What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan:JS/IframeRef [Solved]

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Security Essentials keeps finding the Trojan: Trojan:JS/IframeRef. After I give permission for removal, I am asked to restart the computer. The same Trajan will reappear, sometimes more quickly than others. It is starting to affect my computer performance. Please help me rid this infection from my computer (Windows XP) Thank you, A.J.K.M.
Post #2 last edited
Hello A.J.K.M and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please do not give out your email address on a public forum. I have edited it out of your post.

Please read the following guidelines which will help to make cleaning your machine easier:
  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Run DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

  • disable any script blocking protection (How to Disable your Security Programs)
  • double click DDS icon to run the tool (may take up to 3 minutes to run)
  • when done, DDS.txt will open.
  • after a few moments, attach.txt will open in a second window.
  • save both reports to your desktop.
  • Post the contents of the DDS.txt and Attach.txt reports in your next reply
===================================================

Run aswMBR
  • download aswMBR.exe to your desktop.
  • double click aswMBR.exe to run it
  • if asked, accept the AVAST virus definition download
  • click the "Scan" button to start scan
  • on completion of the scan click Save log, save it to your desktop and post in your next reply
Logs to include with next post:

DDS.txt
Attach.txt
aswMBR log

Thanks

Satchfan
Post #3
Satchfan, Thank you for your response and help. Following are the 3 files you requested I attache to this response. I await your next instructions. I'm not certain how to attach 'notepad' files to this post. Do you want me to cut/paste open file or is there a way to attach the files?
Post #4
Please copy and paste them into your post. I have to leave for a while now but will look at your logs and reply as soon as I can. Satchfan
Post #5
Thank you. Here are the reports: . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_31 Run by [removed] at 9:58:13 on 2012-04-26 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1300 [GMT -5:00] . AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes =============== . C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\System32\mshta.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\RTHDCPL.EXE C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\AVAST Software\Avast\avastUI.exe C:\Program Files\AWS\WeatherBug\Weather.exe C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Palm\HOTSYNC.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\IObit\Advanced SystemCare 5\ASC.exe C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\system32\SearchProtocolHost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://isearch.avg.com/?cid={65B9B557-A7F9-4314-B42F-C7920C264324}∣=⟨=&ds;=≺=&d;=&v;=&sap;=hp uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop uDefault_Search_URL = hxxp://www.google.com/ie uSearch Bar = hxxp://www.google.com/ie mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://home.peoplepc.com/search uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll uURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll uURLSearchHooks: H - No File mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll mURLSearchHooks: H - No File BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: hpWebHelper Class: {aaae832a-5fff-4661-9c8f-369692d1dcb9} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\WebHelper.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: {E8DAAA30-6CAA-4b58-9603-8E54238219E2} - No File BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll TB: &Google; Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll EB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1 mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [AlwaysReady Power Message APP] ARPWRMSG.EXE mRun: [DMAScheduler] "c:\program files\hp digitalmedia archive\DMAScheduler.exe" mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [IJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.exe mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui StartupFolder: c:\docume~1\hp_adm~1\startm~1\programs\startup\hotsyn~1.lnk - c:\palm\HOTSYNC.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodaks~1.lnk - c:\program files\kodak\kodak software updater\7288971\program\backWeb-7288971.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\9972322\program\Updates from HP.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\versio~1.lnk - c:\windows\installer\{78c5d256-a94e-4593-bb24-ced07afc7938}\New_Shortcut_S1699_A8EB5A2133B04A97AEEFDFB17E2E701D.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe IE: E&xport; to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000 IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab TCP: DhcpNameServer = 192.168.30.1 192.168.2.1 TCP: Interfaces\{11F0D49C-5299-434E-8EB8-479F8A0731B2} : DhcpNameServer = 192.168.30.1 192.168.2.1 TCP: Interfaces\{892900FC-9814-4488-99C0-81491C1EE93D} : DhcpNameServer = [removed] [removed] [removed] [removed] Notify: TPSvc - TPSvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\hp_administrator\application data\mozilla\firefox\profiles\0pc4ws4u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;= FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B7c26ee5d-fee5-4534-9787-aa5d4185038d%7D∣=05fad2627b16a0be019094f985765214-2d26666d54754f6641b8f9c40321cfff7167cd4b&ds;=AVG&v;=10.2.0.3⟨=en≺=fr&d;=2012-04-10%2023%3A24%3A21&sap;=ku&q;= FF - component: c:\documents and settings\hp_administrator\application data\mozilla\firefox\profiles\0pc4ws4u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - component: c:\documents and settings\hp_administrator\application data\mozilla\firefox\profiles\0pc4ws4u.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll FF - component: c:\program files\avg\avg10\firefox\components\avgssff.dll FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\canon\easy-photoprint ex\NPEZFFPI.DLL FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_233.dll . —- FIREFOX POLICIES —- FF - user.js: yahoo.homepage.dontask - true ============= SERVICES / DRIVERS =============== . R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [2012-3-11 56208] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-4-12 612184] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-4-12 337880] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648] R1 RapportCerberus_34302;RapportCerberus_34302;c:\documents and settings\all users\application data\trusteer\rapport\store\exts\rapportcerberus\34302\RapportCerberus32_34302.sys [2011-12-15 228208] R1 RapportEI;RapportEI;c:\program files\trusteer\rapport\bin\RapportEI.sys [2012-3-11 71440] R1 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2012-3-11 164112] R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\iobit\advanced systemcare 5\ASCService.exe [2012-4-12 913752] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-4-12 20696] R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-4-12 44768] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 RapportMgmtService;Rapport Management Service;c:\program files\trusteer\rapport\bin\RapportMgmtService.exe [2012-3-11 931640] S1 aaxaihys;aaxaihys; [x] S1 aloooyql;aloooyql;c:\windows\system32\drivers\aloooyql.sys [2012-4-26 42960] S1 amxazyeh;amxazyeh; [x] S1 anwohydi;anwohydi; [x] S1 asgmiduu;asgmiduu; [x] S1 avyaqluc;avyaqluc;\??\c:\windows\system32\drivers\avyaqluc.sys –> c:\windows\system32\drivers\avyaqluc.sys [?] S1 awahhqqq;awahhqqq; [x] S1 awrdgphz;awrdgphz; [x] S1 aysyxjdp;aysyxjdp; [x] S1 bdciuwvi;bdciuwvi; [x] S1 bfdjccpn;bfdjccpn;\??\c:\windows\system32\drivers\bfdjccpn.sys –> c:\windows\system32\drivers\bfdjccpn.sys [?] S1 bfxnqval;bfxnqval; [x] S1 bjbkldmx;bjbkldmx; [x] S1 bmynadok;bmynadok; [x] S1 bosfzspu;bosfzspu; [x] S1 cjjjziiu;cjjjziiu; [x] S1 cleuueai;cleuueai; [x] S1 clxyljbj;clxyljbj; [x] S1 cnyhgcng;cnyhgcng; [x] S1 cqvbmrgn;cqvbmrgn; [x] S1 cstwxgbv;cstwxgbv; [x] S1 dapxhzmr;dapxhzmr; [x] S1 dcflsldg;dcflsldg; [x] S1 dgiwaygz;dgiwaygz;\??\c:\windows\system32\drivers\dgiwaygz.sys –> c:\windows\system32\drivers\dgiwaygz.sys [?] S1 dpklhojc;dpklhojc; [x] S1 dqrjvwmb;dqrjvwmb; [x] S1 dtvosiup;dtvosiup; [x] S1 dxtvwvzj;dxtvwvzj; [x] S1 dytummzo;dytummzo; [x] S1 elkepwdp;elkepwdp; [x] S1 ercvgjfs;ercvgjfs; [x] S1 erggucgs;erggucgs; [x] S1 ewduyewf;ewduyewf;\??\c:\windows\system32\drivers\ewduyewf.sys –> c:\windows\system32\drivers\ewduyewf.sys [?] S1 fdjkedub;fdjkedub; [x] S1 fgnxjzcw;fgnxjzcw; [x] S1 fhmhalia;fhmhalia; [x] S1 fhuvnhze;fhuvnhze; [x] S1 fnjvhizd;fnjvhizd; [x] S1 fvohuhef;fvohuhef; [x] S1 gadimimt;gadimimt;\??\c:\windows\system32\drivers\gadimimt.sys –> c:\windows\system32\drivers\gadimimt.sys [?] S1 gcsimisa;gcsimisa; [x] S1 gezdpnoz;gezdpnoz; [x] S1 gkkbktkp;gkkbktkp; [x] S1 gkmqidbs;gkmqidbs; [x] S1 gpgqpdkt;gpgqpdkt; [x] S1 gwuyqhdh;gwuyqhdh; [x] S1 hmhkpgds;hmhkpgds;\??\c:\windows\system32\drivers\hmhkpgds.sys –> c:\windows\system32\drivers\hmhkpgds.sys [?] S1 hngibxtq;hngibxtq; [x] S1 igingmll;igingmll; [x] S1 igiyppps;igiyppps; [x] S1 ikpgtwgk;ikpgtwgk; [x] S1 ipzmszcn;ipzmszcn; [x] S1 ivpuooyc;ivpuooyc; [x] S1 jbifmbwn;jbifmbwn; [x] S1 jjcdjylf;jjcdjylf; [x] S1 jjtrvrpz;jjtrvrpz; [x] S1 jkcckmjt;jkcckmjt; [x] S1 jlhuqzpl;jlhuqzpl; [x] S1 jqhilvdx;jqhilvdx; [x] S1 jwekksmv;jwekksmv;\??\c:\windows\system32\drivers\jwekksmv.sys –> c:\windows\system32\drivers\jwekksmv.sys [?] S1 jxtaskpa;jxtaskpa; [x] S1 knlkvxvl;knlkvxvl; [x] S1 knunempj;knunempj; [x] S1 koerxrjq;koerxrjq; [x] S1 kpmrttwh;kpmrttwh; [x] S1 krnixgga;krnixgga;\??\c:\windows\system32\drivers\krnixgga.sys –> c:\windows\system32\drivers\krnixgga.sys [?] S1 ktwcjxzq;ktwcjxzq; [x] S1 lpboryhg;lpboryhg; [x] S1 mbbaslqr;mbbaslqr;\??\c:\windows\system32\drivers\mbbaslqr.sys –> c:\windows\system32\drivers\mbbaslqr.sys [?] S1 mejgojqk;mejgojqk; [x] S1 mmwsqxun;mmwsqxun; [x] S1 mtmmwaxg;mtmmwaxg; [x] S1 nihhdjyb;nihhdjyb; [x] S1 nikqlczs;nikqlczs; [x] S1 nknveakk;nknveakk; [x] S1 nlxvyvzy;nlxvyvzy; [x] S1 nuroovqh;nuroovqh; [x] S1 nwvpsqwz;nwvpsqwz; [x] S1 nyemfepe;nyemfepe; [x] S1 obtxtedt;obtxtedt; [x] S1 omcjvevw;omcjvevw; [x] S1 oszwline;oszwline;\??\c:\windows\system32\drivers\oszwline.sys –> c:\windows\system32\drivers\oszwline.sys [?] S1 oxguwjnl;oxguwjnl; [x] S1 ozjoqdtr;ozjoqdtr;\??\c:\windows\system32\drivers\ozjoqdtr.sys –> c:\windows\system32\drivers\ozjoqdtr.sys [?] S1 parhjjok;parhjjok; [x] S1 pcdjcqai;pcdjcqai; [x] S1 pmhucauv;pmhucauv; [x] S1 pnfghaqu;pnfghaqu; [x] S1 pxqzxoaf;pxqzxoaf; [x] S1 qglkdfzd;qglkdfzd; [x] S1 qgmeaffg;qgmeaffg; [x] S1 qntmpkln;qntmpkln; [x] S1 qpuellzp;qpuellzp; [x] S1 qqnswemg;qqnswemg;\??\c:\windows\system32\drivers\qqnswemg.sys –> c:\windows\system32\drivers\qqnswemg.sys [?] S1 qtzuaavp;qtzuaavp; [x] S1 qveevalq;qveevalq; [x] S1 qvhghdsz;qvhghdsz; [x] S1 qvwtabgi;qvwtabgi; [x] S1 rabkklnh;rabkklnh; [x] S1 rffedtwp;rffedtwp;\??\c:\windows\system32\drivers\rffedtwp.sys –> c:\windows\system32\drivers\rffedtwp.sys [?] S1 rgwcsvbc;rgwcsvbc; [x] S1 rlgowvyc;rlgowvyc; [x] S1 rqkrnuqa;rqkrnuqa; [x] S1 rsjlervj;rsjlervj; [x] S1 rvcfdjqj;rvcfdjqj; [x] S1 rwmdihkh;rwmdihkh; [x] S1 sibcdjcr;sibcdjcr; [x] S1 sizbolqx;sizbolqx; [x] S1 sjwojwjp;sjwojwjp; [x] S1 spfiirig;spfiirig; [x] S1 sqhugywn;sqhugywn;\??\c:\windows\system32\drivers\sqhugywn.sys –> c:\windows\system32\drivers\sqhugywn.sys [?] S1 svvawmpo;svvawmpo; [x] S1 ubxrryay;ubxrryay;\??\c:\windows\system32\drivers\ubxrryay.sys –> c:\windows\system32\drivers\ubxrryay.sys [?] S1 udmenvkd;udmenvkd; [x] S1 uffcaflz;uffcaflz; [x] S1 ukuqnyaz;ukuqnyaz; [x] S1 uunryqdi;uunryqdi; [x] S1 uvvjowij;uvvjowij; [x] S1 wzghtyid;wzghtyid; [x] S1 xjnujlcb;xjnujlcb; [x] S1 xwwqyqig;xwwqyqig; [x] S1 xxvlyppi;xxvlyppi; [x] S1 yguhgqwr;yguhgqwr; [x] S1 yhmehhav;yhmehhav; [x] S1 ypbzyzdj;ypbzyzdj; [x] S1 ypeazctt;ypeazctt;\??\c:\windows\system32\drivers\ypeazctt.sys –> c:\windows\system32\drivers\ypeazctt.sys [?] S1 zaddknpv;zaddknpv; [x] S1 zegnzugc;zegnzugc; [x] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-18 135664] S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-3-29 253088] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriver.sys –> c:\windows\system32\drivers\AVGIDSDriver.Sys [?] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilter.sys –> c:\windows\system32\drivers\AVGIDSFilter.Sys [?] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshim.sys –> c:\windows\system32\drivers\AVGIDSShim.Sys [?] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-18 135664] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-9 14336] . =============== Created Last 30 ================ . 2012-04-26 14:53:35 42960 —-a-w- c:\windows\system32\drivers\aloooyql.sys 2012-04-26 14:30:37 56200 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{aea25e2b-6b9b-4e4b-a707-1482e1a129e7}\offreg.dll 2012-04-26 03:11:29 6734704 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{aea25e2b-6b9b-4e4b-a707-1482e1a129e7}\mpengine.dll 2012-04-25 22:12:33 ——– d—–w- c:\documents and settings\hp_administrator\application data\SpeedyPC Software 2012-04-25 22:12:19 ——– d—–w- c:\documents and settings\all users\application data\SpeedyPC Software 2012-04-24 18:37:11 ——– d—–w- c:\program files\AVG Secure Search 2012-04-14 01:27:06 ——– d—–w- c:\windows\system32\winrm 2012-04-14 01:26:54 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$ 2012-04-13 02:27:31 2321288 —-a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\backup\mpengine.dll 2012-04-13 02:27:25 6582328 —-a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{0c4b3f48-b6de-4ddd-86c7-36d37b866eb2}\mpengine.dll 2012-04-12 15:58:00 6734704 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2012-04-12 05:41:47 612184 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2012-04-12 05:41:12 41184 —-a-w- c:\windows\avastSS.scr 2012-04-12 05:19:47 ——– d—–w- c:\documents and settings\all users\application data\IObit 2012-04-12 05:18:36 ——– d—–w- c:\documents and settings\hp_administrator\application data\IObit 2012-04-12 05:18:23 ——– d—–w- c:\program files\IObit 2012-04-11 06:36:47 ——– d—–w- c:\program files\Microsoft Security Client 2012-04-11 04:25:11 ——– d—–w- c:\documents and settings\hp_administrator\application data\AVG2012 2012-04-11 04:24:21 ——– d—–w- c:\documents and settings\all users\application data\AVG Secure Search 2012-04-11 04:02:41 ——– d—–w- c:\documents and settings\hp_administrator\local settings\application data\PCHealth 2012-04-10 05:09:14 ——– d—–w- c:\documents and settings\all users\application data\PC Tools 2012-04-09 06:52:29 42864 —-a-r- c:\windows\system32\SBBD.EXE 2012-04-09 06:52:29 101112 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-04-08 06:27:46 ——– d—–w- c:\program files\AVAST Software 2012-04-08 06:27:46 ——– d—–w- c:\documents and settings\all users\application data\AVAST Software 2012-04-08 06:07:44 11776 —-a-w- c:\program files\mozilla firefox\plugins\nprjplug.dll 2012-04-08 06:06:54 ——– d—–w- c:\program files\common files\xing shared 2012-04-08 06:06:14 150696 —-a-w- c:\program files\mozilla firefox\plugins\nppl3260.dll 2012-04-08 06:05:53 108544 —-a-w- c:\program files\mozilla firefox\plugins\nprpjplug.dll 2012-04-06 19:46:15 ——– d—–w- c:\windows\system32\wbem\repository\FS 2012-04-06 19:46:15 ——– d—–w- c:\windows\system32\wbem\Repository 2012-04-04 05:53:56 182160 —-a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll 2012-04-04 05:53:56 182160 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll 2012-03-29 13:51:58 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe . ==================== Find3M ==================== . 2012-04-16 03:33:38 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-08 06:05:39 499712 —-a-w- c:\windows\system32\msvcp71.dll 2012-04-08 06:05:39 348160 —-a-w- c:\windows\system32\msvcr71.dll 2012-04-04 20:56:40 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-11 18:48:50 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2012-03-05 19:15:35 73728 —-a-w- c:\windows\system32\javacpl.cpl 2012-03-05 19:15:34 472808 —-a-w- c:\windows\system32\deployJava1.dll 2012-03-01 11:01:32 916992 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 11:01:32 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01:32 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10:16 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 14:10:16 148480 ——w- c:\windows\system32\imagehlp.dll 2012-02-29 12:17:40 385024 —-a-w- c:\windows\system32\html.iec 2012-02-23 15:18:36 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-02-03 09:22:18 1860096 —-a-w- c:\windows\system32\win32k.sys . ============= FINISH: 9:59:26.35 =============== NEXT REPORT . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Professional Boot Device: \Device\Harddisk0\DP(1)0x7e00-0x380248fe00+1 Install Date: 3/12/2008 5:21:24 PM System Uptime: 4/26/2012 9:40:03 AM (0 hours ago) . Motherboard: ASUSTek Computer INC. | | NODUSM3 Processor: AMD Athlon™ 64 X2 Dual Core Processor 4600+ | Socket AM2 | 2405/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 224 GiB total, 178.851 GiB free. D: is FIXED (FAT32) - 9 GiB total, 0.616 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP1668: 3/20/2012 9:21:35 PM - Software Distribution Service 3.0 RP1669: 3/22/2012 10:43:15 AM - Software Distribution Service 3.0 RP1670: 3/23/2012 10:49:38 AM - System Checkpoint RP1671: 3/23/2012 8:43:02 PM - Software Distribution Service 3.0 RP1672: 3/24/2012 2:01:26 PM - Software Distribution Service 3.0 RP1673: 3/25/2012 3:07:39 PM - System Checkpoint RP1674: 3/25/2012 7:35:48 PM - Software Distribution Service 3.0 RP1675: 3/26/2012 9:43:00 PM - System Checkpoint RP1676: 3/27/2012 9:04:57 AM - Installed Rapport RP1677: 3/27/2012 9:11:45 AM - Software Distribution Service 3.0 RP1678: 3/28/2012 9:41:53 AM - System Checkpoint RP1679: 3/28/2012 6:01:51 PM - Software Distribution Service 3.0 RP1680: 3/29/2012 8:33:39 PM - Software Distribution Service 3.0 RP1681: 3/30/2012 10:30:38 PM - Software Distribution Service 3.0 RP1682: 3/31/2012 10:36:24 PM - System Checkpoint RP1683: 4/1/2012 7:10:27 PM - Software Distribution Service 3.0 RP1684: 4/2/2012 8:29:40 PM - Software Distribution Service 3.0 RP1685: 4/3/2012 9:10:09 PM - System Checkpoint RP1686: 4/4/2012 8:10:25 AM - Software Distribution Service 3.0 RP1687: 4/4/2012 1:52:19 PM - Software Distribution Service 3.0 RP1688: 4/5/2012 2:15:22 PM - System Checkpoint RP1689: 4/5/2012 2:29:21 PM - Software Distribution Service 3.0 RP1690: 4/6/2012 1:29:29 PM - Restore Operation RP1691: 4/6/2012 2:59:42 PM - Software Distribution Service 3.0 RP1692: 4/7/2012 10:53:47 AM - Software Distribution Service 3.0 RP1693: 4/8/2012 1:27:46 AM - avast! Free Antivirus Setup RP1694: 4/8/2012 12:10:42 PM - Software Distribution Service 3.0 RP1695: 4/9/2012 1:52:03 AM - Installed STOPzilla. Available with Windows Installer version 1.2 and later. RP1696: 4/9/2012 10:32:33 AM - Software Distribution Service 3.0 RP1697: 4/9/2012 8:38:19 PM - Removed STOPzilla. Available with Windows Installer version 1.2 and later. RP1698: 4/9/2012 8:39:52 PM - avast! Free Antivirus Setup RP1699: 4/10/2012 4:03:40 PM - Removed AVG 2012 RP1700: 4/10/2012 4:05:16 PM - Removed AVG 2012 RP1701: 4/10/2012 10:56:32 PM - Installed AVG 2012 RP1702: 4/10/2012 11:21:28 PM - Installed AVG 2012 RP1703: 4/10/2012 11:25:34 PM - Removed AVG 2012 RP1704: 4/10/2012 11:28:16 PM - Removed AVG 2012 RP1705: 4/10/2012 11:28:58 PM - Removed AVG 2012 RP1706: 4/10/2012 11:29:41 PM - Removed AVG 2012 RP1707: 4/10/2012 11:30:18 PM - Removed AVG 2012 RP1708: 4/10/2012 11:30:53 PM - Removed AVG 2012 RP1709: 4/10/2012 11:31:33 PM - Removed AVG 2012 RP1710: 4/11/2012 1:33:33 AM - Installed Windows Defender RP1711: 4/11/2012 10:23:05 AM - Software Distribution Service 3.0 RP1712: 4/11/2012 9:07:32 PM - Software Distribution Service 3.0 RP1713: 4/12/2012 12:40:53 AM - avast! Free Antivirus Setup RP1714: 4/12/2012 10:57:35 AM - Software Distribution Service 3.0 RP1715: 4/12/2012 11:02:17 AM - Removed AVG 2012 RP1716: 4/12/2012 7:37:30 PM - Software Distribution Service 3.0 RP1717: 4/12/2012 9:03:49 PM - Removed MobileMe Control Panel RP1718: 4/12/2012 9:27:18 PM - Software Distribution Service 3.0 RP1719: 4/13/2012 8:25:09 PM - Installed %1 %2. RP1720: 4/13/2012 8:27:02 PM - Installed %1 %2. RP1721: 4/13/2012 8:29:37 PM - Installed Windows XP KB2492386. RP1722: 4/13/2012 8:30:46 PM - Installed Windows XP KB2598845. RP1723: 4/13/2012 8:31:49 PM - Installed Windows XP KB2632503. RP1724: 4/13/2012 8:51:25 PM - Software Distribution Service 3.0 RP1725: 4/14/2012 8:54:26 PM - Software Distribution Service 3.0 RP1726: 4/15/2012 10:14:36 PM - Software Distribution Service 3.0 RP1727: 4/16/2012 1:07:29 PM - Software Distribution Service 3.0 RP1728: 4/17/2012 1:18:18 PM - Software Distribution Service 3.0 RP1729: 4/18/2012 11:16:11 PM - Software Distribution Service 3.0 RP1730: 4/20/2012 7:28:45 AM - Software Distribution Service 3.0 RP1731: 4/21/2012 9:27:29 AM - Software Distribution Service 3.0 RP1732: 4/22/2012 1:17:58 PM - Software Distribution Service 3.0 RP1733: 4/23/2012 7:05:37 PM - Software Distribution Service 3.0 RP1734: 4/24/2012 7:25:33 PM - Software Distribution Service 3.0 RP1735: 4/25/2012 10:11:24 PM - Software Distribution Service 3.0 . ==== Installed Programs ====================== . . Adobe AIR Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader X (10.1.3) Advanced SystemCare 5 Apple Application Support Apple Mobile Device Support Apple Software Update avast! Free Antivirus Bonjour BufferChm Canon Easy-WebPrint EX Canon IJ Network Scan Utility Canon IJ Network Tool Canon Inkjet Printer/Scanner/Fax Extended Survey Program Canon MP Navigator EX 3.0 Canon MP640 series MP Drivers Canon MP640 series User Registration Canon Utilities Easy-PhotoPrint EX Canon Utilities My Printer Canon Utilities Solution Menu Compatibility Pack for the 2007 Office system CP_AtenaShokunin1Config CP_CalendarTemplates1 cp_LightScribeConfig cp_OnlineProjectsConfig CP_Package_Basic1 CP_Package_Variety1 CP_Package_Variety2 CP_Package_Variety3 CP_Panorama1Config cp_PosterPrintConfig cp_UpdateProjectsConfig CueTour Data Fax SoftModem with SmartCP Destinations DeviceManagementQFolder DriverGuide Toolkit Enhanced Multimedia Keyboard Solution FullDPAppQFolder Google Earth Google Toolbar for Internet Explorer Google Update Helper Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Player 10 (KB903157) Hotfix for Windows XP (KB2443685) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB2633952) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) HP Boot Optimizer HP DigitalMedia Archive HP DVD Play 2.1 HP Imaging Device Functions 7.0 HP Photosmart for Media Center PC HP Photosmart Premier Software 6.5 HP Update HP Web Helper HPPhotoSmartExpress HpSdpAppCoreApp InstantShareAlert InstantShareDevices Java Auto Updater Java™ 6 Update 31 LightScribe 1.4.105.1 Malwarebytes Anti-Malware version 1.61.0.1400 Microsoft .NET Framework 1.0 Hotfix (KB2572066) Microsoft .NET Framework 1.0 Hotfix (KB2656378) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2656353) Microsoft .NET Framework 1.1 Security Update (KB2656370) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Antimalware Microsoft Application Error Reporting Microsoft Base Smart Card Cryptographic Service Provider Package Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Interactive Training Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office XP Media Content Microsoft Office XP Standard for Students and Teachers Microsoft Security Client Microsoft Security Essentials Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Works Mozilla Firefox 11.0 (x86 en-US) MSN MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) My HP Games NVIDIA Drivers OpenOffice.org Installer 1.0 OptionalContentQFolder Palm Desktop PhotoGallery Quicken 2006 QuickTime RandMap Rapport RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek High Definition Audio Driver RealUpgrade 1.1 Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft Windows (KB2564958) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 8 (KB2183461) Security Update for Windows Internet Explorer 8 (KB2360131) Security Update for Windows Internet Explorer 8 (KB2416400) Security Update for Windows Internet Explorer 8 (KB2482017) Security Update for Windows Internet Explorer 8 (KB2497640) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2530548) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2559049) Security Update for Windows Internet Explorer 8 (KB2586448) Security Update for Windows Internet Explorer 8 (KB2618444) Security Update for Windows Internet Explorer 8 (KB2647516) Security Update for Windows Internet Explorer 8 (KB2675157) Security Update for Windows Internet Explorer 8 (KB969897) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB972260) Security Update for Windows Internet Explorer 8 (KB974455) Security Update for Windows Internet Explorer 8 (KB976325) Security Update for Windows Internet Explorer 8 (KB978207) Security Update for Windows Internet Explorer 8 (KB981332) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player (KB2378111) Security Update for Windows XP (KB2279986) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2296199) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2436673) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2476687) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479628) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485376) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2491683) Security Update for Windows XP (KB2503658) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2511455) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2536276) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2555917) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2567053) Security Update for Windows XP (KB2567680) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2585542) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2621440) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2633171) Security Update for Windows XP (KB2639417) Security Update for Windows XP (KB2641653) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB2647518) Security Update for Windows XP (KB2653956) Security Update for Windows XP (KB2660465) Security Update for Windows XP (KB2661637) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB981957) Security Update for Windows XP (KB982132) Shipping Assistant 3.7 SkinsHP1 SlideShow SlideShowMusic Sonic_PrimoSDK Unload Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows Internet Explorer 8 (KB2447568) Update for Windows Internet Explorer 8 (KB2598845) Update for Windows Internet Explorer 8 (KB2632503) Update for Windows Internet Explorer 8 (KB968220) Update for Windows Internet Explorer 8 (KB976662) Update for Windows Internet Explorer 8 (KB976749) Update for Windows Internet Explorer 8 (KB978506) Update for Windows Internet Explorer 8 (KB980182) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2492386) Update for Windows XP (KB2541763) Update for Windows XP (KB2607712) Update for Windows XP (KB2616676) Update for Windows XP (KB2641690) Update for Windows XP (KB971029) Updates from HP (remove only) WeatherBug WebFldrs XP Windows Defender Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Management Framework Core Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player Firefox Plugin Windows XP Media Center Edition 2005 KB2502898 Windows XP Media Center Edition 2005 KB2619340 Windows XP Media Center Edition 2005 KB2628259 Windows XP Service Pack 3 Yahoo! Install Manager Yahoo! Software Update Yahoo! Toolbar . ==== Event Viewer Messages From Past Week ======== . 4/26/2012 9:57:40 AM, error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the Interface with IP address 192.168.2.100. The machine with the IP address 192.168.2.102 did not allow the name to be claimed by this machine. 4/25/2012 9:53:20 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/25/2012 5:53:19 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/25/2012 4:52:10 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/25/2012 11:19:53 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/25/2012 10:49:05 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/24/2012 9:59:49 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/24/2012 12:59:02 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/24/2012 11:01:39 AM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/23/2012 8:02:11 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/23/2012 7:59:03 AM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/23/2012 7:20:06 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Search service to connect. 4/23/2012 7:20:06 AM, error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 4/23/2012 7:20:06 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 4/23/2012 7:18:42 AM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23). 4/23/2012 6:56:17 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ftsata2 4/23/2012 6:56:17 PM, error: Service Control Manager [7022] - The Windows Image Acquisition (WIA) service hung on starting. 4/23/2012 6:54:50 PM, error: Service Control Manager [7000] - The MCSTRM service failed to start due to the following error: The system cannot find the file specified. 4/23/2012 6:54:42 PM, error: Print [23] - Printer Lexmark 3100 Series,0 failed to initialize because a suitable Lexmark 3100 Series driver could not be found. 4/22/2012 5:56:08 AM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s). 4/22/2012 4:52:13 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service. 4/21/2012 9:09:35 AM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/20/2012 7:59:05 AM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/20/2012 4:59:02 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/19/2012 9:49:37 AM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/19/2012 8:59:02 AM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/19/2012 8:49:15 PM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. 4/19/2012 12:04:52 AM, error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver skipped scanning items and is in pass through mode. This may be due to low resource conditions. . ==== End Of File =========================== LAST REPORT aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-04-26 10:05:12 —————————– 10:05:12.403 OS Version: Windows 5.1.2600 Service Pack 3 10:05:12.403 Number of processors: 2 586 0x4B02 10:05:12.403 ComputerName: AJDESKTOPOFFICE UserName: 10:05:13.200 Initialize success 10:05:13.387 AVAST engine defs: 12042600 10:05:28.261 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e 10:05:28.261 Disk 0 Vendor: WDC_WD2500JS-60NCB1 10.02E02 Size: 238475MB BusType: 3 10:05:28.277 Disk 0 MBR read successfully 10:05:28.277 Disk 0 MBR scan 10:05:28.277 Disk 0 unknown MBR code 10:05:28.277 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 229412 MB offset 63 10:05:28.323 Disk 0 Partition 2 00 0C FAT32 LBA RECOVERY 9052 MB offset 469853055 10:05:28.323 Disk 0 scanning sectors +488392065 10:05:28.417 Disk 0 scanning C:\WINDOWS\system32\drivers 10:05:35.760 Service scanning 10:05:52.400 Modules scanning 10:05:58.008 Disk 0 trace - called modules: 10:05:58.055 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 10:05:58.055 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a7b2ab8] 10:05:58.055 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\00000074[0x8a7449e8] 10:05:58.071 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-e[0x8a7e7d98] 10:05:58.712 AVAST engine scan C:\WINDOWS 10:06:03.571 AVAST engine scan C:\WINDOWS\system32 10:08:25.902 AVAST engine scan C:\WINDOWS\system32\drivers 10:08:40.073 AVAST engine scan C:\Documents and Settings\HP_Administrator 10:17:14.672 AVAST engine scan C:\Documents and Settings\All Users 10:20:28.815 Scan finished successfully 10:21:42.263 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\HP_Administrator\My Documents\Computer\Computer\REmoving.Trojan\MBR.dat" 10:21:42.278 The log file has been saved successfully to "C:\Documents and Settings\HP_Administrator\My Documents\Computer\Computer\REmoving.Trojan\aswMBR.A.K.J.M.4-26.txt" I WILL BE IN AND OUT THIS AFTERNOON BUT WILL CHECK SITE EACH TIME I AM IN. THANK YOU!
Post #6
Hi AJKM

Your computer is very infected so please do as I previously asked and do not install/uninstall anything without instructions or run any other tools.

We should be able to clear it up. ;)

FIRST

Running multiple antivirus programs

You can not run two real-time antiviruses at the same time. Although many have different methods of searching for and recognising threats, they will all be 'fighting' in memory to kick each other out, rendering them all ineffective.

Uninstall either Avast or Microsoft Security Essentials.
  • click on Start, Settings, Control Panel
  • double-click Add or Remove Programs (it may take time for the list to appear, so be patient)
  • scroll down the list and look for the program you are uninstalling, click on it and then on Remove.
===================================================

Run AVG removal tool

There will still be some remnants of AVG on your computer even after the uninstall so please download and run AVG Removal Tool from here.

===================================================

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, as they may otherwise interfere with our tools. See here for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.

    [external image: Posted Image]


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [external image: Posted Image]


    Click on Yes, to continue scanning for malware.
Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Satchfan
Post #7
Satchfan, Following is the log from the latest scan: ComboFix 12-04-26.01 - HP_Administrator 04/26/2012 20:39:19.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1529 [GMT -5:00] Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Administrator\WINDOWS c:\documents and settings\All Users\Application Data\TEMP c:\documents and settings\All Users\Application Data\TEMP\0B4227B4.TMP c:\documents and settings\All Users\Application Data\TEMP\AVG\avi7.avg c:\documents and settings\All Users\Application Data\TEMP\AVG\crt_x64.msi c:\documents and settings\All Users\Application Data\TEMP\AVG\files.dat c:\documents and settings\All Users\Application Data\TEMP\AVG\incavi.avm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_cz.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_da.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_fr.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ge.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_hu.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_id.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_in.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_it.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_jp.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ko.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ms.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_nl.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pb.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pl.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pt.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ru.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sc.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sk.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sp.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_tr.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_us.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zh.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zt.htm c:\documents and settings\All Users\Application Data\TEMP\AVG\microavi.avg c:\documents and settings\All Users\Application Data\TEMP\AVG\miniavi.avg c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.dat c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.exe c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.ini c:\documents and settings\All Users\Application Data\TEMP\AVG\setupcz.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupda.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupfr.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupge.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setuphu.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupid.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupin.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupit.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupjp.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupko.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupms.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupnl.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setuppb.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setuppl.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setuppt.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupru.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupsc.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupsk.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupsp.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setuptr.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupus.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupzh.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\setupzt.lns c:\documents and settings\All Users\Application Data\TEMP\AVG\trialkey.dat c:\documents and settings\All Users\Application Data\TEMP\AVG\vcredis1.cab c:\documents and settings\All Users\Application Data\TEMP\AVG\vcredist.msi c:\documents and settings\Default User\WINDOWS c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\weave\toFetch c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\weave\toFetch\bookmarks.json c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\weave\toFetch\clients.json c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\weave\toFetch\forms.json c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\weave\toFetch\history.json c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\weave\toFetch\passwords.json c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\weave\toFetch\prefs.json c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\weave\toFetch\tabs.json c:\documents and settings\HP_Administrator\Desktop\Setup.exe c:\documents and settings\HP_Administrator\System c:\documents and settings\HP_Administrator\System\win_qs8.jqx c:\documents and settings\HP_Administrator\WINDOWS c:\windows\AutoRun.ini c:\windows\system32\Cache c:\windows\system32\Cache\272512937d9e61a4.fb c:\windows\system32\Cache\287204568329e189.fb c:\windows\system32\Cache\28bc8f716fd76a47.fb c:\windows\system32\Cache\2c53092c95605355.fb c:\windows\system32\Cache\3917078cb68ec657.fb c:\windows\system32\Cache\590ba23ce359fd0c.fb c:\windows\system32\Cache\610289e025a3ee9a.fb c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb c:\windows\system32\Cache\73071dbedaedc01d.fb c:\windows\system32\Cache\8f1606b952bd0f08.fb c:\windows\system32\Cache\a8556537add6dfc5.fb c:\windows\system32\Cache\ad10a52aff5e038d.fb c:\windows\system32\Cache\c4d28dca2e7648be.fb c:\windows\system32\Cache\d201ef9910cd39de.fb c:\windows\system32\Cache\d2e94710a5708128.fb c:\windows\system32\Cache\d79b9dfe81484ec4.fb c:\windows\system32\Cache\de20e4c2dbb8d5b3.fb c:\windows\system32\Cache\e0de16f883bea794.fb c:\windows\system32\config\systemprofile\WINDOWS c:\windows\system32\SET143.tmp c:\windows\system32\SET148.tmp c:\windows\system32\SETA2.tmp c:\windows\system32\SETA3.tmp c:\windows\system32\urttemp c:\windows\system32\urttemp\fusion.dll c:\windows\system32\urttemp\mscoree.dll c:\windows\system32\urttemp\mscoree.dll.local c:\windows\system32\urttemp\mscorsn.dll c:\windows\system32\urttemp\mscorwks.dll c:\windows\system32\urttemp\msvcr71.dll c:\windows\system32\urttemp\regtlib.exe c:\windows\Tasks\At1.job c:\windows\Tasks\At10.job c:\windows\Tasks\At11.job c:\windows\Tasks\At12.job c:\windows\Tasks\At13.job c:\windows\Tasks\At14.job c:\windows\Tasks\At15.job c:\windows\Tasks\At16.job c:\windows\Tasks\At17.job c:\windows\Tasks\At18.job c:\windows\Tasks\At19.job c:\windows\Tasks\At2.job c:\windows\Tasks\At20.job c:\windows\Tasks\At21.job c:\windows\Tasks\At22.job c:\windows\Tasks\At23.job c:\windows\Tasks\At24.job c:\windows\Tasks\At3.job c:\windows\Tasks\At4.job c:\windows\Tasks\At5.job c:\windows\Tasks\At6.job c:\windows\Tasks\At7.job c:\windows\Tasks\At8.job c:\windows\Tasks\At9.job D:\Autorun.inf . . ((((((((((((((((((((((((( Files Created from 2012-03-27 to 2012-04-27 ))))))))))))))))))))))))))))))) . . 2012-04-26 15:31 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A085FCAE-FC72-4A74-86EC-709EFD7C457F}\mpengine.dll 2012-04-25 22:12 . 2012-04-25 22:12 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\SpeedyPC Software 2012-04-25 22:12 . 2012-04-26 03:47 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedyPC Software 2012-04-24 18:37 . 2012-04-24 18:37 ——– d—–w- c:\program files\AVG Secure Search 2012-04-14 01:27 . 2012-04-14 01:27 ——– d—–w- c:\windows\system32\winrm 2012-04-14 01:26 . 2012-04-14 01:27 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$ 2012-04-13 02:27 . 2007-03-09 16:25 2321288 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2012-04-13 02:27 . 2012-03-20 08:53 6582328 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{0C4B3F48-B6DE-4DDD-86C7-36D37B866EB2}\mpengine.dll 2012-04-12 15:58 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-04-12 05:54 . 2012-04-12 05:54 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\IObit 2012-04-12 05:19 . 2012-04-12 05:19 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit 2012-04-12 05:18 . 2012-04-13 13:45 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\IObit 2012-04-12 05:18 . 2012-04-12 05:18 ——– d—–w- c:\program files\IObit 2012-04-11 06:36 . 2012-04-11 06:37 ——– d—–w- c:\program files\Microsoft Security Client 2012-04-11 06:33 . 2012-04-11 06:33 ——– d—–w- c:\program files\Windows Defender 2012-04-11 04:25 . 2012-04-11 04:25 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\AVG2012 2012-04-11 04:24 . 2012-04-11 04:24 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Secure Search 2012-04-11 04:02 . 2012-04-11 04:02 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\PCHealth 2012-04-10 05:09 . 2012-04-11 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools 2012-04-09 06:52 . 2012-01-19 15:22 42864 —-a-r- c:\windows\system32\SBBD.EXE 2012-04-09 06:52 . 2012-01-12 14:26 101112 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-04-08 06:27 . 2012-04-27 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software 2012-04-08 06:27 . 2012-04-12 05:40 ——– d—–w- c:\program files\AVAST Software 2012-04-08 06:07 . 2012-04-08 06:07 11776 —-a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2012-04-08 06:06 . 2012-04-08 06:06 ——– d—–w- c:\program files\Common Files\xing shared 2012-04-08 06:06 . 2012-04-08 06:06 150696 —-a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2012-04-08 06:05 . 2012-04-08 06:05 108544 —-a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2012-04-06 19:46 . 2012-04-06 19:46 ——– d—–w- c:\windows\system32\wbem\Repository 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll 2012-03-29 13:51 . 2012-04-16 03:33 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-16 03:33 . 2011-05-14 17:50 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-08 06:05 . 2003-03-19 10:14 499712 —-a-w- c:\windows\system32\msvcp71.dll 2012-04-08 06:05 . 2003-02-21 18:42 348160 —-a-w- c:\windows\system32\msvcr71.dll 2012-04-04 20:56 . 2010-10-02 02:39 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-11 18:48 . 2012-03-11 18:48 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2012-03-05 19:15 . 2012-03-05 19:15 73728 —-a-w- c:\windows\system32\javacpl.cpl 2012-03-05 19:15 . 2010-05-20 17:14 472808 —-a-w- c:\windows\system32\deployJava1.dll 2012-03-01 11:01 . 2004-08-10 04:00 916992 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 11:01 . 2004-08-10 04:00 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01 . 2004-08-10 04:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10 . 2004-08-10 11:00 148480 ——w- c:\windows\system32\imagehlp.dll 2012-02-29 14:10 . 2004-08-10 04:00 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 12:17 . 2004-08-10 04:00 385024 —-a-w- c:\windows\system32\html.iec 2012-02-23 15:18 . 2011-09-15 23:15 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-02-03 09:22 . 2004-08-10 04:00 1860096 —-a-w- c:\windows\system32\win32k.sys 2012-03-13 04:39 . 2011-03-26 19:59 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-07 39408] "Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-04-29 1652736] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584] "RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616] "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312] "DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] . c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2004-4-13 299008] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Kodak EasyShare software.lnk - c:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2002-9-16 299008] KODAK Software Updater.lnk - c:\program files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-3-13 16384] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-8-15 36903] VersionTracker Pro.lnk - c:\windows\Installer\{78C5D256-A94E-4593-BB24-CED07AFC7938}\New_Shortcut_S1699_A8EB5A2133B04A97AEEFDFB17E2E701D.exe [2007-7-19 53248] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] . c:\documents and settings\Default User\Start Menu\Programs\Startup\ Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-8-15 27136] PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-15 27136] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [3/11/2012 1:48 PM 56208] R1 RapportCerberus_34302;RapportCerberus_34302;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys [12/15/2011 12:12 PM 228208] R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [3/11/2012 1:48 PM 71440] R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [3/11/2012 1:48 PM 164112] R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [4/12/2012 12:18 AM 913752] R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [3/11/2012 1:48 PM 931640] S1 aaxaihys;aaxaihys; [x] S1 amxazyeh;amxazyeh; [x] S1 anwohydi;anwohydi; [x] S1 asgmiduu;asgmiduu; [x] S1 avyaqluc;avyaqluc;\??\c:\windows\system32\drivers\avyaqluc.sys –> c:\windows\system32\drivers\avyaqluc.sys [?] S1 awahhqqq;awahhqqq; [x] S1 awrdgphz;awrdgphz; [x] S1 aysyxjdp;aysyxjdp; [x] S1 bdciuwvi;bdciuwvi; [x] S1 bfdjccpn;bfdjccpn;\??\c:\windows\system32\drivers\bfdjccpn.sys –> c:\windows\system32\drivers\bfdjccpn.sys [?] S1 bfxnqval;bfxnqval; [x] S1 bjbkldmx;bjbkldmx; [x] S1 bmynadok;bmynadok; [x] S1 bosfzspu;bosfzspu; [x] S1 cjjjziiu;cjjjziiu; [x] S1 cleuueai;cleuueai; [x] S1 clxyljbj;clxyljbj; [x] S1 cnyhgcng;cnyhgcng; [x] S1 cqvbmrgn;cqvbmrgn; [x] S1 cstwxgbv;cstwxgbv; [x] S1 dapxhzmr;dapxhzmr; [x] S1 dcflsldg;dcflsldg; [x] S1 dgiwaygz;dgiwaygz;\??\c:\windows\system32\drivers\dgiwaygz.sys –> c:\windows\system32\drivers\dgiwaygz.sys [?] S1 dpklhojc;dpklhojc; [x] S1 dqrjvwmb;dqrjvwmb; [x] S1 dtvosiup;dtvosiup; [x] S1 dxtvwvzj;dxtvwvzj; [x] S1 dytummzo;dytummzo; [x] S1 elkepwdp;elkepwdp; [x] S1 ercvgjfs;ercvgjfs; [x] S1 erggucgs;erggucgs; [x] S1 ewduyewf;ewduyewf;\??\c:\windows\system32\drivers\ewduyewf.sys –> c:\windows\system32\drivers\ewduyewf.sys [?] S1 fdjkedub;fdjkedub; [x] S1 fgnxjzcw;fgnxjzcw; [x] S1 fhmhalia;fhmhalia; [x] S1 fhuvnhze;fhuvnhze; [x] S1 fnjvhizd;fnjvhizd; [x] S1 fvohuhef;fvohuhef; [x] S1 gadimimt;gadimimt;\??\c:\windows\system32\drivers\gadimimt.sys –> c:\windows\system32\drivers\gadimimt.sys [?] S1 gcsimisa;gcsimisa; [x] S1 gezdpnoz;gezdpnoz; [x] S1 gkkbktkp;gkkbktkp; [x] S1 gkmqidbs;gkmqidbs; [x] S1 gpgqpdkt;gpgqpdkt; [x] S1 gwuyqhdh;gwuyqhdh; [x] S1 hmhkpgds;hmhkpgds;\??\c:\windows\system32\drivers\hmhkpgds.sys –> c:\windows\system32\drivers\hmhkpgds.sys [?] S1 hngibxtq;hngibxtq; [x] S1 igingmll;igingmll; [x] S1 igiyppps;igiyppps; [x] S1 ikpgtwgk;ikpgtwgk; [x] S1 ipzmszcn;ipzmszcn; [x] S1 ivpuooyc;ivpuooyc; [x] S1 jbifmbwn;jbifmbwn; [x] S1 jjcdjylf;jjcdjylf; [x] S1 jjtrvrpz;jjtrvrpz; [x] S1 jkcckmjt;jkcckmjt; [x] S1 jlhuqzpl;jlhuqzpl; [x] S1 jqhilvdx;jqhilvdx; [x] S1 jwekksmv;jwekksmv;\??\c:\windows\system32\drivers\jwekksmv.sys –> c:\windows\system32\drivers\jwekksmv.sys [?] S1 jxtaskpa;jxtaskpa; [x] S1 knlkvxvl;knlkvxvl; [x] S1 knunempj;knunempj; [x] S1 koerxrjq;koerxrjq; [x] S1 kpmrttwh;kpmrttwh; [x] S1 krnixgga;krnixgga;\??\c:\windows\system32\drivers\krnixgga.sys –> c:\windows\system32\drivers\krnixgga.sys [?] S1 ktwcjxzq;ktwcjxzq; [x] S1 lpboryhg;lpboryhg; [x] S1 mbbaslqr;mbbaslqr;\??\c:\windows\system32\drivers\mbbaslqr.sys –> c:\windows\system32\drivers\mbbaslqr.sys [?] S1 mejgojqk;mejgojqk; [x] S1 mmwsqxun;mmwsqxun; [x] S1 mtmmwaxg;mtmmwaxg; [x] S1 nihhdjyb;nihhdjyb; [x] S1 nikqlczs;nikqlczs; [x] S1 nknveakk;nknveakk; [x] S1 nlxvyvzy;nlxvyvzy; [x] S1 nuroovqh;nuroovqh; [x] S1 nwvpsqwz;nwvpsqwz; [x] S1 nyemfepe;nyemfepe; [x] S1 obtxtedt;obtxtedt; [x] S1 omcjvevw;omcjvevw; [x] S1 oszwline;oszwline;\??\c:\windows\system32\drivers\oszwline.sys –> c:\windows\system32\drivers\oszwline.sys [?] S1 oxguwjnl;oxguwjnl; [x] S1 ozjoqdtr;ozjoqdtr;\??\c:\windows\system32\drivers\ozjoqdtr.sys –> c:\windows\system32\drivers\ozjoqdtr.sys [?] S1 parhjjok;parhjjok; [x] S1 pcdjcqai;pcdjcqai; [x] S1 pmhucauv;pmhucauv; [x] S1 pnfghaqu;pnfghaqu; [x] S1 pxqzxoaf;pxqzxoaf; [x] S1 qglkdfzd;qglkdfzd; [x] S1 qgmeaffg;qgmeaffg; [x] S1 qntmpkln;qntmpkln; [x] S1 qpuellzp;qpuellzp; [x] S1 qqnswemg;qqnswemg;\??\c:\windows\system32\drivers\qqnswemg.sys –> c:\windows\system32\drivers\qqnswemg.sys [?] S1 qtzuaavp;qtzuaavp; [x] S1 qveevalq;qveevalq; [x] S1 qvhghdsz;qvhghdsz; [x] S1 qvwtabgi;qvwtabgi; [x] S1 rabkklnh;rabkklnh; [x] S1 rffedtwp;rffedtwp;\??\c:\windows\system32\drivers\rffedtwp.sys –> c:\windows\system32\drivers\rffedtwp.sys [?] S1 rgwcsvbc;rgwcsvbc; [x] S1 rlgowvyc;rlgowvyc; [x] S1 rqkrnuqa;rqkrnuqa; [x] S1 rsjlervj;rsjlervj; [x] S1 rvcfdjqj;rvcfdjqj; [x] S1 rwmdihkh;rwmdihkh; [x] S1 sibcdjcr;sibcdjcr; [x] S1 sizbolqx;sizbolqx; [x] S1 sjwojwjp;sjwojwjp; [x] S1 spfiirig;spfiirig; [x] S1 sqhugywn;sqhugywn;\??\c:\windows\system32\drivers\sqhugywn.sys –> c:\windows\system32\drivers\sqhugywn.sys [?] S1 svvawmpo;svvawmpo; [x] S1 ubxrryay;ubxrryay;\??\c:\windows\system32\drivers\ubxrryay.sys –> c:\windows\system32\drivers\ubxrryay.sys [?] S1 udmenvkd;udmenvkd; [x] S1 uffcaflz;uffcaflz; [x] S1 ukuqnyaz;ukuqnyaz; [x] S1 uunryqdi;uunryqdi; [x] S1 uvvjowij;uvvjowij; [x] S1 wzghtyid;wzghtyid; [x] S1 xjnujlcb;xjnujlcb; [x] S1 xwwqyqig;xwwqyqig; [x] S1 xxvlyppi;xxvlyppi; [x] S1 yguhgqwr;yguhgqwr; [x] S1 yhmehhav;yhmehhav; [x] S1 ypbzyzdj;ypbzyzdj; [x] S1 ypeazctt;ypeazctt;\??\c:\windows\system32\drivers\ypeazctt.sys –> c:\windows\system32\drivers\ypeazctt.sys [?] S1 zaddknpv;zaddknpv; [x] S1 zegnzugc;zegnzugc; [x] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [3/29/2012 8:51 AM 253088] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys –> c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [?] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys –> c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [?] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys –> c:\windows\system32\DRIVERS\AVGIDSShim.Sys [?] S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/9/2004 11:00 PM 14336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WINRM REG_MULTI_SZ WINRM . Contents of the 'Scheduled Tasks' folder . 2012-04-26 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 03:33] . 2012-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-04-25 c:\windows\Tasks\ASC5_AutoUpdate.job - c:\program files\IObit\Advanced SystemCare 5\AutoUpdate.exe [2012-04-12 00:13] . 2012-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-04-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-04-27 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 20:39] . 2012-04-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . 2012-04-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . . ——- Supplementary Scan ——- . uStart Page = hxxp://isearch.avg.com/?cid={65B9B557-A7F9-4314-B42F-C7920C264324}∣=⟨=&ds;=≺=&d;=&v;=&sap;=hp uDefault_Search_URL = hxxp://www.google.com/ie mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.30.1 192.168.2.1 FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;= FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B7c26ee5d-fee5-4534-9787-aa5d4185038d%7D∣=05fad2627b16a0be019094f985765214-2d26666d54754f6641b8f9c40321cfff7167cd4b&ds;=AVG&v;=10.2.0.3⟨=en≺=fr&d;=2012-04-10%2023%3A24%3A21&sap;=ku&q;= FF - user.js: yahoo.homepage.dontask - true . - - - - ORPHANS REMOVED - - - - . Notify-TPSvc - TPSvc.dll . . . ************************************************************************** . disk not found C:\ . please note that you need administrator rights to perform deep scan scanning hidden processes … . scanning hidden autostart entries … . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . Completion time: 2012-04-26 20:51:31 ComboFix-quarantined-files.txt 2012-04-27 01:51 . Pre-Run: 191,921,184,768 bytes free Post-Run: 192,318,701,568 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect . - - End Of File - - 97FCD91847F1D5D58E1A6E1074EB9AB4
Post #8
Hi

I recommend that you uninstall IObit. It is has been proved to be untrustworthy in its programming and is pretty ineffective now that it can no longer be propped up by MBAM

See:

http://forums.malwarebytes.org/index.php?showtopic=29681
http://forums.malwarebytes.org/index.php?showtopic=30989
http://forums.malwarebytes.org/index.php?showtopic=33217

====================================================

Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
File::
c:\windows\system32\drivers\avyaqluc.sys
c:\windows\system32\drivers\bfdjccpn.sys
c:\windows\system32\drivers\dgiwaygz.sys
c:\windows\system32\drivers\ewduyewf.sys
c:\windows\system32\drivers\gadimimt.sys
c:\windows\system32\drivers\hmhkpgds.sys
c:\windows\system32\drivers\jwekksmv.sys
c:\windows\system32\drivers\krnixgga.sys
c:\windows\system32\drivers\mbbaslqr.sys
c:\windows\system32\drivers\oszwline.sys
c:\windows\system32\drivers\ozjoqdtr.sys
c:\windows\system32\drivers\qqnswemg.sys
c:\windows\system32\drivers\rffedtwp.sys
c:\windows\system32\drivers\sqhugywn.sys
c:\windows\system32\drivers\ubxrryay.sys
c:\windows\system32\drivers\ypeazctt.sys

Driver::
aaxaihys
amxazyeh
anwohydi
asgmiduu
avyaqluc
awahhqqq
awrdgphz
aysyxjdp
bdciuwvi
bfdjccpn
fxnqval
bjbkldmx
bmynadok
bosfzspu
cjjjziiu
cleuueai
clxyljbj
cnyhgcng
cqvbmrgn
cstwxgbv
dapxhzmr
dcflsldg
dgiwaygz
dpklhojc
dqrjvwmb
dtvosiup
dxtvwvzj
dytummzo
elkepwdp
ercvgjfs
erggucgs
ewduyewf
fdjkedub
fgnxjzcw
fhmhalia
fhuvnhze
fnjvhizd
fvohuhef
gadimimt
gcsimisa
gezdpnoz
gkkbktkp
gkmqidbs
gpgqpdkt
gwuyqhdh
hmhkpgds
hngibxtq
igingmll
igiyppps
ikpgtwgk
ipzmszcn
ivpuooyc
jbifmbwn
jjcdjylf
jjtrvrpz
jkcckmjt
jlhuqzpl
jqhilvdx
jwekksmv
jxtaskpa
knlkvxvl
knunempj
koerxrjq
kpmrttwh
krnixgga
ktwcjxzq
lpboryhg
mbbaslqr
mejgojqk
mmwsqxun
mtmmwaxg
nihhdjyb
nikqlczs
nknveakk
nlxvyvzy
nuroovqh
nwvpsqwz
nyemfepe
obtxtedt
omcjvevw
oszwline
oxguwjnl
ozjoqdtr
parhjjok
pcdjcqai
pmhucauv
pnfghaqu
pxqzxoaf
qglkdfzd
qgmeaffg
qntmpkln
qpuellzp
qqnswemg
qtzuaavp
qveevalq
qvhghdsz
qvwtabgi
rabkklnh
rffedtwp
rgwcsvbc
rlgowvyc
rqkrnuqa
rsjlervj
rvcfdjqj
rwmdihkh
sibcdjcr
sizbolqx
sjwojwjp
spfiirig
sqhugywn 
svvawmpo
ubxrryay
udmenvkd
uffcaflz
ukuqnyaz
uunryqdi
uvvjowij
wzghtyid
xjnujlcb
xwwqyqig
xxvlyppi
yguhgqwr
yhmehhav
ypbzyzdj
ypeazctt
zaddknpv
zegnzugc

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

====================================================

Run Security Check

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Logs to include in the next post:

ComboFix.txt
Checkup.txt

Satchfan
Post #9
Satchfan, 1st: Thank you for the advise regarding the removal of IObit. I had recently purchased this trying to rid my system of the Trojan and am still within the 30-day money-back trial. IObit has been removed from my system and I have requested a refund 2nd: If I am understanding correctly, the 2nd step is to copy the code you provided, save it as a notepad file, and drag the file into ComboFix.exe. I can not find CombFix.exe on my system, having checked both from 'All Programs' and the 'Software Add/Removal tool on the Control Panel. However, when I do a 'Search' the file appears but I have only been able to create a shortcut to my desktop - can not figure out where to access the actual program on my computer so I can drag the 'Code' notepad file to it. When I tried to work with ComboFix.exe from the desktop shortcut, it 1st said it found a 'root' problem and had to shut down and reopen. It then ran and gave me the following report. (Firewall and Microsoft Security Essentials had been disabled before trying to work with ComboFix.exe. Please give me instructions as to how to access ComboFix.exc - or if I am ready to go to the 3rd step on your last post. Thank-you and following are the notes from ComboFix.exe auto run: ComboFix 12-04-26.01 - HP_Administrator 04/27/2012 11:09:13.3.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1547 [GMT -5:00] Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\HP_Administrator\Local Settings\Application Data\{4CDAB3A2-8C08-41FA-96F7-A672D44C3359} c:\documents and settings\HP_Administrator\Local Settings\Application Data\{4CDAB3A2-8C08-41FA-96F7-A672D44C3359}\chrome.manifest c:\documents and settings\HP_Administrator\Local Settings\Application Data\{4CDAB3A2-8C08-41FA-96F7-A672D44C3359}\chrome\content\overlay.xul c:\documents and settings\HP_Administrator\Local Settings\Application Data\{4CDAB3A2-8C08-41FA-96F7-A672D44C3359}\install.rdf . . ((((((((((((((((((((((((( Files Created from 2012-03-27 to 2012-04-27 ))))))))))))))))))))))))))))))) . . 2012-04-27 07:44 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B43D7006-E902-465A-8FBF-0054830A49A0}\mpengine.dll 2012-04-25 22:12 . 2012-04-25 22:12 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\SpeedyPC Software 2012-04-25 22:12 . 2012-04-26 03:47 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedyPC Software 2012-04-24 18:37 . 2012-04-24 18:37 ——– d—–w- c:\program files\AVG Secure Search 2012-04-14 01:27 . 2012-04-14 01:27 ——– d—–w- c:\windows\system32\winrm 2012-04-14 01:26 . 2012-04-14 01:27 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$ 2012-04-13 02:27 . 2007-03-09 16:25 2321288 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2012-04-13 02:27 . 2012-03-20 08:53 6582328 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{0C4B3F48-B6DE-4DDD-86C7-36D37B866EB2}\mpengine.dll 2012-04-12 15:58 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-04-12 05:54 . 2012-04-12 05:54 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\IObit 2012-04-12 05:19 . 2012-04-12 05:19 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit 2012-04-12 05:18 . 2012-04-13 13:45 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\IObit 2012-04-12 05:18 . 2012-04-12 05:18 ——– d—–w- c:\program files\IObit 2012-04-11 06:36 . 2012-04-11 06:37 ——– d—–w- c:\program files\Microsoft Security Client 2012-04-11 06:33 . 2012-04-11 06:33 ——– d—–w- c:\program files\Windows Defender 2012-04-11 04:25 . 2012-04-11 04:25 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\AVG2012 2012-04-11 04:24 . 2012-04-11 04:24 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Secure Search 2012-04-11 04:02 . 2012-04-11 04:02 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\PCHealth 2012-04-10 05:09 . 2012-04-11 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools 2012-04-09 06:52 . 2012-01-19 15:22 42864 —-a-r- c:\windows\system32\SBBD.EXE 2012-04-09 06:52 . 2012-01-12 14:26 101112 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-04-08 06:27 . 2012-04-27 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software 2012-04-08 06:27 . 2012-04-12 05:40 ——– d—–w- c:\program files\AVAST Software 2012-04-08 06:07 . 2012-04-08 06:07 11776 —-a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2012-04-08 06:06 . 2012-04-08 06:06 ——– d—–w- c:\program files\Common Files\xing shared 2012-04-08 06:06 . 2012-04-08 06:06 150696 —-a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2012-04-08 06:05 . 2012-04-08 06:05 108544 —-a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2012-04-06 19:46 . 2012-04-06 19:46 ——– d—–w- c:\windows\system32\wbem\Repository 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll 2012-03-29 13:51 . 2012-04-16 03:33 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-16 03:33 . 2011-05-14 17:50 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-08 06:05 . 2003-03-19 10:14 499712 —-a-w- c:\windows\system32\msvcp71.dll 2012-04-08 06:05 . 2003-02-21 18:42 348160 —-a-w- c:\windows\system32\msvcr71.dll 2012-04-04 20:56 . 2010-10-02 02:39 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-11 18:48 . 2012-03-11 18:48 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2012-03-05 19:15 . 2012-03-05 19:15 73728 —-a-w- c:\windows\system32\javacpl.cpl 2012-03-05 19:15 . 2010-05-20 17:14 472808 —-a-w- c:\windows\system32\deployJava1.dll 2012-03-01 11:01 . 2004-08-10 04:00 916992 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 11:01 . 2004-08-10 04:00 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01 . 2004-08-10 04:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10 . 2004-08-10 11:00 148480 ——w- c:\windows\system32\imagehlp.dll 2012-02-29 14:10 . 2004-08-10 04:00 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 12:17 . 2004-08-10 04:00 385024 —-a-w- c:\windows\system32\html.iec 2012-02-23 15:18 . 2011-09-15 23:15 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-02-03 09:22 . 2004-08-10 04:00 1860096 —-a-w- c:\windows\system32\win32k.sys 2012-03-13 04:39 . 2011-03-26 19:59 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-04-27_01.50.10 ))))))))))))))))))))))))))))))))))))))))) . + 2012-04-27 16:17 . 2012-04-27 16:17 16384 c:\windows\Temp\Perflib_Perfdata_f28.dat + 2012-04-27 16:07 . 2012-04-27 16:07 16384 c:\windows\Temp\Perflib_Perfdata_7f8.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-07 39408] "Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-04-29 1652736] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584] "RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616] "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312] "DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] . c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2004-4-13 299008] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Kodak EasyShare software.lnk - c:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2002-9-16 299008] KODAK Software Updater.lnk - c:\program files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-3-13 16384] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-8-15 36903] VersionTracker Pro.lnk - c:\windows\Installer\{78C5D256-A94E-4593-BB24-CED07AFC7938}\New_Shortcut_S1699_A8EB5A2133B04A97AEEFDFB17E2E701D.exe [2007-7-19 53248] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] . c:\documents and settings\Default User\Start Menu\Programs\Startup\ Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-8-15 27136] PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-15 27136] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [3/11/2012 1:48 PM 56208] R1 RapportCerberus_34302;RapportCerberus_34302;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys [12/15/2011 12:12 PM 228208] R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [3/11/2012 1:48 PM 71440] R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [3/11/2012 1:48 PM 164112] R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [3/11/2012 1:48 PM 931640] S1 aaxaihys;aaxaihys; [x] S1 amxazyeh;amxazyeh; [x] S1 anwohydi;anwohydi; [x] S1 asgmiduu;asgmiduu; [x] S1 avyaqluc;avyaqluc;\??\c:\windows\system32\drivers\avyaqluc.sys –> c:\windows\system32\drivers\avyaqluc.sys [?] S1 awahhqqq;awahhqqq; [x] S1 awrdgphz;awrdgphz; [x] S1 aysyxjdp;aysyxjdp; [x] S1 bdciuwvi;bdciuwvi; [x] S1 bfdjccpn;bfdjccpn;\??\c:\windows\system32\drivers\bfdjccpn.sys –> c:\windows\system32\drivers\bfdjccpn.sys [?] S1 bfxnqval;bfxnqval; [x] S1 bjbkldmx;bjbkldmx; [x] S1 bmynadok;bmynadok; [x] S1 bosfzspu;bosfzspu; [x] S1 cjjjziiu;cjjjziiu; [x] S1 cleuueai;cleuueai; [x] S1 clxyljbj;clxyljbj; [x] S1 cnyhgcng;cnyhgcng; [x] S1 cqvbmrgn;cqvbmrgn; [x] S1 cstwxgbv;cstwxgbv; [x] S1 dapxhzmr;dapxhzmr; [x] S1 dcflsldg;dcflsldg; [x] S1 dgiwaygz;dgiwaygz;\??\c:\windows\system32\drivers\dgiwaygz.sys –> c:\windows\system32\drivers\dgiwaygz.sys [?] S1 dpklhojc;dpklhojc; [x] S1 dqrjvwmb;dqrjvwmb; [x] S1 dtvosiup;dtvosiup; [x] S1 dxtvwvzj;dxtvwvzj; [x] S1 dytummzo;dytummzo; [x] S1 elkepwdp;elkepwdp; [x] S1 ercvgjfs;ercvgjfs; [x] S1 erggucgs;erggucgs; [x] S1 ewduyewf;ewduyewf;\??\c:\windows\system32\drivers\ewduyewf.sys –> c:\windows\system32\drivers\ewduyewf.sys [?] S1 fdjkedub;fdjkedub; [x] S1 fgnxjzcw;fgnxjzcw; [x] S1 fhmhalia;fhmhalia; [x] S1 fhuvnhze;fhuvnhze; [x] S1 fnjvhizd;fnjvhizd; [x] S1 fvohuhef;fvohuhef; [x] S1 gadimimt;gadimimt;\??\c:\windows\system32\drivers\gadimimt.sys –> c:\windows\system32\drivers\gadimimt.sys [?] S1 gcsimisa;gcsimisa; [x] S1 gezdpnoz;gezdpnoz; [x] S1 gkkbktkp;gkkbktkp; [x] S1 gkmqidbs;gkmqidbs; [x] S1 gpgqpdkt;gpgqpdkt; [x] S1 gwuyqhdh;gwuyqhdh; [x] S1 hmhkpgds;hmhkpgds;\??\c:\windows\system32\drivers\hmhkpgds.sys –> c:\windows\system32\drivers\hmhkpgds.sys [?] S1 hngibxtq;hngibxtq; [x] S1 igingmll;igingmll; [x] S1 igiyppps;igiyppps; [x] S1 ikpgtwgk;ikpgtwgk; [x] S1 ipzmszcn;ipzmszcn; [x] S1 ivpuooyc;ivpuooyc; [x] S1 jbifmbwn;jbifmbwn; [x] S1 jjcdjylf;jjcdjylf; [x] S1 jjtrvrpz;jjtrvrpz; [x] S1 jkcckmjt;jkcckmjt; [x] S1 jlhuqzpl;jlhuqzpl; [x] S1 jqhilvdx;jqhilvdx; [x] S1 jwekksmv;jwekksmv;\??\c:\windows\system32\drivers\jwekksmv.sys –> c:\windows\system32\drivers\jwekksmv.sys [?] S1 jxtaskpa;jxtaskpa; [x] S1 knlkvxvl;knlkvxvl; [x] S1 knunempj;knunempj; [x] S1 koerxrjq;koerxrjq; [x] S1 kpmrttwh;kpmrttwh; [x] S1 krnixgga;krnixgga;\??\c:\windows\system32\drivers\krnixgga.sys –> c:\windows\system32\drivers\krnixgga.sys [?] S1 ktwcjxzq;ktwcjxzq; [x] S1 lpboryhg;lpboryhg; [x] S1 mbbaslqr;mbbaslqr;\??\c:\windows\system32\drivers\mbbaslqr.sys –> c:\windows\system32\drivers\mbbaslqr.sys [?] S1 mejgojqk;mejgojqk; [x] S1 mmwsqxun;mmwsqxun; [x] S1 mtmmwaxg;mtmmwaxg; [x] S1 nihhdjyb;nihhdjyb; [x] S1 nikqlczs;nikqlczs; [x] S1 nknveakk;nknveakk; [x] S1 nlxvyvzy;nlxvyvzy; [x] S1 nuroovqh;nuroovqh; [x] S1 nwvpsqwz;nwvpsqwz; [x] S1 nyemfepe;nyemfepe; [x] S1 obtxtedt;obtxtedt; [x] S1 omcjvevw;omcjvevw; [x] S1 oszwline;oszwline;\??\c:\windows\system32\drivers\oszwline.sys –> c:\windows\system32\drivers\oszwline.sys [?] S1 oxguwjnl;oxguwjnl; [x] S1 ozjoqdtr;ozjoqdtr;\??\c:\windows\system32\drivers\ozjoqdtr.sys –> c:\windows\system32\drivers\ozjoqdtr.sys [?] S1 parhjjok;parhjjok; [x] S1 pcdjcqai;pcdjcqai; [x] S1 pmhucauv;pmhucauv; [x] S1 pnfghaqu;pnfghaqu; [x] S1 pxqzxoaf;pxqzxoaf; [x] S1 qglkdfzd;qglkdfzd; [x] S1 qgmeaffg;qgmeaffg; [x] S1 qntmpkln;qntmpkln; [x] S1 qpuellzp;qpuellzp; [x] S1 qqnswemg;qqnswemg;\??\c:\windows\system32\drivers\qqnswemg.sys –> c:\windows\system32\drivers\qqnswemg.sys [?] S1 qtzuaavp;qtzuaavp; [x] S1 qveevalq;qveevalq; [x] S1 qvhghdsz;qvhghdsz; [x] S1 qvwtabgi;qvwtabgi; [x] S1 rabkklnh;rabkklnh; [x] S1 rffedtwp;rffedtwp;\??\c:\windows\system32\drivers\rffedtwp.sys –> c:\windows\system32\drivers\rffedtwp.sys [?] S1 rgwcsvbc;rgwcsvbc; [x] S1 rlgowvyc;rlgowvyc; [x] S1 rqkrnuqa;rqkrnuqa; [x] S1 rsjlervj;rsjlervj; [x] S1 rvcfdjqj;rvcfdjqj; [x] S1 rwmdihkh;rwmdihkh; [x] S1 sibcdjcr;sibcdjcr; [x] S1 sizbolqx;sizbolqx; [x] S1 sjwojwjp;sjwojwjp; [x] S1 spfiirig;spfiirig; [x] S1 sqhugywn;sqhugywn;\??\c:\windows\system32\drivers\sqhugywn.sys –> c:\windows\system32\drivers\sqhugywn.sys [?] S1 svvawmpo;svvawmpo; [x] S1 ubxrryay;ubxrryay;\??\c:\windows\system32\drivers\ubxrryay.sys –> c:\windows\system32\drivers\ubxrryay.sys [?] S1 udmenvkd;udmenvkd; [x] S1 uffcaflz;uffcaflz; [x] S1 ukuqnyaz;ukuqnyaz; [x] S1 uunryqdi;uunryqdi; [x] S1 uvvjowij;uvvjowij; [x] S1 wzghtyid;wzghtyid; [x] S1 xjnujlcb;xjnujlcb; [x] S1 xwwqyqig;xwwqyqig; [x] S1 xxvlyppi;xxvlyppi; [x] S1 yguhgqwr;yguhgqwr; [x] S1 yhmehhav;yhmehhav; [x] S1 ypbzyzdj;ypbzyzdj; [x] S1 ypeazctt;ypeazctt;\??\c:\windows\system32\drivers\ypeazctt.sys –> c:\windows\system32\drivers\ypeazctt.sys [?] S1 zaddknpv;zaddknpv; [x] S1 zegnzugc;zegnzugc; [x] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [3/29/2012 8:51 AM 253088] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys –> c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [?] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys –> c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [?] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys –> c:\windows\system32\DRIVERS\AVGIDSShim.Sys [?] S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/9/2004 11:00 PM 14336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WINRM REG_MULTI_SZ WINRM . Contents of the 'Scheduled Tasks' folder . 2012-04-27 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 03:33] . 2012-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-04-27 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 20:39] . 2012-04-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . 2012-04-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . . ——- Supplementary Scan ——- . uStart Page = hxxp://isearch.avg.com/?cid={65B9B557-A7F9-4314-B42F-C7920C264324}∣=⟨=&ds;=≺=&d;=&v;=&sap;=hp uDefault_Search_URL = hxxp://www.google.com/ie mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.30.1 192.168.2.1 FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;= FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B7c26ee5d-fee5-4534-9787-aa5d4185038d%7D∣=05fad2627b16a0be019094f985765214-2d26666d54754f6641b8f9c40321cfff7167cd4b&ds;=AVG&v;=10.2.0.3⟨=en≺=fr&d;=2012-04-10%2023%3A24%3A21&sap;=ku&q;= FF - user.js: yahoo.homepage.dontask - true . . ************************************************************************** . disk not found C:\ . please note that you need administrator rights to perform deep scan scanning hidden processes … . scanning hidden autostart entries … . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . Completion time: 2012-04-27 11:19:04 ComboFix-quarantined-files.txt 2012-04-27 16:19 ComboFix2.txt 2012-04-27 15:21 ComboFix3.txt 2012-04-27 01:51 . Pre-Run: 192,310,849,536 bytes free Post-Run: 192,306,704,384 bytes free . - - End Of File - - 5A62F83E70EB039F7A106F45EA6D2488
Post #10
My apologies, I should have noticed: ComboFix was not saved to your desktop and is in your "Downloads" folder which is why you can't find it. The "fix" won't work from this location. It is probably easier if you download ComboFix again and this time save it directly to your desktop. When it asks where to save it choose "Desktop" then run it normally and send a new log so that I can see that it is in the correct location. I was about to leave for a while so if you are having difficulty understanding these instructions, please tell me and I'll explain with more detail later. Thanks for your patience Satchfan
Post #11
Satchfan, I seem to having a problem getting ComboFix to save to my system file. When I click on the link you earlier provided, I am asked if I want to 'Save' the file - I answer 'yes' however I am given no choice as to where I want the file saved. The file then downloads. When I click on the file I am only given the option to 'Run', not to save to my system. (FYI- The Firewall and Microsoft Security Essentials were disabled before I started the download.) In addition, MS has sent me two notices that 'Updates are Ready to Install on My System'. Should I ignore these notices for now (until we are finished with infection removal) or allow the computer to install them at this time. Thank you, A.J.K.M.
Post #12

MS has sent me two notices that 'Updates are ready to Install on My System'. Should I ignore these notices for now (until we are finished with infection removal) or allow the computer to install them at this time.

Ignore it until we are finished.


From your user account Downloads folder, move ComboFix to your desktop - right click on it, select Cut, right click the desktop and select Paste.

Let me know if that is successful.

Satchfan
Post #13
Satchfan:

I think I got the programs downloaded and run properly Here are the results:

1stTEST:

ComboFix 12-04-27.02 - HP_Administrator 04/28/2012 14:55:17.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1549 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\windows\system32\drivers\avyaqluc.sys"
"c:\windows\system32\drivers\bfdjccpn.sys"
"c:\windows\system32\drivers\dgiwaygz.sys"
"c:\windows\system32\drivers\ewduyewf.sys"
"c:\windows\system32\drivers\gadimimt.sys"
"c:\windows\system32\drivers\hmhkpgds.sys"
"c:\windows\system32\drivers\jwekksmv.sys"
"c:\windows\system32\drivers\krnixgga.sys"
"c:\windows\system32\drivers\mbbaslqr.sys"
"c:\windows\system32\drivers\oszwline.sys"
"c:\windows\system32\drivers\ozjoqdtr.sys"
"c:\windows\system32\drivers\qqnswemg.sys"
"c:\windows\system32\drivers\rffedtwp.sys"
"c:\windows\system32\drivers\sqhugywn.sys"
"c:\windows\system32\drivers\ubxrryay.sys"
"c:\windows\system32\drivers\ypeazctt.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_aaxaihys
——-\Service_amxazyeh
——-\Service_anwohydi
——-\Service_asgmiduu
——-\Service_avyaqluc
——-\Service_awahhqqq
——-\Service_awrdgphz
——-\Service_aysyxjdp
——-\Service_bdciuwvi
——-\Service_bfdjccpn
——-\Service_bjbkldmx
——-\Service_bmynadok
——-\Service_bosfzspu
——-\Service_cjjjziiu
——-\Service_cleuueai
——-\Service_clxyljbj
——-\Service_cnyhgcng
——-\Service_cqvbmrgn
——-\Service_cstwxgbv
——-\Service_dapxhzmr
——-\Service_dcflsldg
——-\Service_dgiwaygz
——-\Service_dpklhojc
——-\Service_dqrjvwmb
——-\Service_dtvosiup
——-\Service_dxtvwvzj
——-\Service_dytummzo
——-\Service_elkepwdp
——-\Service_ercvgjfs
——-\Service_erggucgs
——-\Service_ewduyewf
——-\Service_fdjkedub
——-\Service_fgnxjzcw
——-\Service_fhmhalia
——-\Service_fhuvnhze
——-\Service_fnjvhizd
——-\Service_fvohuhef
——-\Service_gadimimt
——-\Service_gcsimisa
——-\Service_gezdpnoz
——-\Service_gkkbktkp
——-\Service_gkmqidbs
——-\Service_gpgqpdkt
——-\Service_gwuyqhdh
——-\Service_hmhkpgds
——-\Service_hngibxtq
——-\Service_igingmll
——-\Service_igiyppps
——-\Service_ikpgtwgk
——-\Service_ipzmszcn
——-\Service_ivpuooyc
——-\Service_jbifmbwn
——-\Service_jjcdjylf
——-\Service_jjtrvrpz
——-\Service_jkcckmjt
——-\Service_jlhuqzpl
——-\Service_jqhilvdx
——-\Service_jwekksmv
——-\Service_jxtaskpa
——-\Service_knlkvxvl
——-\Service_knunempj
——-\Service_koerxrjq
——-\Service_kpmrttwh
——-\Service_krnixgga
——-\Service_ktwcjxzq
——-\Service_lpboryhg
——-\Service_mbbaslqr
——-\Service_mejgojqk
——-\Service_mmwsqxun
——-\Service_mtmmwaxg
——-\Service_nihhdjyb
——-\Service_nikqlczs
——-\Service_nknveakk
——-\Service_nlxvyvzy
——-\Service_nuroovqh
——-\Service_nwvpsqwz
——-\Service_nyemfepe
——-\Service_obtxtedt
——-\Service_omcjvevw
——-\Service_oszwline
——-\Service_oxguwjnl
——-\Service_ozjoqdtr
——-\Service_parhjjok
——-\Service_pcdjcqai
——-\Service_pmhucauv
——-\Service_pnfghaqu
——-\Service_pxqzxoaf
——-\Service_qglkdfzd
——-\Service_qgmeaffg
——-\Service_qntmpkln
——-\Service_qpuellzp
——-\Service_qqnswemg
——-\Service_qtzuaavp
——-\Service_qveevalq
——-\Service_qvhghdsz
——-\Service_qvwtabgi
——-\Service_rabkklnh
——-\Service_rffedtwp
——-\Service_rgwcsvbc
——-\Service_rlgowvyc
——-\Service_rqkrnuqa
——-\Service_rsjlervj
——-\Service_rvcfdjqj
——-\Service_rwmdihkh
——-\Service_sibcdjcr
——-\Service_sizbolqx
——-\Service_sjwojwjp
——-\Service_spfiirig
——-\Service_sqhugywn
——-\Service_svvawmpo
——-\Service_ubxrryay
——-\Service_udmenvkd
——-\Service_uffcaflz
——-\Service_ukuqnyaz
——-\Service_uunryqdi
——-\Service_uvvjowij
——-\Service_wzghtyid
——-\Service_xjnujlcb
——-\Service_xwwqyqig
——-\Service_xxvlyppi
——-\Service_yguhgqwr
——-\Service_yhmehhav
——-\Service_ypbzyzdj
——-\Service_ypeazctt
——-\Service_zaddknpv
——-\Service_zegnzugc
.
.
((((((((((((((((((((((((( Files Created from 2012-03-28 to 2012-04-28 )))))))))))))))))))))))))))))))
.
.
2012-04-27 21:12 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9CA8DABC-53E4-4DC1-B27A-AAACB914FB16}\mpengine.dll
2012-04-27 17:17 . 2012-04-27 17:17 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-04-27 17:17 . 2012-04-27 17:17 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-27 17:17 . 2012-04-27 17:17 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-04-25 22:12 . 2012-04-25 22:12 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\SpeedyPC Software
2012-04-25 22:12 . 2012-04-26 03:47 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedyPC Software
2012-04-24 18:37 . 2012-04-24 18:37 ——– d—–w- c:\program files\AVG Secure Search
2012-04-14 01:27 . 2012-04-14 01:27 ——– d—–w- c:\windows\system32\winrm
2012-04-14 01:26 . 2012-04-14 01:27 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$
2012-04-13 02:27 . 2007-03-09 16:25 2321288 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2012-04-13 02:27 . 2012-03-20 08:53 6582328 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{0C4B3F48-B6DE-4DDD-86C7-36D37B866EB2}\mpengine.dll
2012-04-12 15:58 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-04-12 05:54 . 2012-04-12 05:54 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\IObit
2012-04-12 05:19 . 2012-04-12 05:19 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit
2012-04-12 05:18 . 2012-04-13 13:45 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\IObit
2012-04-12 05:18 . 2012-04-12 05:18 ——– d—–w- c:\program files\IObit
2012-04-11 06:36 . 2012-04-27 21:12 ——– d—–w- c:\program files\Microsoft Security Client
2012-04-11 06:33 . 2012-04-11 06:33 ——– d—–w- c:\program files\Windows Defender
2012-04-11 04:25 . 2012-04-11 04:25 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\AVG2012
2012-04-11 04:24 . 2012-04-11 04:24 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Secure Search
2012-04-11 04:02 . 2012-04-11 04:02 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\PCHealth
2012-04-10 05:09 . 2012-04-11 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2012-04-09 06:52 . 2012-01-19 15:22 42864 —-a-r- c:\windows\system32\SBBD.EXE
2012-04-09 06:52 . 2012-01-12 14:26 101112 —-a-r- c:\windows\system32\drivers\SBREDrv.sys
2012-04-08 06:27 . 2012-04-27 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software
2012-04-08 06:27 . 2012-04-12 05:40 ——– d—–w- c:\program files\AVAST Software
2012-04-08 06:07 . 2012-04-08 06:07 11776 —-a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll
2012-04-08 06:06 . 2012-04-08 06:06 ——– d—–w- c:\program files\Common Files\xing shared
2012-04-08 06:06 . 2012-04-08 06:06 150696 —-a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2012-04-08 06:05 . 2012-04-08 06:05 108544 —-a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll
2012-04-06 19:46 . 2012-04-06 19:46 ——– d—–w- c:\windows\system32\wbem\Repository
2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-16 03:33 . 2012-03-29 13:51 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-16 03:33 . 2011-05-14 17:50 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-08 06:05 . 2003-03-19 10:14 499712 —-a-w- c:\windows\system32\msvcp71.dll
2012-04-08 06:05 . 2003-02-21 18:42 348160 —-a-w- c:\windows\system32\msvcr71.dll
2012-04-04 20:56 . 2010-10-02 02:39 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-03-21 01:44 . 2011-04-18 18:18 171064 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-03-11 18:48 . 2012-03-11 18:48 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
2012-03-05 19:15 . 2012-03-05 19:15 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-03-05 19:15 . 2010-05-20 17:14 472808 —-a-w- c:\windows\system32\deployJava1.dll
2012-03-01 11:01 . 2004-08-10 04:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2004-08-10 04:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-03-01 11:01 . 2004-08-10 04:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-02-29 14:10 . 2004-08-10 11:00 148480 ——w- c:\windows\system32\imagehlp.dll
2012-02-29 14:10 . 2004-08-10 04:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 12:17 . 2004-08-10 04:00 385024 —-a-w- c:\windows\system32\html.iec
2012-02-23 15:18 . 2011-09-15 23:15 237072 ——w- c:\windows\system32\MpSigStub.exe
2012-02-03 09:22 . 2004-08-10 04:00 1860096 —-a-w- c:\windows\system32\win32k.sys
2012-04-27 17:17 . 2011-03-26 19:59 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-27_01.50.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-28 20:03 . 2012-04-28 20:03 16384 c:\windows\Temp\Perflib_Perfdata_7a4.dat
+ 2012-04-28 20:05 . 2012-04-28 20:05 16384 c:\windows\Temp\Perflib_Perfdata_778.dat
+ 2012-04-27 21:11 . 2012-04-27 21:11 301056 c:\windows\Installer\11774db.msi
+ 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\SCEP.exe
+ 2012-04-27 21:12 . 2012-04-27 21:12 123352 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\MSE.exe
+ 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\INTUNE.exe
+ 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\FEP.exe
+ 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\EPP.exe
+ 2012-04-27 21:12 . 2012-04-27 21:12 1826304 c:\windows\Installer\117750a.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-07 39408]
"Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-04-29 1652736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2004-4-13 299008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2002-9-16 299008]
KODAK Software Updater.lnk - c:\program files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-3-13 16384]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-8-15 36903]
VersionTracker Pro.lnk - c:\windows\Installer\{78C5D256-A94E-4593-BB24-CED07AFC7938}\New_Shortcut_S1699_A8EB5A2133B04A97AEEFDFB17E2E701D.exe [2007-7-19 53248]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-8-15 27136]
PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-15 27136]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [3/11/2012 1:48 PM 56208]
R1 RapportCerberus_34302;RapportCerberus_34302;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys [12/15/2011 12:12 PM 228208]
R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [3/11/2012 1:48 PM 71440]
R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [3/11/2012 1:48 PM 164112]
R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [3/11/2012 1:48 PM 931640]
S1 bfxnqval;bfxnqval; [x]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [3/29/2012 8:51 AM 253088]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys –> c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [?]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys –> c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [?]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys –> c:\windows\system32\DRIVERS\AVGIDSShim.Sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/27/2012 12:17 PM 129976]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/9/2004 11:00 PM 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 03:33]
.
2012-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2012-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59]
.
2012-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59]
.
2012-04-28 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3006399-3236263178-3685853688-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45]
.
2012-04-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3006399-3236263178-3685853688-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://isearch.avg.com/?cid={65B9B557-A7F9-4314-B42F-C7920C264324}∣=⟨=&ds;=≺=&d;=&v;=&sap;=hp
uDefault_Search_URL = hxxp://www.google.com/ie
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.30.1 192.168.2.1
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B7c26ee5d-fee5-4534-9787-aa5d4185038d%7D∣=05fad2627b16a0be019094f985765214-2d26666d54754f6641b8f9c40321cfff7167cd4b&ds;=AVG&v;=10.2.0.3⟨=en≺=fr&d;=2012-04-10%2023%3A24%3A21&sap;=ku&q;=
FF - user.js: yahoo.homepage.dontask - true
.
.
**************************************************************************
.
disk not found C:\
.
please note that you need administrator rights to perform deep scan
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files:
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3496)
c:\windows\system32\WININET.dll
c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dllhost.exe
c:\windows\eHome\ehmsas.exe
c:\windows\RTHDCPL.EXE
.
**************************************************************************
.
Completion time: 2012-04-28 15:10:50 - machine was rebooted
ComboFix-quarantined-files.txt 2012-04-28 20:10
ComboFix2.txt 2012-04-27 16:19
ComboFix3.txt 2012-04-27 15:21
ComboFix4.txt 2012-04-27 01:51
.
Pre-Run: 192,070,983,680 bytes free
Post-Run: 191,963,222,016 bytes free
.
- - End Of File - - 8D0221547BAF0EC58590354302DA9182

2nd TEST:

Results of screen317's Security Check version 0.99.32
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
Microsoft Security Essentials
Antivirus up to date! (On Access scanning disabled!)
```````````````````````````````
Anti-malware/Other Utilities Check:
Windows Defender
Java™ 6 Update 31
Adobe Flash Player 11.2.202.233
Adobe Reader X (10.1.3)
Mozilla Firefox (12.0.)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
``````````End of Log````````````


Thank you, A.J.K.M.
Post #14
Good work :thumbup:

Let's do the "fix" again now.

Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
File::
c:\windows\system32\drivers\avyaqluc.sys
c:\windows\system32\drivers\bfdjccpn.sys
c:\windows\system32\drivers\dgiwaygz.sys
c:\windows\system32\drivers\ewduyewf.sys
c:\windows\system32\drivers\gadimimt.sys
c:\windows\system32\drivers\hmhkpgds.sys
c:\windows\system32\drivers\jwekksmv.sys
c:\windows\system32\drivers\krnixgga.sys
c:\windows\system32\drivers\mbbaslqr.sys
c:\windows\system32\drivers\oszwline.sys
c:\windows\system32\drivers\ozjoqdtr.sys
c:\windows\system32\drivers\qqnswemg.sys
c:\windows\system32\drivers\rffedtwp.sys
c:\windows\system32\drivers\sqhugywn.sys
c:\windows\system32\drivers\ubxrryay.sys
c:\windows\system32\drivers\ypeazctt.sys

Driver::
aaxaihys
amxazyeh
anwohydi
asgmiduu
avyaqluc
awahhqqq
awrdgphz
aysyxjdp
bdciuwvi
bfdjccpn
fxnqval
bjbkldmx
bmynadok
bosfzspu
cjjjziiu
cleuueai
clxyljbj
cnyhgcng
cqvbmrgn
cstwxgbv
dapxhzmr
dcflsldg
dgiwaygz
dpklhojc
dqrjvwmb
dtvosiup
dxtvwvzj
dytummzo
elkepwdp
ercvgjfs
erggucgs
ewduyewf
fdjkedub
fgnxjzcw
fhmhalia
fhuvnhze
fnjvhizd
fvohuhef
gadimimt
gcsimisa
gezdpnoz
gkkbktkp
gkmqidbs
gpgqpdkt
gwuyqhdh
hmhkpgds
hngibxtq
igingmll
igiyppps
ikpgtwgk
ipzmszcn
ivpuooyc
jbifmbwn
jjcdjylf
jjtrvrpz
jkcckmjt
jlhuqzpl
jqhilvdx
jwekksmv
jxtaskpa
knlkvxvl
knunempj
koerxrjq
kpmrttwh
krnixgga
ktwcjxzq
lpboryhg
mbbaslqr
mejgojqk
mmwsqxun
mtmmwaxg
nihhdjyb
nikqlczs
nknveakk
nlxvyvzy
nuroovqh
nwvpsqwz
nyemfepe
obtxtedt
omcjvevw
oszwline
oxguwjnl
ozjoqdtr
parhjjok
pcdjcqai
pmhucauv
pnfghaqu
pxqzxoaf
qglkdfzd
qgmeaffg
qntmpkln
qpuellzp
qqnswemg
qtzuaavp
qveevalq
qvhghdsz
qvwtabgi
rabkklnh
rffedtwp
rgwcsvbc
rlgowvyc
rqkrnuqa
rsjlervj
rvcfdjqj
rwmdihkh
sibcdjcr
sizbolqx
sjwojwjp
spfiirig
sqhugywn 
svvawmpo
ubxrryay
udmenvkd
uffcaflz
ukuqnyaz
uunryqdi
uvvjowij
wzghtyid
xjnujlcb
xwwqyqig
xxvlyppi
yguhgqwr
yhmehhav
ypbzyzdj
ypeazctt
zaddknpv
zegnzugc

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.
Post #15
Satchfan: I re-ran the test per your instructions. FYI: As it has in the past, after Combo.Fix ran for a few moments, a message popped up saying it was detecting 'root.kit activity' and needed to shut-down and restart the computer. LATEST LOG: ComboFix 12-04-27.02 - HP_Administrator 04/28/2012 19:50:37.5.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1549 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . FILE :: "c:\windows\system32\drivers\avyaqluc.sys" "c:\windows\system32\drivers\bfdjccpn.sys" "c:\windows\system32\drivers\dgiwaygz.sys" "c:\windows\system32\drivers\ewduyewf.sys" "c:\windows\system32\drivers\gadimimt.sys" "c:\windows\system32\drivers\hmhkpgds.sys" "c:\windows\system32\drivers\jwekksmv.sys" "c:\windows\system32\drivers\krnixgga.sys" "c:\windows\system32\drivers\mbbaslqr.sys" "c:\windows\system32\drivers\oszwline.sys" "c:\windows\system32\drivers\ozjoqdtr.sys" "c:\windows\system32\drivers\qqnswemg.sys" "c:\windows\system32\drivers\rffedtwp.sys" "c:\windows\system32\drivers\sqhugywn.sys" "c:\windows\system32\drivers\ubxrryay.sys" "c:\windows\system32\drivers\ypeazctt.sys" . . ((((((((((((((((((((((((( Files Created from 2012-03-28 to 2012-04-29 ))))))))))))))))))))))))))))))) . . 2012-04-28 21:58 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C76CA97F-2F90-434D-81AD-3D12F0ECC617}\mpengine.dll 2012-04-27 21:12 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-04-27 17:17 . 2012-04-27 17:17 ——– d—–w- c:\program files\Mozilla Maintenance Service 2012-04-27 17:17 . 2012-04-27 17:17 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe 2012-04-27 17:17 . 2012-04-27 17:17 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe 2012-04-25 22:12 . 2012-04-25 22:12 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\SpeedyPC Software 2012-04-25 22:12 . 2012-04-26 03:47 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedyPC Software 2012-04-24 18:37 . 2012-04-24 18:37 ——– d—–w- c:\program files\AVG Secure Search 2012-04-14 01:27 . 2012-04-14 01:27 ——– d—–w- c:\windows\system32\winrm 2012-04-14 01:26 . 2012-04-14 01:27 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$ 2012-04-13 02:27 . 2007-03-09 16:25 2321288 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2012-04-13 02:27 . 2012-03-20 08:53 6582328 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{0C4B3F48-B6DE-4DDD-86C7-36D37B866EB2}\mpengine.dll 2012-04-12 05:54 . 2012-04-12 05:54 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\IObit 2012-04-12 05:19 . 2012-04-12 05:19 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit 2012-04-12 05:18 . 2012-04-13 13:45 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\IObit 2012-04-12 05:18 . 2012-04-12 05:18 ——– d—–w- c:\program files\IObit 2012-04-11 06:36 . 2012-04-27 21:12 ——– d—–w- c:\program files\Microsoft Security Client 2012-04-11 06:33 . 2012-04-11 06:33 ——– d—–w- c:\program files\Windows Defender 2012-04-11 04:25 . 2012-04-11 04:25 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\AVG2012 2012-04-11 04:24 . 2012-04-11 04:24 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Secure Search 2012-04-11 04:02 . 2012-04-11 04:02 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\PCHealth 2012-04-10 05:09 . 2012-04-11 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools 2012-04-09 06:52 . 2012-01-19 15:22 42864 —-a-r- c:\windows\system32\SBBD.EXE 2012-04-09 06:52 . 2012-01-12 14:26 101112 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-04-08 06:27 . 2012-04-27 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software 2012-04-08 06:27 . 2012-04-12 05:40 ——– d—–w- c:\program files\AVAST Software 2012-04-08 06:07 . 2012-04-08 06:07 11776 —-a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2012-04-08 06:06 . 2012-04-08 06:06 ——– d—–w- c:\program files\Common Files\xing shared 2012-04-08 06:06 . 2012-04-08 06:06 150696 —-a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2012-04-08 06:05 . 2012-04-08 06:05 108544 —-a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2012-04-06 19:46 . 2012-04-06 19:46 ——– d—–w- c:\windows\system32\wbem\Repository 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-16 03:33 . 2012-03-29 13:51 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-04-16 03:33 . 2011-05-14 17:50 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-08 06:05 . 2003-03-19 10:14 499712 —-a-w- c:\windows\system32\msvcp71.dll 2012-04-08 06:05 . 2003-02-21 18:42 348160 —-a-w- c:\windows\system32\msvcr71.dll 2012-04-04 20:56 . 2010-10-02 02:39 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-21 01:44 . 2011-04-18 18:18 171064 —-a-w- c:\windows\system32\drivers\MpFilter.sys 2012-03-11 18:48 . 2012-03-11 18:48 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2012-03-05 19:15 . 2012-03-05 19:15 73728 —-a-w- c:\windows\system32\javacpl.cpl 2012-03-05 19:15 . 2010-05-20 17:14 472808 —-a-w- c:\windows\system32\deployJava1.dll 2012-03-01 11:01 . 2004-08-10 04:00 916992 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 11:01 . 2004-08-10 04:00 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01 . 2004-08-10 04:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10 . 2004-08-10 11:00 148480 ——w- c:\windows\system32\imagehlp.dll 2012-02-29 14:10 . 2004-08-10 04:00 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 12:17 . 2004-08-10 04:00 385024 —-a-w- c:\windows\system32\html.iec 2012-02-23 15:18 . 2011-09-15 23:15 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-02-03 09:22 . 2004-08-10 04:00 1860096 —-a-w- c:\windows\system32\win32k.sys 2012-04-27 17:17 . 2011-03-26 19:59 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-04-27_01.50.10 ))))))))))))))))))))))))))))))))))))))))) . + 2012-04-29 00:48 . 2012-04-29 00:48 16384 c:\windows\Temp\Perflib_Perfdata_7e8.dat + 2012-04-27 21:11 . 2012-04-27 21:11 301056 c:\windows\Installer\11774db.msi + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\SCEP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 123352 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\MSE.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\INTUNE.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\FEP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\EPP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 1826304 c:\windows\Installer\117750a.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-07 39408] "Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-04-29 1652736] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584] "RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616] "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312] "DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200] . c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2004-4-13 299008] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Kodak EasyShare software.lnk - c:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2002-9-16 299008] KODAK Software Updater.lnk - c:\program files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-3-13 16384] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-8-15 36903] VersionTracker Pro.lnk - c:\windows\Installer\{78C5D256-A94E-4593-BB24-CED07AFC7938}\New_Shortcut_S1699_A8EB5A2133B04A97AEEFDFB17E2E701D.exe [2007-7-19 53248] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] . c:\documents and settings\Default User\Start Menu\Programs\Startup\ Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-8-15 27136] PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-15 27136] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [3/11/2012 1:48 PM 56208] R1 RapportCerberus_34302;RapportCerberus_34302;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys [12/15/2011 12:12 PM 228208] R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [3/11/2012 1:48 PM 71440] R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [3/11/2012 1:48 PM 164112] R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [3/11/2012 1:48 PM 931640] S1 bfxnqval;bfxnqval; [x] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [3/29/2012 8:51 AM 253088] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys –> c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [?] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys –> c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [?] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys –> c:\windows\system32\DRIVERS\AVGIDSShim.Sys [?] S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/27/2012 12:17 PM 129976] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/9/2004 11:00 PM 14336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WINRM REG_MULTI_SZ WINRM . Contents of the 'Scheduled Tasks' folder . 2012-04-29 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 03:33] . 2012-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-04-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-04-29 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . 2012-04-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . . ——- Supplementary Scan ——- . uStart Page = hxxp://isearch.avg.com/?cid={65B9B557-A7F9-4314-B42F-C7920C264324}∣=⟨=&ds;=≺=&d;=&v;=&sap;=hp uDefault_Search_URL = hxxp://www.google.com/ie mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.30.1 192.168.2.1 FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;= FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B7c26ee5d-fee5-4534-9787-aa5d4185038d%7D∣=05fad2627b16a0be019094f985765214-2d26666d54754f6641b8f9c40321cfff7167cd4b&ds;=AVG&v;=10.2.0.3⟨=en≺=fr&d;=2012-04-10%2023%3A24%3A21&sap;=ku&q;= FF - user.js: yahoo.homepage.dontask - true . . ************************************************************************** . disk not found C:\ . please note that you need administrator rights to perform deep scan scanning hidden processes … . scanning hidden autostart entries … . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . Completion time: 2012-04-28 19:59:22 ComboFix-quarantined-files.txt 2012-04-29 00:59 ComboFix2.txt 2012-04-28 20:10 ComboFix3.txt 2012-04-27 16:19 ComboFix4.txt 2012-04-27 15:21 ComboFix5.txt 2012-04-29 00:45 . Pre-Run: 192,218,853,376 bytes free Post-Run: 192,228,933,632 bytes free . - - End Of File - - 7BCDB3A040DA612897A2E962B12E2A36 - A.J.K.M.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI