What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

System Scan virus -- says harddrive, ram failed [Solved]

70 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
The desktop is still completely black with no icons, the programs don't show up in the start/programs menu (the programs that have arrows are empty, but the ones that have direct links on the start/programs menu open, like windows media player.
Post #32
The computer was just sitting on my desk (I'm using a different computer), and Avira popped up and said a virus was found: TR/Offend.kdv571726 in C:\System Volume Information\…\A0064283.exe. If I push any buttons, Avira is going to start scanning, and I know you told me not to run any other scans. What should I do?
Post #33
Try this logged in as Administrator in Safe mode fwith Networking.

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, as they may otherwise interfere with our tools. See here for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.

    [external image: Posted Image]


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [external image: Posted Image]


    Click on Yes, to continue scanning for malware.
Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

If this doesn’t work, please let me know if you can log in at all either as Shannon or Administrator in Safe mode.

Satchfan
Post #34
OK, how about if I just smash this computer into a million pieces and call it a day??? ARRRRRRGH! I left work at 515 p.m. I didn't turn off the computer because there are windows updates waiting to install if I turn it off. Instead, I shut the lid. I read your instructions on my other computer. I opened the lid of this computer, restarted in Safe Networking mode logged on as Administrator, and I could not get to the Internet. I went to Control Panel, Network Connections, and clicked on the wireless connection. It said it was acquiring network addres or something like that. So I restarted again, let the computer boot up normally, and the wireless connects automatically to my home network. Thinking that the network just hadn't had enough time to connect before, I restarted again to Safe Networking as Administrator. Still no wireless. I clicked on the wireless connection, disconnected it and allowed it to re-try to log on. It will not find the network address when logged on as Administrator in Safe Networking. I am now logged on normally. Everything's fine. Oh, another thing. I disabled Avira active guard during one of the previous boots, and now it is active again, even though I didn't re-enable it. I'm not going to run ComboFix in normal mode unless instructed to do so by you.
Post #35

OK, how about if I just smash this computer into a million pieces and call it a day???

These infections can be infuriating but hopefully we'll beat it. :)

Please try running ComboFix in any mode you can. If you can't get a network connection, download it from another computer and transfer it to the desktop of the infected computer.
Post #36
Here is the ComboFix log:

ComboFix 12-03-22.01 - Administrator 03/23/2012 13:43:35.1.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.695 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Shannon\Desktop\System Check.lnk
c:\documents and settings\Shannon\Start Menu\Programs\System Check\System Check.lnk
c:\documents and settings\Shannon\Start Menu\Programs\System Check\Uninstall System Check.lnk
c:\program files\Internet Explorer\SETDB.tmp
c:\program files\Internet Explorer\SETDC.tmp
c:\program files\Internet Explorer\SETDD.tmp
c:\windows\EventSystem.log
c:\windows\Services.reg
c:\windows\system32\Desktop_.ini
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((((( Files Created from 2012-02-23 to 2012-03-23 )))))))))))))))))))))))))))))))
.
.
2012-03-23 20:26 . 2012-03-23 20:26 4443082 ——r- c:\program files\ComboFix.exe
2012-03-22 03:57 . 2012-03-22 03:57 ——– d—–w- C:\_OTL
2012-03-18 05:28 . 2012-03-18 05:28 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2012-03-17 04:33 . 2012-03-17 04:33 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2012-03-14 22:22 . 2012-03-14 22:22 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2012-03-13 06:15 . 2012-03-13 06:17 ——– dc—-w- c:\windows\ie8
2012-03-13 05:59 . 2012-03-13 05:59 ——– d—–w- c:\documents and settings\Shannon\Local Settings\Application Data\Mozilla
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-11 02:39 . 2009-12-26 13:21 499712 —-a-w- c:\windows\system32\msvcp71.dll
2012-02-11 02:39 . 2009-12-26 13:21 348160 —-a-w- c:\windows\system32\msvcr71.dll
2012-01-12 16:53 . 2009-03-11 12:53 1859968 —-a-w- c:\windows\system32\win32k.sys
2012-01-11 19:06 . 2012-02-22 05:02 3072 ——w- c:\windows\system32\iacenc.dll
2012-02-16 14:40 . 2012-03-13 05:59 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-05 1430824]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-07-06 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-19 421736]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Shannon^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Shannon\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-12-26 05:37 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Adobe\\Acrobat.com\\Acrobat.com.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [3/3/2009 8:03 PM 38912]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [3/16/2011 10:01 PM 136360]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/17/2010 10:43 PM 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [3/11/2009 10:56 PM 1684736]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [11/17/2010 10:43 PM 136176]
S3 M3000Srv;USB2.0 UVC WebCam Driver;c:\windows\system32\drivers\M3000KNT.sys [5/11/2009 9:41 AM 145408]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys –> c:\windows\system32\Drivers\RTS5121.sys [?]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys –> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 05:43]
.
2012-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 05:43]
.
2012-02-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1602489464-951796526-1614765859-1006Core.job
- c:\documents and settings\Shannon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-10-25 18:05]
.
2012-02-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1602489464-951796526-1614765859-1006UA.job
- c:\documents and settings\Shannon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-10-25 18:05]
.
2012-02-22 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1602489464-951796526-1614765859-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-31 01:45]
.
2012-02-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1602489464-951796526-1614765859-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-31 01:45]
.
.
——- Supplementary Scan ——-
.
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-mcmscsvc
SafeBoot-MCODS
MSConfigStartUp-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe
MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-23 13:51
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1602489464-951796526-1614765859-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,84,ea,06,5b,6b,29,da,46,81,9b,61,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,84,ea,06,5b,6b,29,da,46,81,9b,61,\
.
Completion time: 2012-03-23 13:53:48
ComboFix-quarantined-files.txt 2012-03-23 20:53
.
Pre-Run: 133,281,988,608 bytes free
Post-Run: 133,366,947,840 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptOut
.
- - End Of File - - 35EB854323F134B047AFDCC85644BC6D
Post #41
This “Rogue” saves all your startup programs in a temporary folder which may have been deleted so we need to run this scan to see if they are still there.

Run OTL
  • double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • when the window appears, underneath Output at the top change it to Minimal Output.
  • check the boxes beside LOP Check and Purity Check.
  • under Custom Scan paste this in


%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
/md5stop

  • click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
  • when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
Satchfan
Post #42
Herre's the OTL.txt log:

OTL logfile created on: 3/23/2012 4:39:10 PM - Run 4
OTL by OldTimer - Version 3.2.39.1 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.88 Mb Total Physical Memory | 770.93 Mb Available Physical Memory | 76.04% Memory free
2.38 Gb Paging File | 2.27 Gb Available in Paging File | 95.21% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 142.05 Gb Total Space | 124.32 Gb Free Space | 87.52% Space Free | Partition Type: NTFS

Computer Name: ACER-330BB84976 | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (USBCCID) – system32\DRIVERS\Rts5161ccid.sys File not found
DRV - (Rts516xIR) – system32\DRIVERS\Rts516xIR.sys File not found
DRV - (RSUSBSTOR) – System32\Drivers\RTS5121.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (int15.sys) – c:\acernb\int15.sys File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (L1c) – C:\WINDOWS\system32\drivers\l1c51x86.sys (Atheros Communications, Inc.)
DRV - (AR5416) – C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (M3000Srv) – C:\WINDOWS\system32\drivers\M3000KNT.sys ()
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (btwhid) – C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (DritekPortIO) – C:\Program Files\Launch Manager\DPortIO.sys (Dritek System Inc.)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7ACAW

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.2.72: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.2.72: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/05/17 15:07:36 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/02/10 19:39:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/12 22:59:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/03/12 22:59:15 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/02/16 07:40:42 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/16 03:42:53 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/16 03:42:53 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/03/23 13:51:12 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7865F192-851C-4580-8579-DB71F758AE05}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/03/11 22:07:49 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/03/23 13:53:50 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2012/03/23 13:42:05 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/03/23 13:40:07 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/03/23 13:40:07 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/03/23 13:40:06 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/03/23 13:40:06 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/03/23 13:39:57 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2012/03/23 13:39:51 | 000,000,000 | —D | C] – C:\Qoobox
[2012/03/23 13:39:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\My Documents\My Videos
[2012/03/23 13:39:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools
[2012/03/23 13:39:02 | 004,443,082 | R— | C] (Swearware) – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2012/03/23 13:26:36 | 004,443,082 | R— | C] (Swearware) – C:\Program Files\ComboFix.exe
[2012/03/21 20:57:53 | 000,000,000 | —D | C] – C:\_OTL
[2012/03/21 20:56:55 | 009,502,424 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Administrator\Desktop\mbam–setup-1.60.1.1000.exe
[2012/03/20 21:29:49 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/03/20 21:26:32 | 000,594,432 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/03/18 20:46:09 | 000,389,024 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Administrator\Desktop\unhide.exe
[2012/03/17 22:28:06 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\PrivacIE
[2012/03/16 21:33:41 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\IETldCache
[2012/03/12 23:15:41 | 000,000,000 | —D | C] – C:\WINDOWS\ie8
[2012/03/12 22:59:12 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox

========== Files - Modified Within 30 Days ==========

[2012/03/23 16:38:34 | 000,434,126 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/03/23 16:38:34 | 000,068,412 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/03/23 16:34:24 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/03/23 13:51:12 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/03/23 13:42:10 | 000,000,328 | RHS- | M] () – C:\boot.ini
[2012/03/23 13:39:02 | 004,443,082 | R— | M] (Swearware) – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2012/03/23 13:26:36 | 004,443,082 | R— | M] (Swearware) – C:\Program Files\ComboFix.exe
[2012/03/22 11:41:44 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/03/22 11:08:20 | 000,000,788 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/03/21 21:09:05 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/03/21 20:57:06 | 009,502,424 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Administrator\Desktop\mbam–setup-1.60.1.1000.exe
[2012/03/20 21:36:14 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill.scr
[2012/03/20 21:35:44 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill.com
[2012/03/20 21:35:15 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill.exe
[2012/03/20 21:34:37 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill 2.com
[2012/03/20 21:33:52 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill 1.exe
[2012/03/20 21:29:49 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/03/20 21:26:35 | 000,594,432 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/03/18 20:46:23 | 000,389,024 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Administrator\Desktop\unhide.exe
[2012/03/18 20:41:27 | 000,294,400 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\exeHelper.com
[2012/03/17 22:33:01 | 000,068,194 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\RogueKiller.exe
[2012/03/16 20:40:25 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/03/12 23:18:51 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK

========== Files Created - No Company Name ==========

[2012/03/23 13:42:09 | 000,000,212 | —- | C] () – C:\Boot.bak
[2012/03/23 13:42:06 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/03/23 13:40:07 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/03/23 13:40:07 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/03/23 13:40:07 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/03/23 13:40:07 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/03/23 13:40:06 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/03/22 11:08:20 | 000,000,788 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/03/20 22:20:48 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/03/20 21:36:09 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill.scr
[2012/03/20 21:35:40 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill.com
[2012/03/20 21:35:11 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill.exe
[2012/03/20 21:34:32 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill 2.com
[2012/03/20 21:33:47 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill 1.exe
[2012/03/18 20:41:05 | 000,294,400 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\exeHelper.com
[2012/03/17 22:32:50 | 000,068,194 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\RogueKiller.exe
[2012/02/21 22:02:38 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/01/03 15:06:20 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat

========== LOP Check ==========

[2009/03/11 23:32:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Acer
[2009/03/11 23:06:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Acer GameZone Console
[2009/03/11 23:27:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Super-Cow
[2009/12/26 09:14:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2DBoy
[2009/03/11 23:06:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Acer GameZone Console
[2010/10/07 01:01:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broadcom
[2011/05/12 09:50:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2012/02/10 20:01:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EX_ >
[2008/04/14 05:00:00 | 000,356,615 | —- | M] () MD5=D7B59A7EC9CB1429FDCEC84A22228555 – C:\i386\EXPLORER.EX_

< MD5 for: EXPLORER.EXE >
[2008/04/14 05:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/14 05:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 05:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: EXPLORER.SC_ >
[2008/04/14 05:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\i386\EXPLORER.SC_

< MD5 for: EXPLORER.SCF >
[2008/04/14 05:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CH_ >
[2008/04/14 05:00:00 | 000,199,077 | —- | M] () MD5=1D662719AB9BB40BA7526B3973D3F626 – C:\i386\IEXPLORE.CH_

< MD5 for: IEXPLORE.CHM >
[2009/02/21 01:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2006/09/01 09:43:50 | 000,503,758 | —- | M] () MD5=652E46500C149D1DC948BF9CEA8C4933 – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.CHW >
[2010/01/06 23:43:02 | 000,157,092 | —- | M] () MD5=AF2CF3DE9B5746E5A3C7882969E04B99 – C:\WINDOWS\Help\iexplore.chw

< MD5 for: IEXPLORE.EX_ >
[2008/04/14 05:00:00 | 000,037,887 | —- | M] () MD5=2B46169148FFD81CAE84572CD32BDF86 – C:\i386\IEXPLORE.EX_

< MD5 for: IEXPLORE.EXE >
[2010/12/20 04:25:27 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=091D358EFC9D22901BD879EF37F0DAC4 – C:\WINDOWS\ie7updates\KB2497640-IE7\iexplore.exe
[2011/12/16 04:00:16 | 000,634,680 | —- | M] (Microsoft Corporation) MD5=1C206B8FEEC6882B7F7F479E95D2BDD9 – C:\WINDOWS\ie8\iexplore.exe
[2011/10/31 03:32:32 | 000,634,504 | —- | M] (Microsoft Corporation) MD5=1C5DA2D9EA2A59D0D5C116FA3A5A21AA – C:\WINDOWS\$hf_mig$\KB2618444-IE7\SP3QFE\iexplore.exe
[2010/06/17 08:12:57 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=203E897F843D56496E2CC101DFF6CE34 – C:\WINDOWS\ie7updates\KB2360131-IE7\iexplore.exe
[2011/10/31 03:46:00 | 000,634,504 | —- | M] (Microsoft Corporation) MD5=2E34CF22B5862AB02786F0819B9FD819 – C:\WINDOWS\ie7updates\KB2647516-IE7\iexplore.exe
[2011/04/21 03:34:43 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=3E23DBEBE1020D52C63235E4189FAC03 – C:\WINDOWS\$hf_mig$\KB2530548-IE7\SP3QFE\iexplore.exe
[2009/10/27 23:54:16 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=4F9B04D546C23A295F3F0AE015BE51DB – C:\WINDOWS\ie7updates\KB978207-IE7\iexplore.exe
[2009/12/18 06:05:43 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=53C291F3B01EECECBD7FD358EA3ACC94 – C:\WINDOWS\ie7updates\KB980182-IE7\iexplore.exe
[2008/04/14 05:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ie7\iexplore.exe
[2012/01/13 14:53:20 | 000,182,856 | —- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2011/08/17 04:01:37 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=6A1D755C68C10863C598C78A597FA7C3 – C:\WINDOWS\ie7updates\KB2618444-IE7\iexplore.exe
[2010/10/18 04:07:43 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=72D1F43C4146D312B0DB6AB98C21340E – C:\WINDOWS\ie7updates\KB2482017-IE7\iexplore.exe
[2009/10/27 23:54:21 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=80675329E0FD54F016C4F8A83C616349 – C:\WINDOWS\$hf_mig$\KB976325-IE7\SP3QFE\iexplore.exe
[2011/06/20 04:29:11 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=993F33696EF219C306BF9BBA34D85073 – C:\WINDOWS\ie7updates\KB2586448-IE7\iexplore.exe
[2010/06/17 07:45:15 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B0BC6DC9C9277250C5C8F7B7A48A02CC – C:\WINDOWS\$hf_mig$\KB2183461-IE7\SP3QFE\iexplore.exe
[2010/04/16 04:08:29 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B24A4E23A2FEDB6976EB04D334AD82B2 – C:\WINDOWS\$hf_mig$\KB982381-IE7\SP3QFE\iexplore.exe
[2010/02/22 22:20:02 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B5116340B84824DDD0A641E36B126194 – C:\WINDOWS\ie7updates\KB982381-IE7\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\ERDNT\cache\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe
[2011/04/21 03:58:25 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B6E13F9C120C776A89D783E26D6C15C5 – C:\WINDOWS\ie7updates\KB2559049-IE7\iexplore.exe
[2010/12/20 03:49:55 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B74CBEBA34E3CAA2CCACC87FEE8A16C0 – C:\WINDOWS\$hf_mig$\KB2482017-IE7\SP3QFE\iexplore.exe
[2010/04/16 04:43:25 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=C4BA5E36FB57F547117305BF1E0FE454 – C:\WINDOWS\ie7updates\KB2183461-IE7\iexplore.exe
[2010/02/22 22:19:59 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=C8DDA4028065D5CE39CBE7A156B72AB9 – C:\WINDOWS\$hf_mig$\KB980182-IE7\SP3QFE\iexplore.exe
[2011/08/17 03:34:43 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=CB0AFAF9E5C5FE70EC7087E71275DD33 – C:\WINDOWS\$hf_mig$\KB2586448-IE7\SP3QFE\iexplore.exe
[2009/12/18 00:00:27 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=D19E56D5930C37CF211867DF450C372A – C:\WINDOWS\$hf_mig$\KB978207-IE7\SP3QFE\iexplore.exe
[2010/10/18 03:36:30 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=DA6E1F0F1932B62DD2F6ED05541C555C – C:\WINDOWS\$hf_mig$\KB2416400-IE7\SP3QFE\iexplore.exe
[2011/12/16 03:35:06 | 000,634,680 | —- | M] (Microsoft Corporation) MD5=DB9D9A73FACB0B11992201D670D73E16 – C:\WINDOWS\$hf_mig$\KB2647516-IE7\SP3QFE\iexplore.exe
[2011/06/20 03:38:09 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=DE0F15DD275A36C3E67DC1E36F958F3A – C:\WINDOWS\$hf_mig$\KB2559049-IE7\SP3QFE\iexplore.exe
[2007/08/13 19:43:56 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=DE49B348A18369B4626FBA1D49B07FB4 – C:\WINDOWS\ie7updates\KB976325-IE7\iexplore.exe
[2011/02/14 04:36:55 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=E3CC8CCF21BFDC954255BB17083FB9F0 – C:\WINDOWS\$hf_mig$\KB2497640-IE7\SP3QFE\iexplore.exe
[2011/02/14 05:17:08 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=E4A798DFDE7FE6E79F23548F0EF0F844 – C:\WINDOWS\ie7updates\KB2530548-IE7\iexplore.exe
[2010/08/25 04:30:33 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=E5412ED9E07C42C20C48D3FF71E6B1E8 – C:\WINDOWS\ie7updates\KB2416400-IE7\iexplore.exe
[2010/08/25 04:07:58 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=F047BEB9771E45A05F425499A30F9BBA – C:\WINDOWS\$hf_mig$\KB2360131-IE7\SP3QFE\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-030260BF.PF >
[2012/03/23 13:30:53 | 000,012,034 | —- | M] () MD5=A2DCA13E8725AF64A59847F08AD3469D – C:\WINDOWS\Prefetch\IEXPLORE.EXE-030260BF.pf

< MD5 for: IEXPLORE.EXE-2341EA0A.PF >
[2012/03/23 13:30:53 | 000,010,934 | —- | M] () MD5=CA54C86702B8C4EB3C271D9D3FB7B200 – C:\WINDOWS\Prefetch\IEXPLORE.EXE-2341EA0A.pf

< MD5 for: IEXPLORE.EXE-25E064CA.PF >
[2012/03/23 13:30:56 | 000,013,580 | —- | M] () MD5=B798D9F3109267876411D8E0A095EDB8 – C:\WINDOWS\Prefetch\IEXPLORE.EXE-25E064CA.pf

< MD5 for: IEXPLORE.EXE-2D97EBE6.PF >
[2012/03/22 18:28:23 | 000,115,384 | —- | M] () MD5=0ACD151164645A734587D83EFFFCABD9 – C:\WINDOWS\Prefetch\IEXPLORE.EXE-2D97EBE6.pf

< MD5 for: IEXPLORE.HL_ >
[2008/04/14 05:00:00 | 000,059,881 | —- | M] () MD5=D23388C8D5D82D4D1C3B0B6A256E3CB7 – C:\i386\IEXPLORE.HL_

< MD5 for: IEXPLORE.HLP >
[2008/04/14 05:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: WINLOGON.EX_ >
[2008/04/14 05:00:00 | 000,265,069 | —- | M] () MD5=063EF1A46C58A731F78AE5AF47070D65 – C:\i386\WINLOGON.EX_

< MD5 for: WINLOGON.EXE >
[2012/01/13 14:53:20 | 000,182,856 | —- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/14 05:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/14 05:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/14 05:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< End of report >
Post #44
I’m sorry for the problem with our time difference but I tried to get you help as quickly as possible so please bear with me.

it did not sve the Extras log.

Sorry, it only gives an Extras log on the first run unless we specifically ask for it.

Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
Reglock::
[HKEY_USERS\S-1-5-21-2000478354-926492609-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]

Registry::
[HKEY_USERS\S-1-5-21-2000478354-926492609-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=-
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=-

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

===================================================

Your missing start menu items are a bit odd. Looking back, after running RKill and Unhide, you said that your start menu items were back. Was this logged in as Administrator or your username?

OK, so now I booted up in normal mode and the desktop is still all black, no icons, and the start menu is very minimal, no internet explorer. Also, the programs in my list are gone

I’m a bit confused here. By “Normal” mode, was that as Administrator or as Shannon?

Please tell me if there are any programs in the start menu and if it is only the shortcuts that are missing. I need to know this for both – ie when you log on with your username and as Administrator.


We can restore the defaults for the Start Menu, Accessories and Administrative Tools if they are missing. Please tell me if any of those are missing and I’ll supply instructions.

Thanks

Satchfan
Post #45
There's no problem with the time difference. The infected computer is an extra, and since it's small it's easy to cart back and forth to work. I really appreciate your help and patience! Re: "Normal mode," by that I meant not in Safe Mode. Whenever I am in Safe Networking Mode, I am logged in as Administrator. When not in Safe mode, I'm logged in as Shannon. When I stated earlier that my start menu was restored, I was wrong. It's just that the "look" of the start menu was restored in safe mode so I thought it was back. In both Safe Networking Mode (as Adminsitrator) and normal mode (as Shannon), there are no programs, only shortcuts. In both modes, it appears that Accessories are all there, but there are no System Tools (I checked in Control Panel as well – the screen is blank). In normal mode, the toolbar at the bottom right shows the running services such as Avira, the wireless, etc. If I click on the C drive, Program files, I can see that they are all still there. I'm running ComboFix now (on the infected comptuer). Will post the log as soon as it's finished.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI