What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan:JS/IframeRef [Solved]

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
File::
c:\windows\system32\DRIVERS\AVGIDSDriver.Sys
c:\windows\system32\DRIVERS\AVGIDSFilter.Sys
c:\windows\system32\DRIVERS\AVGIDSShim.Sys

Driver::
bfxnqval
AVGIDSDriver
AVGIDSFilter
AVGIDSShim

Firefox::
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B7c26ee5d-fee5-4534-9787-aa5d4185038d%7D&mid=05fad2627b16a0be019094f985765214-2d26666d54754f6641b8f9c40321cfff7167cd4b&ds=AVG&v=10.2.0.3&lang=en&pr=fr&d=2012-04-10%2023%3A24%3A21&sap=ku&q=

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:
  • start Malwarebytes-Anti-Malware and update it, (“Update” tab}
  • once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
  • when the scan is complete, click OK, then Show Results to view the results.
  • be sure that everything is checked, and click Remove Selected.
  • when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Please tell me how your computer is now and if there are any outstanding problems

Satchfan
Post #17
Satchfan: Is there anything more I need to do to clean my computer? The Trojan:JS/IframeRef has not shown its self for several days. I hope this means the Trojan is gone and not hiding somewhere in my system. I am careful as to what I download, but still got this infection. Are there any suggestions you can offer which I can do to protect my computer in the future? Thank you, A.J.K.M.
Post #18
I will deal with prevention when I'm sure your computer is clean. Please follow the instructions that I sent in the previous post.
Post #19
Satchfan: I reran Combo.fix An update to the software was offered and I did allow the software update. When I run Combo.fix, I still et a pop-up saying there is Root kit activity detected and the softwaer must reboot my computer. Following is my most recent log: ComboFix 12-04-31.03 - HP_Administrator 04/30/2012 21:57:06.6.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1550 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . FILE :: "c:\windows\system32\drivers\avyaqluc.sys" "c:\windows\system32\drivers\bfdjccpn.sys" "c:\windows\system32\drivers\dgiwaygz.sys" "c:\windows\system32\drivers\ewduyewf.sys" "c:\windows\system32\drivers\gadimimt.sys" "c:\windows\system32\drivers\hmhkpgds.sys" "c:\windows\system32\drivers\jwekksmv.sys" "c:\windows\system32\drivers\krnixgga.sys" "c:\windows\system32\drivers\mbbaslqr.sys" "c:\windows\system32\drivers\oszwline.sys" "c:\windows\system32\drivers\ozjoqdtr.sys" "c:\windows\system32\drivers\qqnswemg.sys" "c:\windows\system32\drivers\rffedtwp.sys" "c:\windows\system32\drivers\sqhugywn.sys" "c:\windows\system32\drivers\ubxrryay.sys" "c:\windows\system32\drivers\ypeazctt.sys" . . ((((((((((((((((((((((((( Files Created from 2012-04-01 to 2012-05-01 ))))))))))))))))))))))))))))))) . . 2012-04-30 18:07 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A83489B-557E-4102-A9FD-BCE5532B0D1E}\mpengine.dll 2012-04-29 17:37 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-04-27 17:17 . 2012-04-27 17:17 ——– d—–w- c:\program files\Mozilla Maintenance Service 2012-04-27 17:17 . 2012-04-27 17:17 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe 2012-04-27 17:17 . 2012-04-27 17:17 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe 2012-04-25 22:12 . 2012-04-25 22:12 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\SpeedyPC Software 2012-04-25 22:12 . 2012-04-26 03:47 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedyPC Software 2012-04-24 18:37 . 2012-04-24 18:37 ——– d—–w- c:\program files\AVG Secure Search 2012-04-14 01:27 . 2012-04-14 01:27 ——– d—–w- c:\windows\system32\winrm 2012-04-14 01:26 . 2012-04-14 01:27 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$ 2012-04-13 02:27 . 2007-03-09 16:25 2321288 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2012-04-13 02:27 . 2012-03-20 08:53 6582328 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{0C4B3F48-B6DE-4DDD-86C7-36D37B866EB2}\mpengine.dll 2012-04-12 05:54 . 2012-04-12 05:54 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\IObit 2012-04-12 05:19 . 2012-04-12 05:19 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit 2012-04-12 05:18 . 2012-04-13 13:45 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\IObit 2012-04-12 05:18 . 2012-04-12 05:18 ——– d—–w- c:\program files\IObit 2012-04-11 06:36 . 2012-04-27 21:12 ——– d—–w- c:\program files\Microsoft Security Client 2012-04-11 06:33 . 2012-04-11 06:33 ——– d—–w- c:\program files\Windows Defender 2012-04-11 04:25 . 2012-04-11 04:25 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\AVG2012 2012-04-11 04:24 . 2012-04-11 04:24 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Secure Search 2012-04-11 04:02 . 2012-04-11 04:02 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\PCHealth 2012-04-10 05:09 . 2012-04-11 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools 2012-04-09 06:52 . 2012-01-19 15:22 42864 —-a-r- c:\windows\system32\SBBD.EXE 2012-04-09 06:52 . 2012-01-12 14:26 101112 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-04-08 06:27 . 2012-04-27 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software 2012-04-08 06:27 . 2012-04-12 05:40 ——– d—–w- c:\program files\AVAST Software 2012-04-08 06:07 . 2012-04-08 06:07 11776 —-a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2012-04-08 06:06 . 2012-04-08 06:06 ——– d—–w- c:\program files\Common Files\xing shared 2012-04-08 06:06 . 2012-04-08 06:06 150696 —-a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2012-04-08 06:05 . 2012-04-08 06:05 108544 —-a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2012-04-06 19:46 . 2012-04-06 19:46 ——– d—–w- c:\windows\system32\wbem\Repository 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-16 03:33 . 2012-03-29 13:51 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-04-16 03:33 . 2011-05-14 17:50 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-08 06:05 . 2003-03-19 10:14 499712 —-a-w- c:\windows\system32\msvcp71.dll 2012-04-08 06:05 . 2003-02-21 18:42 348160 —-a-w- c:\windows\system32\msvcr71.dll 2012-04-04 20:56 . 2010-10-02 02:39 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-21 01:44 . 2011-04-18 18:18 171064 —-a-w- c:\windows\system32\drivers\MpFilter.sys 2012-03-11 18:48 . 2012-03-11 18:48 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2012-03-05 19:15 . 2012-03-05 19:15 73728 —-a-w- c:\windows\system32\javacpl.cpl 2012-03-05 19:15 . 2010-05-20 17:14 472808 —-a-w- c:\windows\system32\deployJava1.dll 2012-03-01 11:01 . 2004-08-10 04:00 916992 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 11:01 . 2004-08-10 04:00 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01 . 2004-08-10 04:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10 . 2004-08-10 11:00 148480 ——w- c:\windows\system32\imagehlp.dll 2012-02-29 14:10 . 2004-08-10 04:00 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 12:17 . 2004-08-10 04:00 385024 —-a-w- c:\windows\system32\html.iec 2012-02-23 15:18 . 2011-09-15 23:15 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-02-03 09:22 . 2004-08-10 04:00 1860096 —-a-w- c:\windows\system32\win32k.sys 2012-04-27 17:17 . 2011-03-26 19:59 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-04-27_01.50.10 ))))))))))))))))))))))))))))))))))))))))) . + 2012-05-01 03:04 . 2012-05-01 03:04 16384 c:\windows\Temp\Perflib_Perfdata_f00.dat + 2012-05-01 02:54 . 2012-05-01 02:54 16384 c:\windows\Temp\Perflib_Perfdata_724.dat + 2012-04-27 21:11 . 2012-04-27 21:11 301056 c:\windows\Installer\11774db.msi + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\SCEP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 123352 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\MSE.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\INTUNE.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\FEP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\EPP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 1826304 c:\windows\Installer\117750a.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-07 39408] "Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-04-29 1652736] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584] "RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616] "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312] "DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200] . c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2004-4-13 299008] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Kodak EasyShare software.lnk - c:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2002-9-16 299008] KODAK Software Updater.lnk - c:\program files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-3-13 16384] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-8-15 36903] VersionTracker Pro.lnk - c:\windows\Installer\{78C5D256-A94E-4593-BB24-CED07AFC7938}\New_Shortcut_S1699_A8EB5A2133B04A97AEEFDFB17E2E701D.exe [2007-7-19 53248] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] . c:\documents and settings\Default User\Start Menu\Programs\Startup\ Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-8-15 27136] PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-15 27136] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [3/11/2012 1:48 PM 56208] R1 RapportCerberus_34302;RapportCerberus_34302;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys [12/15/2011 12:12 PM 228208] R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [3/11/2012 1:48 PM 71440] R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [3/11/2012 1:48 PM 164112] R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [3/11/2012 1:48 PM 931640] S1 bfxnqval;bfxnqval; [x] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [3/29/2012 8:51 AM 253088] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys –> c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [?] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys –> c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [?] S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys –> c:\windows\system32\DRIVERS\AVGIDSShim.Sys [?] S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/27/2012 12:17 PM 129976] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/9/2004 11:00 PM 14336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WINRM REG_MULTI_SZ WINRM . Contents of the 'Scheduled Tasks' folder . 2012-05-01 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 03:33] . 2012-05-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-05-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . 2012-04-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . . ——- Supplementary Scan ——- . uStart Page = hxxp://isearch.avg.com/?cid={65B9B557-A7F9-4314-B42F-C7920C264324}∣=⟨=&ds;=≺=&d;=&v;=&sap;=hp uDefault_Search_URL = hxxp://www.google.com/ie mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.30.1 192.168.2.1 FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;= FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B7c26ee5d-fee5-4534-9787-aa5d4185038d%7D∣=05fad2627b16a0be019094f985765214-2d26666d54754f6641b8f9c40321cfff7167cd4b&ds;=AVG&v;=10.2.0.3⟨=en≺=fr&d;=2012-04-10%2023%3A24%3A21&sap;=ku&q;= FF - user.js: yahoo.homepage.dontask - true . . ************************************************************************** . disk not found C:\ . please note that you need administrator rights to perform deep scan scanning hidden processes … . scanning hidden autostart entries … . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . Completion time: 2012-04-30 22:07:22 ComboFix-quarantined-files.txt 2012-05-01 03:07 ComboFix2.txt 2012-04-29 00:59 ComboFix3.txt 2012-04-28 20:10 ComboFix4.txt 2012-04-27 16:19 ComboFix5.txt 2012-05-01 02:51 . Pre-Run: 192,101,388,288 bytes free Post-Run: 192,103,067,648 bytes free . - - End Of File - - D08D6DAC366E997E84E6AC783A422D82 Thank you for your assistance, A.J.K.M.
Post #20
There does appear to be something wrong.

The ComboFix scripts I supplied should have got rid of many things that are still appearing, one of which is AVG which makes me thing that the scripts have not been run properly.

Run TDSSKiller

Please download TDSSKiller.zip
  • extract it to your desktop
  • double click TDSSKiller.exe
  • press Start Scan

    only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.

  • click Continue > Reboot now

  • copy and paste the log in your next reply
  • a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

===================================================

Run DDS

Please re-run DDS and post the contents of DDS.txt in your next reply - remember to include the TDSSKiller log

Satchfan
Post #21
Satchfan: 1st an apology. I missed your post to run the Malware program on my computer (missed 'page 2). FYI, before working with you I would update and run this regularly. When I first ran the program it would find several items. Lately it has not found problems. After the software updated I did a quick scan. Following is the log: Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.05.01.07 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 HP_Administrator :: AJDESKTOPOFFICE [administrator] 5/1/2012 9:25:21 AM mbam-log-2012-05-01 (09-25-21).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 213768 Time elapsed: 10 minute(s), 14 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) I also missed your request to download: TDSSKiller. I did download the software to my desktop and ran it twice. It did not find any problems to 'cure'. I then copied the new code provided for Combo.Fix and dragged it to the program. (Shield and MSE were disabled for this step.) Again it detected 'new software available' and I allowed the software to update. When the ComboFix ran I again received a message 'root.kit activity detected, computer must reboot' (I allowed computer to reboot). What does this mean and does it indicate an infection still present? Following is the log from Combo.Fix: ComboFix 12-05-01.02 - HP_Administrator 05/01/2012 10:19:06.8.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1550 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . FILE :: "c:\windows\system32\DRIVERS\AVGIDSDriver.Sys" "c:\windows\system32\DRIVERS\AVGIDSFilter.Sys" "c:\windows\system32\DRIVERS\AVGIDSShim.Sys" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Legacy_AVGIDSDRIVER ——-\Legacy_AVGIDSFILTER ——-\Legacy_AVGIDSSHIM ——-\Service_AVGIDSDriver ——-\Service_AVGIDSFilter ——-\Service_AVGIDSShim ——-\Service_bfxnqval . . ((((((((((((((((((((((((( Files Created from 2012-04-01 to 2012-05-01 ))))))))))))))))))))))))))))))) . . 2012-05-01 15:06 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2C902D6E-EE30-410F-B96F-493087FA2663}\mpengine.dll 2012-04-29 17:37 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-04-27 17:17 . 2012-04-27 17:17 ——– d—–w- c:\program files\Mozilla Maintenance Service 2012-04-27 17:17 . 2012-04-27 17:17 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe 2012-04-27 17:17 . 2012-04-27 17:17 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe 2012-04-25 22:12 . 2012-04-25 22:12 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\SpeedyPC Software 2012-04-25 22:12 . 2012-04-26 03:47 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedyPC Software 2012-04-24 18:37 . 2012-04-24 18:37 ——– d—–w- c:\program files\AVG Secure Search 2012-04-14 01:27 . 2012-04-14 01:27 ——– d—–w- c:\windows\system32\winrm 2012-04-14 01:26 . 2012-04-14 01:27 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$ 2012-04-13 02:27 . 2007-03-09 16:25 2321288 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2012-04-13 02:27 . 2012-03-20 08:53 6582328 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{0C4B3F48-B6DE-4DDD-86C7-36D37B866EB2}\mpengine.dll 2012-04-12 05:54 . 2012-04-12 05:54 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\IObit 2012-04-12 05:19 . 2012-04-12 05:19 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit 2012-04-12 05:18 . 2012-04-13 13:45 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\IObit 2012-04-12 05:18 . 2012-04-12 05:18 ——– d—–w- c:\program files\IObit 2012-04-11 06:36 . 2012-04-27 21:12 ——– d—–w- c:\program files\Microsoft Security Client 2012-04-11 06:33 . 2012-04-11 06:33 ——– d—–w- c:\program files\Windows Defender 2012-04-11 04:25 . 2012-04-11 04:25 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\AVG2012 2012-04-11 04:24 . 2012-04-11 04:24 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Secure Search 2012-04-11 04:02 . 2012-04-11 04:02 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\PCHealth 2012-04-10 05:09 . 2012-04-11 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools 2012-04-09 06:52 . 2012-01-19 15:22 42864 —-a-r- c:\windows\system32\SBBD.EXE 2012-04-09 06:52 . 2012-01-12 14:26 101112 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-04-08 06:27 . 2012-04-27 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software 2012-04-08 06:27 . 2012-04-12 05:40 ——– d—–w- c:\program files\AVAST Software 2012-04-08 06:07 . 2012-04-08 06:07 11776 —-a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2012-04-08 06:06 . 2012-04-08 06:06 ——– d—–w- c:\program files\Common Files\xing shared 2012-04-08 06:06 . 2012-04-08 06:06 150696 —-a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2012-04-08 06:05 . 2012-04-08 06:05 108544 —-a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2012-04-06 19:46 . 2012-04-06 19:46 ——– d—–w- c:\windows\system32\wbem\Repository 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-16 03:33 . 2012-03-29 13:51 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-04-16 03:33 . 2011-05-14 17:50 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-08 06:05 . 2003-03-19 10:14 499712 —-a-w- c:\windows\system32\msvcp71.dll 2012-04-08 06:05 . 2003-02-21 18:42 348160 —-a-w- c:\windows\system32\msvcr71.dll 2012-04-04 20:56 . 2010-10-02 02:39 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-21 01:44 . 2011-04-18 18:18 171064 —-a-w- c:\windows\system32\drivers\MpFilter.sys 2012-03-11 18:48 . 2012-03-11 18:48 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2012-03-05 19:15 . 2012-03-05 19:15 73728 —-a-w- c:\windows\system32\javacpl.cpl 2012-03-05 19:15 . 2010-05-20 17:14 472808 —-a-w- c:\windows\system32\deployJava1.dll 2012-03-01 11:01 . 2004-08-10 04:00 916992 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 11:01 . 2004-08-10 04:00 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01 . 2004-08-10 04:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10 . 2004-08-10 11:00 148480 ——w- c:\windows\system32\imagehlp.dll 2012-02-29 14:10 . 2004-08-10 04:00 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 12:17 . 2004-08-10 04:00 385024 —-a-w- c:\windows\system32\html.iec 2012-02-23 15:18 . 2011-09-15 23:15 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-02-03 09:22 . 2004-08-10 04:00 1860096 —-a-w- c:\windows\system32\win32k.sys 2012-04-27 17:17 . 2011-03-26 19:59 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-04-27_01.50.10 ))))))))))))))))))))))))))))))))))))))))) . + 2012-05-01 15:27 . 2012-05-01 15:27 16384 c:\windows\Temp\Perflib_Perfdata_ff0.dat + 2012-05-01 15:28 . 2012-05-01 15:28 16384 c:\windows\Temp\Perflib_Perfdata_618.dat + 2012-04-27 21:11 . 2012-04-27 21:11 301056 c:\windows\Installer\11774db.msi + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\SCEP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 123352 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\MSE.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\INTUNE.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\FEP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\EPP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 1826304 c:\windows\Installer\117750a.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-07 39408] "Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-04-29 1652736] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584] "RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616] "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312] "DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200] . c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2004-4-13 299008] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Kodak EasyShare software.lnk - c:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2002-9-16 299008] KODAK Software Updater.lnk - c:\program files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-3-13 16384] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-8-15 36903] VersionTracker Pro.lnk - c:\windows\Installer\{78C5D256-A94E-4593-BB24-CED07AFC7938}\New_Shortcut_S1699_A8EB5A2133B04A97AEEFDFB17E2E701D.exe [2007-7-19 53248] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] . c:\documents and settings\Default User\Start Menu\Programs\Startup\ Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-8-15 27136] PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-15 27136] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [3/11/2012 1:48 PM 56208] R1 RapportCerberus_34302;RapportCerberus_34302;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys [12/15/2011 12:12 PM 228208] R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [3/11/2012 1:48 PM 71440] R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [3/11/2012 1:48 PM 164112] R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [3/11/2012 1:48 PM 931640] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [3/29/2012 8:51 AM 253088] S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/27/2012 12:17 PM 129976] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/9/2004 11:00 PM 14336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WINRM REG_MULTI_SZ WINRM . Contents of the 'Scheduled Tasks' folder . 2012-05-01 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 03:33] . 2012-05-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-05-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . 2012-04-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . . ——- Supplementary Scan ——- . uStart Page = hxxp://isearch.avg.com/?cid={65B9B557-A7F9-4314-B42F-C7920C264324}∣=⟨=&ds;=≺=&d;=&v;=&sap;=hp uDefault_Search_URL = hxxp://www.google.com/ie mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.30.1 192.168.2.1 FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;= FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - user.js: yahoo.homepage.dontask - true . . ************************************************************************** . disk not found C:\ . please note that you need administrator rights to perform deep scan scanning hidden processes … . scanning hidden autostart entries … . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . ——————— DLLs Loaded Under Running Processes ——————— . - - - - - - - > 'explorer.exe'(2528) c:\windows\system32\WININET.dll c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll c:\progra~1\WINDOW~1\wmpband.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ———————— Other Running Processes ———————— . c:\program files\Microsoft Security Client\MsMpEng.exe c:\windows\eHome\ehRecvr.exe c:\windows\eHome\ehSched.exe c:\program files\Canon\IJPLM\IJPLMSVC.EXE c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\nvsvc32.exe c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\windows\system32\SearchIndexer.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\wscntfy.exe c:\windows\system32\dllhost.exe c:\windows\RTHDCPL.EXE c:\windows\eHome\ehmsas.exe . ************************************************************************** . Completion time: 2012-05-01 10:34:10 - machine was rebooted ComboFix-quarantined-files.txt 2012-05-01 15:34 ComboFix2.txt 2012-05-01 15:02 ComboFix3.txt 2012-05-01 03:07 ComboFix4.txt 2012-04-29 00:59 ComboFix5.txt 2012-05-01 15:14 . Pre-Run: 192,076,890,112 bytes free Post-Run: 192,073,195,520 bytes free . - - End Of File - - 4E0A6A49BF3FD028E8523F17B92C4CE9 Thank you. I await your next instructions. A.J.K.M.
Post #22
Thanks for the logs, it has cleared up a few of the questions I had.. I'd still like a new DDS log. Can you also tell me if you are having any issues now. Thanks Satchfan
Post #23
Satchfan: The Trojan has not shown itself for several days. My hope is it is out of my computer system, never to return. My system seems good but my internet has been running a little slower, but it is 'leaf-out' and we are getting several spring storms - all typically slow down my connection to the city-wide WiFi to which I subscribe. When running ComboFix I again got a message saying there was 'rootkit activity detected' and the system had to reboot. What does this mean? Is it normal? (Computer Shield and MSE had been disabled before starting scan.) Also, since the 1st time I downloaded the Combo.Fix from your link, this file appeared on my desktop with your software: avg_free_stb_en_2012_2127_free. Is this an error or correct? You had earlier mentioned detecting a bit of AVG remaining on my system. Other than those minor issues, my computer is working well and I expect will be even better if I run a defrag. Here is the latest Combo.Fix log: ComboFix 12-05-01.02 - HP_Administrator 05/01/2012 19:01:50.9.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1547 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . FILE :: "c:\windows\system32\DRIVERS\AVGIDSDriver.Sys" "c:\windows\system32\DRIVERS\AVGIDSFilter.Sys" "c:\windows\system32\DRIVERS\AVGIDSShim.Sys" . . ((((((((((((((((((((((((( Files Created from 2012-04-02 to 2012-05-02 ))))))))))))))))))))))))))))))) . . 2012-05-01 17:49 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B6563ED8-0247-4FED-8362-5D39225DD4AD}\mpengine.dll 2012-05-01 15:35 . 2012-04-13 07:36 6734704 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-04-27 17:17 . 2012-04-27 17:17 ——– d—–w- c:\program files\Mozilla Maintenance Service 2012-04-27 17:17 . 2012-04-27 17:17 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe 2012-04-27 17:17 . 2012-04-27 17:17 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe 2012-04-25 22:12 . 2012-04-25 22:12 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\SpeedyPC Software 2012-04-25 22:12 . 2012-04-26 03:47 ——– d—–w- c:\documents and settings\All Users\Application Data\SpeedyPC Software 2012-04-24 18:37 . 2012-04-24 18:37 ——– d—–w- c:\program files\AVG Secure Search 2012-04-14 01:27 . 2012-04-14 01:27 ——– d—–w- c:\windows\system32\winrm 2012-04-14 01:26 . 2012-04-14 01:27 ——– dc-h–w- c:\windows\$968930Uinstall_KB968930$ 2012-04-13 02:27 . 2007-03-09 16:25 2321288 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2012-04-13 02:27 . 2012-03-20 08:53 6582328 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{0C4B3F48-B6DE-4DDD-86C7-36D37B866EB2}\mpengine.dll 2012-04-12 05:54 . 2012-04-12 05:54 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\IObit 2012-04-12 05:19 . 2012-04-12 05:19 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit 2012-04-12 05:18 . 2012-04-13 13:45 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\IObit 2012-04-12 05:18 . 2012-04-12 05:18 ——– d—–w- c:\program files\IObit 2012-04-11 06:36 . 2012-04-27 21:12 ——– d—–w- c:\program files\Microsoft Security Client 2012-04-11 06:33 . 2012-04-11 06:33 ——– d—–w- c:\program files\Windows Defender 2012-04-11 04:25 . 2012-04-11 04:25 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\AVG2012 2012-04-11 04:24 . 2012-04-11 04:24 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Secure Search 2012-04-11 04:02 . 2012-04-11 04:02 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\PCHealth 2012-04-10 05:09 . 2012-04-11 06:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools 2012-04-09 06:52 . 2012-01-19 15:22 42864 —-a-r- c:\windows\system32\SBBD.EXE 2012-04-09 06:52 . 2012-01-12 14:26 101112 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-04-08 06:27 . 2012-04-27 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software 2012-04-08 06:27 . 2012-04-12 05:40 ——– d—–w- c:\program files\AVAST Software 2012-04-08 06:07 . 2012-04-08 06:07 11776 —-a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2012-04-08 06:06 . 2012-04-08 06:06 ——– d—–w- c:\program files\Common Files\xing shared 2012-04-08 06:06 . 2012-04-08 06:06 150696 —-a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2012-04-08 06:05 . 2012-04-08 06:05 108544 —-a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2012-04-06 19:46 . 2012-04-06 19:46 ——– d—–w- c:\windows\system32\wbem\Repository 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll 2012-04-04 05:53 . 2012-04-04 05:53 182160 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-16 03:33 . 2012-03-29 13:51 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-04-16 03:33 . 2011-05-14 17:50 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-08 06:05 . 2003-03-19 10:14 499712 —-a-w- c:\windows\system32\msvcp71.dll 2012-04-08 06:05 . 2003-02-21 18:42 348160 —-a-w- c:\windows\system32\msvcr71.dll 2012-04-04 20:56 . 2010-10-02 02:39 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-21 01:44 . 2011-04-18 18:18 171064 —-a-w- c:\windows\system32\drivers\MpFilter.sys 2012-03-11 18:48 . 2012-03-11 18:48 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2012-03-05 19:15 . 2012-03-05 19:15 73728 —-a-w- c:\windows\system32\javacpl.cpl 2012-03-05 19:15 . 2010-05-20 17:14 472808 —-a-w- c:\windows\system32\deployJava1.dll 2012-03-01 11:01 . 2004-08-10 04:00 916992 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 11:01 . 2004-08-10 04:00 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 11:01 . 2004-08-10 04:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2012-02-29 14:10 . 2004-08-10 11:00 148480 ——w- c:\windows\system32\imagehlp.dll 2012-02-29 14:10 . 2004-08-10 04:00 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 12:17 . 2004-08-10 04:00 385024 —-a-w- c:\windows\system32\html.iec 2012-02-23 15:18 . 2011-09-15 23:15 237072 ——w- c:\windows\system32\MpSigStub.exe 2012-02-03 09:22 . 2004-08-10 04:00 1860096 —-a-w- c:\windows\system32\win32k.sys 2012-04-27 17:17 . 2011-03-26 19:59 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-04-27_01.50.10 ))))))))))))))))))))))))))))))))))))))))) . + 2012-05-01 23:59 . 2012-05-01 23:59 16384 c:\windows\Temp\Perflib_Perfdata_15c.dat + 2012-04-27 21:11 . 2012-04-27 21:11 301056 c:\windows\Installer\11774db.msi + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\SCEP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 123352 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\MSE.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\INTUNE.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\FEP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\EPP.exe + 2012-04-27 21:12 . 2012-04-27 21:12 1826304 c:\windows\Installer\117750a.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-07 39408] "Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-04-29 1652736] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584] "RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616] "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312] "DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200] . c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2004-4-13 299008] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Kodak EasyShare software.lnk - c:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2002-9-16 299008] KODAK Software Updater.lnk - c:\program files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-3-13 16384] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-8-15 36903] VersionTracker Pro.lnk - c:\windows\Installer\{78C5D256-A94E-4593-BB24-CED07AFC7938}\New_Shortcut_S1699_A8EB5A2133B04A97AEEFDFB17E2E701D.exe [2007-7-19 53248] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] . c:\documents and settings\Default User\Start Menu\Programs\Startup\ Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-8-15 27136] PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-8-15 27136] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [3/11/2012 1:48 PM 56208] R1 RapportCerberus_34302;RapportCerberus_34302;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys [12/15/2011 12:12 PM 228208] R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [3/11/2012 1:48 PM 71440] R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [3/11/2012 1:48 PM 164112] R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [3/11/2012 1:48 PM 931640] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [3/29/2012 8:51 AM 253088] S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/18/2010 8:59 PM 135664] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/27/2012 12:17 PM 129976] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/9/2004 11:00 PM 14336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WINRM REG_MULTI_SZ WINRM . Contents of the 'Scheduled Tasks' folder . 2012-05-01 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 03:33] . 2012-05-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-05-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 01:59] . 2012-05-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . 2012-04-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3006399-3236263178-3685853688-1007.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-30 22:45] . . ——- Supplementary Scan ——- . uStart Page = hxxp://isearch.avg.com/?cid={65B9B557-A7F9-4314-B42F-C7920C264324}∣=⟨=&ds;=≺=&d;=&v;=&sap;=hp uDefault_Search_URL = hxxp://www.google.com/ie mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.30.1 192.168.2.1 FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\0pc4ws4u.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;= FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official FF - user.js: yahoo.homepage.dontask - true . . ************************************************************************** . disk not found C:\ . please note that you need administrator rights to perform deep scan scanning hidden processes … . scanning hidden autostart entries … . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . Completion time: 2012-05-01 19:10:44 ComboFix-quarantined-files.txt 2012-05-02 00:10 ComboFix2.txt 2012-05-01 15:34 ComboFix3.txt 2012-05-01 15:02 ComboFix4.txt 2012-05-01 03:07 ComboFix5.txt 2012-05-01 23:56 . Pre-Run: 191,999,463,424 bytes free Post-Run: 192,012,042,240 bytes free . - - End Of File - - C639D82340BF17060F795C7A71A43F2C Thank you for your assistance, A.J.K.M.
Post #24
Hi A.J.K.M

since the 1st time I downloaded the Combo.Fix from your link, this file appeared on my desktop with your software: avg_free_stb_en_2012_2127_free

that’s not from ComboFix but may have come with something else. Just delete it from your desktop.

There doesn’t seem to be any sign of rootkits as aswMBR, TDSSKiller & ComboFix have found nothing.

However, although everything is looking good, we’ll run a rootkit and online scan to be sure there is nothing left.

==============================================

Download the GMER Rootkit Scanner

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done, click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

==============================================

Run ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Please also include Gmer.txt

Satchfan
Post #25
Satchfan:

Following are the results of the two programs:

1st file:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-05-02 12:32:46
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e WDC_WD2500JS-60NCB1 rev.10.02E02
Running: gmer.exe; Driver: C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\uxnyqpoc.sys


—- System - GMER 1.0.15 —-

SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwAssignProcessToJobObject [0xB578A086]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwCreateFile [0xB578ABE4]
SSDT \??\C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys ZwCreateThread [0xB5B365E0]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteFile [0xB578ADDC]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteKey [0xB578E5B2]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteValueKey [0xB578E5E4]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwLoadKey [0xB578E746]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenFile [0xB578ACFC]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenProcess [0xB578A1FC]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenThread [0xB578A3F0]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwProtectVirtualMemory [0xB578A522]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwQueryValueKey [0xB578E6BC]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwRenameKey [0xB578E626]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwReplaceKey [0xB578E658]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwRestoreKey [0xB578E68A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetContextThread [0xB578A02C]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetInformationFile [0xB578AE82]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetValueKey [0xB578E54A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSuspendThread [0xB5789FC6]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwTerminateProcess [0xB5789EEE]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwTerminateThread [0xB5789F36]

—- Kernel code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB8D62360, 0x20574D, 0xE8000020]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1292] ntdll.dll!KiUserApcDispatcher 7C90E450 5 Bytes JMP 00414DA0 C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (RapportMgmtService/Trusteer Ltd.)
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1292] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71A70001
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1292] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 71A10022
.text C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe[1292] WS2_32.dll!gethostbyname 71AB5355 5 Bytes JMP 71AE0022
.text C:\WINDOWS\system32\SearchIndexer.exe[2188] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!??2@YAPAXI@Z 77C29CC5 5 Bytes JMP 0A93C080 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!??3@YAXPAX@Z 77C29CDD 5 Bytes JMP 0A93C0E0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!?set_new_handler@@YAP6AXXZP6AXXZ@Z 77C29D9F 5 Bytes JMP 0A93C110 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_aligned_offset_malloc 77C29DAF 5 Bytes JMP 0A93BFE0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_aligned_free 77C29E33 5 Bytes JMP 0A93C0E0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_aligned_malloc 77C29E52 5 Bytes JMP 0A93BFC0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_aligned_offset_realloc 77C29E6E 5 Bytes JMP 0A93C020 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_aligned_realloc 77C29FC6 5 Bytes JMP 0A93C000 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_expand 77C29FE5 5 Bytes JMP 0A93BFA0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_heapadd 77C2BC9F 5 Bytes JMP 0A93C160 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_heapchk 77C2BCB3 5 Bytes JMP 0A93C170 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_heapset + 1 77C2BD83 4 Bytes JMP 0A93C191 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_heapmin 77C2BD8C 5 Bytes JMP 0A93C260 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_heapused 77C2BE3A 5 Bytes JMP 0A93C230 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_heapwalk 77C2BE4D 5 Bytes JMP 0A93C1A0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!_msize 77C2BF6C 5 Bytes JMP 0A93BEB0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!calloc 77C2C0C3 5 Bytes JMP 0A93BE50 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!free 77C2C21B 5 Bytes JMP 0A93C0E0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!malloc 77C2C407 5 Bytes JMP 0A93BE10 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\HOTSYNC.EXE[3428] MSVCRT.dll!realloc 77C2C437 5 Bytes JMP 0A93BE90 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3508] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 0121C930 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3508] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 0144E0AA C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3508] kernel32.dll!MapViewOfFile 7C80B9A5 5 Bytes JMP 0144E083 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3508] USER32.dll!GetWindowInfo 7E42C49C 5 Bytes JMP 0139BEC9 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3508] GDI32.dll!CreateDIBSection 77F19E19 5 Bytes JMP 0144E00D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 arkbcfltr.sys (Microsoft AR PS/2 Keyboard Filter Driver (Beta 2 Release 2)/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-


2nd file:

C:\Documents and Settings\HP_Administrator\My Documents\Downloads\Flash-Player-Setup.exe Win32/Toolbar.Zugo application deleted - quarantined
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1738\A1779056.exe a variant of Win32/Soft32Downloader.A application cleaned by deleting - quarantined
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1738\A1779065.exe a variant of Win32/Soft32Downloader.A application cleaned by deleting - quarantined


Please advise.

Thank you,

A.J.K.M.
Post #26
Hi A.J.K.M, that all looks fine and I think you are good to go. :thumbup:

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

Uninstall Combofix

Follow these steps to uninstall Combofix
  • click START then RUN
  • now type Combofix /uninstall in the runbox and click OK.
Note the space between the X and the /, it needs to be there.
🖼Click to load external image (Posted Image)
  • please follow the prompts to uninstall Combofix.
  • once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.
You can delete all other programs or files that we have used from your desktop.

===================================================

Firewall

You're using the Windows Firewall which is not adequate protection. The main reason you should use a third-party firewall over the Windows XP Firewall is because Windows Firewall only stops incoming signals from accessing your computer. However, it will not stop Outgoing signals (possibly ones that could intrude your privacy) from sending information to the Internet or to other networks. That means if malware happens to compromise your PC again, it will be able to SEND OUT out your credit card data and any other personal information.

I suggest you install a more robust third party firewall that filters both incoming and outgoing traffic.

Download and install one of the following freeware firewalls from below:

Sygate Personal Firewall Free Edition:
Zone Alarm Free:
Comodo Personal Firewall:

NOTE only install one firewall. Having more than one could cause many programs to stop working altogether. Also, the firewalls may get in each others' way and cause some security holes that would not be there with just one firewall.

When you have done that:

Disable Windows firewall:
  • Click on Start, Settings and then Control Panel
  • Click on the Security Center icon.
  • Click on the Windows Firewall icon
  • Click Off (not recommended) and then click OK.
You should take the time to read Understanding and Using Firewalls

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

===================================================

Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

Safe computing

Satchfan
Post #27
Satchfan: Thank you for all your assistance. I began reading the suggested information sites - bookmarked them to finish at a later time. I also uninstalled Combo.Fix I have downloaded and enabled the Comodo Firewall and disabled the Microsoft Firewall. I also downloaded and enabled Spyware Blaster. Should I keep Microsoft Security Essentials active on my computer? I will continue to keep Malwarebytes updated and will run it at least once a week. It is wonderful to have a healed computer and hopefully it will now be better protected. Thank you again, A.J.K.M.
Post #28
Hello A.J.K.M

Thank you for all your assistance

You're welcome..

Should I keep Microsoft Security Essentials active on my computer?

Yes, it’s a very good antivirus. You should have ONE antivirus and ONE firewall on your computer, Comodo and Microsoft Security Essentials will do the trick.

Regards

Satchfan
Post #29
Satchfan: I thought everything was going well, but in the past 36 hours, my computer response time has slowed down dramatically. I can connect to the internet, but it takes forever for sites to load. Is Comodo causing the slowdown? Should I try another firewall? I want the computer to be safe, but the way it is presently working, it is very difficult to get anything done. A.J.K.M.
Post #30
Hello A.J.K.M

You're right to be sure so we'll check to put your mind at ease.

Comodo is not really known to make that nuch of a slow-down so let's have another look at what security you have.

Run Security Check

It may not be on your system any more so you can download it again.

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI