 2012.01.09 -
Kaspersky 9.0.0.837 2012.01.10 -
McAfee 5.400.0.1158 2012.01.10 -
McAfee-GW-Edition 2010.1E 2012.01.10 -
Microsoft 1.7903 2012.01.10 -
NOD32 6782 2012.01.10 -
Norman 6.07.13 2012.01.10 -
nProtect 2012-01-10.01 2012.01.10 -
Panda 10.0.3.5 2012.01.09 -
PCTools 8.0.0.5 2012.01.10 -
Prevx 3.0 2012.01.10 -
Rising 23.92.01.02 2012.01.10 -
Sophos 4.73.0 2012.01.10 -
SUPERAntiSpyware 4.40.0.1006 2012.01.10 -
Symantec 20111.2.0.82 2012.01.10 -
TheHacker 6.7.0.1.375 2012.01.10 -
TrendMicro 9.500.0.1008 2012.01.10 -
TrendMicro-HouseCall 9.500.0.1008 2012.01.10 -
VBA32 3.12.16.4 2012.01.10 -
VIPRE 11378 2012.01.10 -
ViRobot 2012.1.10.4873 2012.01.10 -
VirusBuster 14.1.159.0 2012.01.10 -
Additional informationShow all
MD5 : d8353c5b11c421094b7d6961ab9f3d30
SHA1 : b16ffbb891c3cedcbdb43312c387d000104166ef
SHA256: 59dfa35e7e5bfdecf7d52a474eb2008375fbf28bfc79f6b612aca0ca4a4243d8
ssdeep: 768:z7D+h2Fw+MumO2mqVH8Ps+lxGhVjFekJ:z7D+oFw+MumO2380cycQ
File size : 32256 bytes
First seen: 2010-07-14 00:04:11
Last seen : 2012-01-10 16:08:16
TrID:
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: Xerox Corporation
copyright….: x5pp.dll
product……: Xerox Print Driver
description..: Print Processor Module
original name: x5pp.dll
internal name: x5pp.dll
file version.: 5173, 1100, 0, 0
comments…..:
signers……: -
signing date.: -
verified…..: Unsigned

PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x603E
timedatestamp….: 0x4C0D3EE7 (Mon Jun 07 18:48:07 2010)
machinetype……: 0x14c (I386)

[[ 4 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x63C9, 0x6400, 6.56, ad92fc8cc2cdcd33718e86a17f9e4308
.data, 0x8000, 0xE08, 0xC00, 3.64, 9bae63caa0149b2e97ffe5484d5fbcdf
.rsrc, 0x9000, 0x3D8, 0x400, 3.12, 6d149a0065ee8a3f6259ea4a10508017
.reloc, 0xA000, 0x59C, 0x600, 3.65, f257cf5f817018a9bf07c061ad4a6537

[[ 5 import(s) ]]
msvcrt.dll: _amsg_exit, _initterm, free, malloc, _XcptFilter, _wcsicmp, wcschr, _wcsnicmp, iswdigit, wcstoul, memcpy, memset
KERNEL32.dll: GetACP, CloseHandle, GetVersion, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, RtlUnwind, InterlockedCompareExchange, Sleep, InterlockedExchange, SetEvent, ResetEvent, CreateEventW, FreeLibrary, GlobalFree, GetProcAddress, LoadLibraryW, GetLastError, WaitForSingleObject, SetLastError, lstrlenW, IsDBCSLeadByteEx, GlobalAlloc
GDI32.dll: SetWorldTransform, GetDeviceCaps, GdiResetDCEMF, GdiPlayPageEMF, CancelDC, CreateDCW, DeleteDC, TranslateCharsetInfo, CreateFontIndirectW, SelectObject, GetTextMetricsW, StartDocW, SetBkMode, StartPage, EndPage, TextOutA, EndDoc, AbortDoc, DeleteObject, GdiGetSpoolFileHandle, GdiGetDC, GdiGetPageCount, GetWorldTransform, GdiStartDocEMF, GdiEndDocEMF, GdiDeleteSpoolFileHandle, GdiGetPageHandle, GdiStartPageEMF, GdiEndPageEMF, GdiGetDevmodeForPage, ResetDCW, SetGraphicsMode, ModifyWorldTransform, ExtEscape
WINSPOOL.DRV: GetPrinterDataW, GetPrinterW, StartDocPrinterW, OpenPrinterW, WritePrinter, ReadPrinter, ClosePrinter, EndDocPrinter, DeviceCapabilitiesW
SPOOLSS.DLL: GetJobAttributes

[[ 7 export(s) ]]
ClosePrintProcessor, ControlPrintProcessor, DllMain, EnumPrintProcessorDatatypesW, GetPrintProcessorCapabilities, OpenPrintProcessor, PrintDocumentOnPrintProcessor

ExifTool:
file metadata
CharacterSet: Unicode
CodeSize: 25600
Comments:
CompanyName: Xerox Corporation
EntryPoint: 0x603e
FileDescription: Print Processor Module
FileFlagsMask: 0x003f
FileOS: Windows NT 32-bit
FileSize: 32 kB
FileSubtype: 0
FileType: Win32 DLL
FileVersion: 5173, 1100, 0, 0
FileVersionNumber: 5173.1100.0.0
ImageVersion: 6.1
InitializedDataSize: 6656
InternalName: x5pp.dll
LanguageCode: Neutral
LegalCopyright: x5pp.dll
LegalTrademarks:
LinkerVersion: 9.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 6.1
ObjectFileType: Dynamic link library
OriginalFilename: x5pp.dll
PEType: PE32
PrivateBuild:
ProductName: Xerox Print Driver
ProductVersion: 5173, 1100, 0, 0
ProductVersionNumber: 5173.1100.0.0
SpecialBuild:
Subsystem: Windows command line
SubsystemVersion: 5.0
TimeStamp: 2010:06:07 20:48:07+02:00
UninitializedDataSize: 0

Praveen

Post #10January 10, 2012, 4:32 PM UTC

Here is the VirusTotal report for the other file:

c:\windows\system32\drivers\i8042prt.sys

File name: file-3272730_sys
Submission date: 2011-12-14 18:20:44 (UTC)
Current status: finished
Result: 0 /43 (0.0%)
VT Community

not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.12.13.01 2011.12.14 -
AntiVir 7.11.19.112 2011.12.14 -
Antiy-AVL 2.0.3.7 2011.12.14 -
Avast 6.0.1289.0 2011.12.14 -
AVG 10.0.0.1190 2011.12.14 -
BitDefender 7.2 2011.12.14 -
ByteHero 1.0.0.1 2011.12.07 -
CAT-QuickHeal 12.00 2011.12.14 -
ClamAV 0.97.3.0 2011.12.14 -
Commtouch 5.3.2.6 2011.12.14 -
Comodo 10955 2011.12.14 -
DrWeb 5.0.2.03300 2011.12.14 -
Emsisoft 5.1.0.11 2011.12.14 -
eSafe 7.0.17.0 2011.12.13 -
eTrust-Vet 37.0.9623 2011.12.14 -
F-Prot 4.6.5.141 2011.12.13 -
F-Secure 9.0.16440.0 2011.12.14 -
Fortinet 4.3.388.0 2011.12.14 -
GData 22 2011.12.14 -
Ikarus T3.1.1.109.0 2011.12.14 -
Jiangmin 13.0.900 2011.12.14 -
K7AntiVirus 9.119.5684 2011.12.14 -
Kaspersky 9.0.0.837 2011.12.14 -
McAfee 5.400.0.1158 2011.12.14 -
McAfee-GW-Edition 2010.1E 2011.12.14 -
Microsoft 1.7903 2011.12.14 -
NOD32 6712 2011.12.14 -
Norman 6.07.13 2011.12.14 -
nProtect 2011-12-14.01 2011.12.14 -
Panda 10.0.3.5 2011.12.14 -
PCTools 8.0.0.5 2011.12.14 -
Prevx 3.0 2011.12.14 -
Rising 23.88.02.02 2011.12.14 -
Sophos 4.72.0 2011.12.14 -
SUPERAntiSpyware 4.40.0.1006 2011.12.14 -
Symantec 20111.2.0.82 2011.12.14 -
TheHacker 6.7.0.1.356 2011.12.11 -
TrendMicro 9.500.0.1008 2011.12.14 -
TrendMicro-HouseCall 9.500.0.1008 2011.12.14 -
VBA32 3.12.16.4 2011.12.14 -
VIPRE 11249 2011.12.14 -
ViRobot 2011.12.14.4825 2011.12.14 -
VirusBuster 14.1.116.0 2011.12.14 -
Additional informationShow all
MD5 : f151f0bdc47f4a28b1b20a0818ea36d6
SHA1 : db6edac7f4df87ba26ee981d54a2a77182246038
SHA256: 84b24b5796d9f70a8c37773f5484a4606cc7908370ccd942627acbedc4952d79
ssdeep: 1536:gWAgyYi1Lh9wS/++HULtrxi6P3Jim4zi7XPp/RiGcKulPQ70jtZZ0:gWAIuN9++HULRxiW
3tci7B/RN0jtZZ0
File size : 80896 bytes
First seen: 2009-08-28 06:48:22
Last seen : 2011-12-14 18:20:44
Magic: PE32 executable for MS Windows (native) Intel 80386 32-bit
TrID:
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher….: Microsoft Corporation
copyright….: © Microsoft Corporation. All rights reserved.
product……: Microsoft_ Windows_ Operating System
description..: i8042 Port Driver
original name: i8042prt.sys
internal name: i8042prt.sys
file version.: 6.1.7600.16385 (win7_rtm.090713-1255)
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

PEiD: -
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x12138
timedatestamp….: 0x4A5BBF1B (Mon Jul 13 23:11:23 2009)
machinetype……: 0x14C (Intel I386)

[[ 7 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x7A35, 0x7C00, 6.34, af80cb3ed413d4c618cf9bf8966ec5f3
.rdata, 0x9000, 0x5C4, 0x600, 5.19, 12056b9a9153aece4cd7bf5cf0f7486f
.data, 0xA000, 0x158, 0x200, 1.68, 3c8707bf80065497dee70c357e3dac01
PAGE, 0xB000, 0x687E, 0x6A00, 6.33, e7637bba2668f536870f954f650cadaa
INIT, 0x12000, 0x1236, 0x1400, 5.86, 2fa2c49a4daaf92878b12770d90e6898
.rsrc, 0x14000, 0x2538, 0x2600, 3.42, b2484cacc2022f1b55fcbb8179835186
.reloc, 0x17000, 0xE64, 0x1000, 6.45, 2e1ba198999359b94dc35b4ba901ee90

[[ 3 import(s) ]]
hal.dll: KfAcquireSpinLock, READ_PORT_UCHAR, KfRaiseIrql, KfLowerIrql, WRITE_PORT_UCHAR, KfReleaseSpinLock, KeGetCurrentIrql, KeStallExecutionProcessor
ntoskrnl.exe: IoBuildDeviceIoControlRequest, KeInitializeEvent, IoStartPacket, IoAcquireRemoveLockEx, memmove, ObfDereferenceObject, IoGetAttachedDeviceReference, ExAllocatePoolWithTag, WRITE_REGISTER_UCHAR, READ_REGISTER_UCHAR, MmMapIoSpace, KeInsertQueueDpc, KeSetTimer, KeSynchronizeExecution, IoReleaseCancelSpinLock, IoAcquireCancelSpinLock, memcpy, IoAllocateController, IoWMIWriteEvent, memset, MmGetSystemRoutineAddress, RtlInitUnicodeString, RtlCompareMemory, IoWMIRegistrationControl, IoDeleteController, MmUnmapIoSpace, KeDelayExecutionThread, IoFreeWorkItem, ExReleaseFastMutexUnsafe, ExAcquireFastMutexUnsafe, RtlQueryRegistryValues, RtlAppendUnicodeToString, KeInitializeTimer, IoCreateController, IoInvalidateDeviceState, KeQueryTimeIncrement, KeTickCount, PoStartNextPowerIrp, PoSetPowerState, IofCallDriver, KdChangeOption, KeBugCheckEx, ZwClose, ZwSetValueKey, ZwOpenKey, _allmul, IoOpenDeviceRegistryKey, DbgBreakPointWithStatus, KdDebuggerEnabled, KdDebuggerNotPresent, IoConnectInterrupt, KeInitializeDpc, KeRemoveQueueDpc, RtlFreeUnicodeString, IoSetDeviceInterfaceState, IoDisconnectInterrupt, KeSetTimerEx, IoFreeIrp, _wcsupr, _alldiv, IoAllocateIrp, IoUnregisterPlugPlayNotification, IoQueueWorkItem, IoAllocateWorkItem, KeInitializeTimerEx, IoRegisterPlugPlayNotification, IoSetStartIoAttributes, IoInitializeRemoveLockEx, IoDeleteDevice, IoAttachDeviceToDeviceStack, IoCreateDevice, KeSetEvent, IoQueryDeviceDescription, IoRegisterDeviceInterface, IoDetachDevice, IoReleaseRemoveLockAndWaitEx, PoCallDriver, RtlUnwind, KeWaitForSingleObject, IoAllocateErrorLogEntry, IoWriteErrorLogEntry, KeCancelTimer, KefAcquireSpinLockAtDpcLevel, ExFreePoolWithTag, KefReleaseSpinLockFromDpcLevel, IoFreeController, IoStartNextPacket, IoReleaseRemoveLockEx, KdEnableDebugger, IofCompleteRequest, DbgPrint, PsGetVersion, ExAllocatePoolWithQuotaTag, ZwQuerySystemInformation, KiBugCheckData
wmilib.sys: WmiSystemControl, WmiCompleteRequest

Androguard:
-
ExifTool:
-
Symantec reputation:Suspicious.Insight

Praveen

Post #11January 10, 2012, 5:23 PM UTC

Here is the new ComboFix log file: ComboFix 12-01-06.03 - Praveen 10/01/2012 16:43:51.2.2 - x86 Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Praveen\Desktop\CFScript.txt * Created a new restore point * Resident AV is active . . FILE :: "c:\windows\System32\config\systemprofile\AppData\Local\nykkygy.dll" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\System32\config\systemprofile\AppData\Local\nykkygy.dll c:\windows\$NtUninstallKB31434$ . . . . Failed to delete . . ((((((((((((((((((((((((( Files Created from 2011-12-10 to 2012-01-10 ))))))))))))))))))))))))))))))) . . 2012-01-10 16:56 . 2012-01-10 16:59 ——– d—–w- c:\users\Praveen\AppData\Local\temp 2012-01-10 16:56 . 2012-01-10 16:56 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-01-10 16:40 . 2009-07-13 23:11 53760 —-a-w- c:\windows\system32\drivers\intelppm.sys 2012-01-08 02:39 . 2012-01-08 02:39 ——– d—–w- c:\users\Praveen\AppData\Roaming\HPAppData 2012-01-07 12:32 . 2009-07-13 23:11 80896 —-a-w- c:\windows\system32\drivers\i8042prt.sys 2012-01-06 12:05 . 2012-01-10 16:43 ——– d—–w- C:\Malwarebyte Logs 2012-01-05 22:45 . 2011-12-06 17:22 28760 —-a-w- c:\program files\Mozilla Firefox\ScriptFF.dll 2012-01-05 22:09 . 2012-01-05 22:41 ——– d—–w- c:\program files\SiteAdvisor 2012-01-05 16:11 . 2012-01-05 16:11 ——– d—–w- c:\users\Praveen\.java 2012-01-01 23:39 . 2012-01-01 23:39 ——– d—–w- c:\windows\system32\EventProviders 2011-12-23 08:29 . 2011-12-24 06:33 ——– d—–w- c:\users\Praveen\AppData\Roaming\Icpe 2011-12-22 23:35 . 2011-12-22 23:37 ——– d—–w- c:\users\Praveen\AppData\Roaming\vlc 2011-12-22 23:35 . 2011-12-22 23:35 ——– d—–w- c:\program files\VLC 2011-12-22 15:49 . 2011-12-22 15:49 ——– d—–w- c:\users\Praveen\AppData\Roaming\DVDVideoSoft 2011-12-22 15:48 . 2011-12-22 15:49 ——– d—–w- c:\program files\Video Flip and Rotate 2011-12-22 15:48 . 2011-12-22 15:49 ——– d—–w- c:\program files\Common Files\DVDVideoSoft 2011-12-20 11:40 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7F0AD6C5-2B99-4BBA-9C4E-A4C1AB84E159}\mpengine.dll 2011-12-16 16:34 . 2012-01-10 01:19 ——– d—–w- C:\T1 2011-12-14 03:23 . 2011-12-14 03:23 ——– d—–w- C:\found.000 2011-12-13 20:48 . 2011-11-05 04:30 2048 —-a-w- c:\windows\system32\tzres.dll 2011-12-13 20:48 . 2011-11-24 04:23 2340352 —-a-w- c:\windows\system32\win32k.sys 2011-12-13 20:48 . 2011-10-26 04:25 38912 —-a-w- c:\windows\system32\csrsrv.dll 2011-12-13 20:46 . 2011-10-26 04:42 3901808 —-a-w- c:\windows\system32\ntoskrnl.exe 2011-12-13 20:46 . 2011-10-26 04:42 3957104 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-12-11 21:43 . 2011-12-11 21:43 ——– d—–w- c:\users\Guest . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-01-02 19:32 . 2011-08-11 08:44 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-12-10 15:24 . 2010-09-28 18:41 20464 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-06-28 20:25 . 2011-05-10 19:21 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2011-04-14 14:08 . 2012-01-05 21:20 24376 —-a-w- c:\program files\mozilla firefox\components\Scriptff.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WordWeb"="c:\program files\WordWeb\wweb32.exe" [2009-11-08 65216] "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-11-22 1318816] . c:\users\Praveen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk backup=c:\windows\pss\VPN Client.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2011-03-30 04:59 937920 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-09-07 22:58 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Communicator] 2008-12-16 22:05 5160288 —-a-w- c:\program files\Microsoft Office Communicator\communicator.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2011-09-10 22:28 136176 —-atw- c:\users\Praveen\AppData\Local\Google\Update\GoogleUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] 2007-01-01 21:22 3739648 —-a-w- c:\users\Praveen\AppData\Roaming\Google\Google Talk\googletalk.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] 2006-10-26 23:47 31016 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2009-11-18 15:13 54576 —-a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)] 2011-12-24 17:50 981680 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2011-12-24 17:50 460872 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)] 2011-12-24 17:50 981680 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] 2010-06-01 09:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-05-14 11:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe] 2011-04-22 12:21 247728 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIExec] 2009-07-16 13:42 132608 —-a-w- c:\program files\T-Mobile Broadband Manager\T-Mobile Mobile Broadband Manager\UIExec.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center] 2007-05-31 09:21 648072 —-a-w- c:\windows\WindowsMobile\wmdc.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher] 2011-08-05 12:29 159456 —-a-w- c:\program files\Zune\ZuneLauncher.exe . R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-28 136176] R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-27 214904] R2 UI Assistant Service;UI Assistant Service;c:\program files\T-Mobile Broadband Manager\T-Mobile Mobile Broadband Manager\AssistantServices.exe [2009-07-16 241664] R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-10-15 57600] R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-28 136176] R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2009-05-22 9728] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-10-15 87656] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-30 1343400] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520] R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 268512] S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2011-10-15 64880] S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-10-15 165680] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-27 214904] S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2011-01-27 214904] S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-12-06 160608] S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-12-06 150856] S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832] S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464] S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-10-15 338176] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336] S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920] . . — Other Services/Drivers In Memory — . *Deregistered* - BMLoad *Deregistered* - mfeavfk01 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPService REG_MULTI_SZ HPSLPSVC HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr . Contents of the 'Scheduled Tasks' folder . 2012-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-09-28 19:01] . 2012-01-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-09-28 19:01] . 2012-01-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-933742835-676889697-3988407338-1000Core.job - c:\users\Praveen\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-14 22:28] . 2012-01-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-933742835-676889697-3988407338-1000UA.job - c:\users\Praveen\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-14 22:28] . . ——- Supplementary Scan ——- . uStart Page = about:blank IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Open using &Advanced JPEG Compressor - c:\program files\Advanced JPEG Compressor\ajcieex.htm TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Praveen\AppData\Roaming\Mozilla\Firefox\Profiles\qr0ilu45.default\ FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\windows\system32\WUDFHost.exe c:\program files\Cisco Systems\VPN Client\cvpnd.exe c:\program files\Common Files\McAfee\SystemCore\mcshield.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\McAfee\SystemCore\mfefire.exe c:\windows\system32\taskhost.exe c:\windows\System32\rundll32.exe c:\windows\system32\conhost.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\progra~1\mcafee.com\agent\mcagent.exe . ************************************************************************** . Completion time: 2012-01-10 17:09:57 - machine was rebooted ComboFix-quarantined-files.txt 2012-01-10 17:09 . Pre-Run: 35,510,202,368 bytes free Post-Run: 35,510,566,912 bytes free . - - End Of File - - C9AE9E127EF8A5405765CA6B42E8A440

Praveen

Post #12January 10, 2012, 5:29 PM UTC

The computer now looks okay, haven't seen PING.EXE running in the background since I started running these tests and also don't see the Google redirect problem. Does this mean its all good or still there are stuffs to do? There was an alert notification that popped up when I was running the ComboFix scan, it just appeared for few seconds that said something like Infected with Rootkit.???. Hope you know what I mean…

oldman960

Post #13January 11, 2012, 1:14 AM UTC last edited January 11, 2012, 1:16 AM UTC

Hi Praveen,

My mistake, you did find the correct file though.

Looks good so far.

You have an old vulnerable version of Java to uninstall

click the Start button
click Control Panel
click Programs
click Programs and Features.

Uninstall Java 2 Runtime Environment Standard Edition v1.3.1_01

Do not uninstall Java™ 6 Update 22

Next

Click your start button > Control Panel

Use the drop down menu beside view by and change it to small icons
locate java (looks like a coffe cup) in the list and click on it
when the java console opens click the update tab
Click update now

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:Files
dir /s c:\users\Praveen\AppData\Roaming\Yxeg /c
dir /s c:\windows\$NtUninstallKB31434$ /c
ipconfig /flushdns /c

:Commands
[createrestorepoint]
[emptytemp]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Next

Download and save to your desktop Malwarebytes Anti-Malware

Right Click mbam-setup.exe and click "Run as Administrator" to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with

OTL fix log
MBAM log

Everything still ok?

Thanks

Praveen

Post #14January 11, 2012, 2:30 PM UTC

Hello again oldman……..

I uninstalled Java 2 Runtime Environment Standard Edition v1.3.1_01, but I wasn't able to update the Java from the control panel as there weren't any Update tab.

Below is the OTL fix log file:

All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
< dir /s c:\users\Praveen\AppData\Roaming\Yxeg /c >
Volume in drive C has no label.
Volume Serial Number is 1879-15AD
C:\Scan Logs\cmd.bat deleted successfully.
C:\Scan Logs\cmd.txt deleted successfully.
< dir /s c:\windows\$NtUninstallKB31434$ /c >
Volume in drive C has no label.
Volume Serial Number is 1879-15AD
Directory of c:\windows\$NtUninstallKB31434$
07/01/2012 12:32 .
07/01/2012 12:32 ..
07/01/2012 12:47 1468149064
0 File(s) 0 bytes
Directory of c:\windows\$NtUninstallKB31434$\1468149064
07/01/2012 12:47 .
07/01/2012 12:47 ..
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
5 Dir(s) 37,198,258,176 bytes free
C:\Scan Logs\cmd.bat deleted successfully.
C:\Scan Logs\cmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Scan Logs\cmd.bat deleted successfully.
C:\Scan Logs\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56504 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 17613950 bytes
->FireFox cache emptied: 89176528 bytes
->Flash cache emptied: 57680 bytes

User: Praveen
->Temp folder emptied: 156200 bytes
->Temporary Internet Files folder emptied: 49875182 bytes
->Java cache emptied: 288778710 bytes
->FireFox cache emptied: 50593649 bytes
->Google Chrome cache emptied: 259027484 bytes
->Flash cache emptied: 1068335 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 87610 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 721.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 01112012_141600

Files\Folders moved on Reboot…
C:\Users\Praveen\AppData\Local\Temp\~DF61C9382E00439AE1.TMP moved successfully.
C:\Users\Praveen\AppData\Local\Temp\~DF96D07AEBDF00572C.TMP moved successfully.
C:\Users\Praveen\AppData\Local\Temp\~DFEB0C4460C40E2FBB.TMP moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4E008C57-F7D2-4A70-B24C-0E18F53C093A}.tmp moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8808B771-01E8-4621-AD2A-699CE0A97C3E}.tmp moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C1280D10-197B-459F-9D93-280938EC98E2}.tmp moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z3QW3IDN\index[8].htm moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAD0A755\iframe[3].htm moved successfully.
C:\Users\Praveen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\05RG1JP3\2012_phenomenon[1].htm moved successfully.

Registry entries deleted on Reboot…

Praveen

Post #15January 11, 2012, 2:57 PM UTC

I already had Malwarebytes installed in my PC. MBAM scan loosk clear, says no infection. Malwarebytes Anti-Malware (Trial) 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.11.05 Windows 7 x86 NTFS Internet Explorer 8.0.7600.16385 Praveen :: A-GIFT-FROM-HBI [administrator] Protection: Disabled 11/01/2012 14:33:06 mbam-log-2012-01-11 (14-33-06).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 188626 Time elapsed: 6 minute(s), Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) The computer also looks okay, as I said before no PING.exe program running in the background and Google redirection has also stopped. Am I all set?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

PING.EXE Max CPU Usage/Google Redirect [Solved]

✨ Ask AI

Ask AI