What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware/virus scan [Closed]

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am running a windows xp on my Dell pc. Unable to access internet in the normal fashion. My desktop icons don't show. Instead I get a small flashing and constantly moving window. The best I can do is run my pc on SAFE MODE to get internet access.
Post #2
I am running a windows xp on my Dell pc. Unable to access internet in the normal fashion. My desktop icons don't show. Instead I get a small flashing and constantly moving window. The best I can do is run my pc on SAFE MODE to get internet access.
Post #3
Hello Kenny,

This is Ken, Debbies dad.

Let run a few scans and see whats going on.



Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]





Download DDS from one of the links below to your desktop

Link 1
Link 2

  • Double click the tool to run it.
  • A black Screen will open, just read the contents and do nothing.
  • When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
  • Copy/Paste the contents of 'DDS.txt' into your post.
  • 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)
Post #4 last edited
I saved the log of my scan. It is saved to my desktop in what appears to be a zipped file. What is the procedure for sending it to you? aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-05-06 20:31:33 —————————– 20:31:33.000 OS Version: Windows 5.1.2600 Service Pack 3 20:31:33.000 Number of processors: 1 586 0x102 20:31:33.000 ComputerName: KENSCOMPUTER UserName: Ken 20:31:34.015 Initialize success 20:33:34.578 AVAST engine defs: 12050601 20:33:56.562 The log file has been saved successfully to "C:\Documents and Settings\Ken.KENSCOMPUTER\Desktop\aswMBR.txt" aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-05-06 20:31:33 —————————– 20:31:33.000 OS Version: Windows 5.1.2600 Service Pack 3 20:31:33.000 Number of processors: 1 586 0x102 20:31:33.000 ComputerName: KENSCOMPUTER UserName: Ken 20:31:34.015 Initialize success 20:33:34.578 AVAST engine defs: 12050601 20:33:56.562 The log file has been saved successfully to "C:\Documents and Settings\Ken.KENSCOMPUTER\Desktop\aswMBR.txt" 20:34:09.312 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 20:34:09.312 Disk 0 Vendor: WDC_WD1600AAJB-22WRA0 58.01H58 Size: 152627MB BusType: 3 20:34:09.312 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c 20:34:09.312 Disk 1 Vendor: IOMEGA_ZIP_250 41.S Size: 152627MB BusType: 2 20:34:09.343 Disk 0 MBR read successfully 20:34:09.343 Disk 0 MBR scan 20:34:09.734 Disk 0 Windows XP default MBR code 20:34:09.750 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 152617 MB offset 63 20:34:10.015 Disk 0 scanning sectors +312560640 20:34:10.390 Disk 0 scanning C:\WINDOWS\system32\drivers 20:34:19.437 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 20:34:26.531 Disk 0 trace - called modules: 20:34:26.875 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8309ef10]<< 20:34:26.875 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x833a2ab8] 20:34:26.875 3 CLASSPNP.SYS[f8776fd7] -> nt!IofCallDriver -> [0x8310a328] 20:34:26.890 \Driver\00000807[0x8310d7d8] -> IRP_MJ_CREATE -> 0x8309ef10 20:34:27.750 AVAST engine scan C:\WINDOWS 20:34:49.375 AVAST engine scan C:\WINDOWS\system32 20:36:36.281 File: C:\WINDOWS\system32\mclogmanagerservice.dll **INFECTED** Win32:Sirefef-SM [Trj] 20:39:52.812 AVAST engine scan C:\WINDOWS\system32\drivers 20:40:02.484 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 20:40:16.109 AVAST engine scan C:\Documents and Settings\Ken.KENSCOMPUTER 20:41:15.203 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Ken.KENSCOMPUTER\Desktop\MBR.dat" 20:41:15.203 The log file has been saved successfully to "C:\Documents and Settings\Ken.KENSCOMPUTER\Desktop\aswMBR.txt"

Attachments:

Post #5
Kenny,

Reply to this topic only by using the ADD REPLY button on the bottom of this page and do not START A NEW TOPIC or else I wont be able to keep track of you.


Most of the scanner logs will open in Notepad, when they open go up to the top and go to EDIT > SELECT ALL …………..EDIT > COPY and then just paste the report into this thread by using ADD REPLY.

aswMBR checks for a rootkit, it looks you have some serious infections going on, before we do anything else I want to see the DDS report please
Post #6

Hello Kenny,

This is Ken, Debbies dad.

Let run a few scans and see whats going on.



Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]





Download DDS from one of the links below to your desktop

Link 1
Link 2

  • Double click the tool to run it.
  • A black Screen will open, just read the contents and do nothing.
  • When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
  • Copy/Paste the contents of 'DDS.txt' into your post.
  • 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)

Attachments:

Post #7
DDS (Ver_2011-08-26.01) - NTFSx86 DSREPAIR
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_30
Run by [removed] at 13:16:31 on 2012-05-07
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.126 [GMT -7:00]
.
FW: AVG Firewall *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Brand Affinity Technologies\Fantapper Player\FantapperUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\cidaemon.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {27a220b7-bb43-4faf-b27b-f803d18eea28} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Yontoo: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo\YontooIEClient.dll
TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [8DDYX0ZBPZ] c:\docume~1\ken~1.ken\locals~1\temp\Mf1.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [C-Media Mixer] Mixer.exe /startup
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [MozillaAgent] c:\windows\temp\_ex-68.exe
mRun: [Spybot-S&D Cleaning] "c:\program files\spybot - search & destroy 2\SDCleaner.exe" /autoclean
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallati…077504fe70f9bf1
dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10v_ActiveX.exe -update activex
StartupFolder: c:\docume~1\ken~1.ken\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: mswsock.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1255750055086
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1255811357906
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{68FA7271-FF42-4841-825F-FA3D539DF2B4} : DhcpNameServer = 192.168.1.1
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 nwprovau
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\ken.kenscomputer\application data\mozilla\firefox\profiles\36a57sz9.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B6769e734-6725-442f-9bdf-7c69f859f1ba%7D&mid=3d0d8e7ad9e647d19a93d14d1c978d9b-dab3fd35dbbe67f699e0cb7c8077504fe70f9bf1&ds=AVG&v=9.0.0.22&lang=en&pr=pr&d=2011-10-12%2018%3A54%3A36&sap=ku&q=
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_235.dll
.
—- FIREFOX POLICIES —-
user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);FF - user.js: extentions.y2layers.installId - 7396ecbf-66fb-4de8-9619-c71d1f173c5b
FF - user.js: extentions.y2layers.defaultEnableAppsList - bestvideodownloader,ezLooker,pagerage,buzzdock,toprelatedtopics,twittube
.
FF - user.js: extensions.autoDisableScopes - 14
.
============= SERVICES / DRIVERS ===============
.
R2 FTSvc;Fantapper Player Update Service;c:\program files\brand affinity technologies\fantapper player\FantapperUpdateService.exe [2011-12-15 11776]
S0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2011-10-15 464176]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2012-1-5 150856]
S2 pav_service;Npapimon;c:\windows\system32\svchost.exe -k netsvcs [2001-8-23 14336]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-4 257696]
S3 dsiarhwprog;dsiarhwprog;c:\windows\system32\drivers\dsiarhwprog.sys [2009-12-23 29184]
S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2011-12-22 50704]
.
=============== Created Last 30 ================
.
2012-04-27 23:58:55 ——– d—–w- c:\documents and settings\ken.kenscomputer\local settings\application data\Help
2012-04-27 20:33:58 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2012-04-27 20:33:52 719832 —-a-w- c:\program files\mozilla firefox\mozcpp19.dll
2012-04-27 20:33:52 715736 —-a-w- c:\program files\mozilla firefox\mozcrt19.dll
.
==================== Find3M ====================
.
2012-05-07 04:06:31 0 –sha-w- c:\windows\system32\dds_trash_log.cmd
2012-05-05 19:07:06 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-05 19:07:06 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
.
============= FINISH: 13:17:49.17 ===============
Post #8
Kenny,

No need to quote me on my posts, just copy and paste the logs I ask for into this thread. No need to attach them either, all the logs will open in Windows Notepad, when the log opens, just go up to the top left and select Edit > Select All…… Then Edit> Copy . Then click on the Add Reply button , put your mouse cursor into the reply, right click and select Paste.


Ok, here we go


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #9 last edited

Kenny,

No need to quote me on my posts, just copy and paste the logs I ask for into this thread. No need to attach them either, all the logs will open in Windows Notepad, when the log opens, just go up to the top left and select Edit > Select All…… Then Edit> Copy . Then click on the Add Reply button , put your mouse cursor into the reply, right click and select Paste.


Ok, here we go


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.






ComboFix 12-05-07.03 - Ken 05/07/2012 15:50:29.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.320 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users.WINDOWS\Application Data\108225323
c:\documents and settings\All Users.WINDOWS\Application Data\1315616642
c:\documents and settings\All Users.WINDOWS\Application Data\338746g7b825m842w374y8huq4t2
c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
c:\documents and settings\All Users.WINDOWS\Application Data\TEMP\DFC5A2B2.TMP
c:\program files\Brand Affinity Technologies
c:\program files\Brand Affinity Technologies\Fantapper Player\ChromeInstaller.dll
c:\program files\Brand Affinity Technologies\Fantapper Player\ChromeInstaller.InstallState
c:\program files\Brand Affinity Technologies\Fantapper Player\fantapper_gi20111005.crx
c:\program files\Brand Affinity Technologies\Fantapper Player\fantapper_gi20111005.xpi
c:\program files\Brand Affinity Technologies\Fantapper Player\FantapperUpdateService.exe
c:\program files\Brand Affinity Technologies\Fantapper Player\FantapperUpdateService.InstallState
c:\program files\Brand Affinity Technologies\Fantapper Player\FirefoxInstaller.dll
c:\program files\Brand Affinity Technologies\Fantapper Player\FirefoxInstaller.InstallState
c:\program files\Brand Affinity Technologies\Fantapper Player\FT_Enabled.ico
c:\program files\Brand Affinity Technologies\Fantapper Player\FT_Plugin_Installer.jpg
c:\program files\Brand Affinity Technologies\Fantapper Player\IEInstaller.dll
c:\program files\Brand Affinity Technologies\Fantapper Player\OpenIE.dll
c:\program files\Internet Explorer\SET742.tmp
c:\program files\Internet Explorer\SET743.tmp
c:\program files\Internet Explorer\SET744.tmp
c:\program files\Internet Explorer\SET7F0.tmp
c:\program files\Internet Explorer\SET7F1.tmp
c:\program files\Internet Explorer\SET7F2.tmp
c:\program files\Internet Explorer\SET81F.tmp
c:\program files\Internet Explorer\SET820.tmp
c:\program files\Internet Explorer\SET821.tmp
c:\program files\Internet Explorer\SET857.tmp
c:\program files\Internet Explorer\SET858.tmp
c:\program files\Internet Explorer\SET859.tmp
c:\program files\Internet Explorer\SET880.tmp
c:\program files\Internet Explorer\SET881.tmp
c:\program files\Internet Explorer\SET882.tmp
c:\program files\Object
c:\program files\Object\config.ini
c:\program files\Object\enable.txt
c:\program files\Object\facetheme\build.sh
c:\program files\Object\facetheme\chrome.manifest
c:\program files\Object\facetheme\config_build.sh
c:\program files\Object\facetheme\content\.DS_Store
c:\program files\Object\facetheme\content\firefoxOverlay.xul
c:\program files\Object\facetheme\content\installid.js
c:\program files\Object\facetheme\content\overlay.js
c:\program files\Object\facetheme\content\sudoku.js
c:\program files\Object\facetheme\defaults\.DS_Store
c:\program files\Object\facetheme\defaults\preferences\._sudoku.js
c:\program files\Object\facetheme\defaults\preferences\.DS_Store
c:\program files\Object\facetheme\defaults\preferences\sudoku.js
c:\program files\Object\facetheme\files
c:\program files\Object\facetheme\install.rdf
c:\program files\Object\facetheme\locale\.DS_Store
c:\program files\Object\facetheme\locale\en-US\.DS_Store
c:\program files\Object\facetheme\locale\en-US\sudoku.dtd
c:\program files\Object\facetheme\locale\en-US\sudoku.properties
c:\program files\Object\facetheme\readme.txt
c:\program files\Object\facetheme\skin\overlay.css
c:\program files\Object\status.txt
c:\program files\Object\status2.txt
c:\program files\Object\status3.txt
c:\program files\Object\status4.txt
c:\windows\$NtUninstallKB8372$\2274600743\@
c:\windows\$NtUninstallKB8372$\2274600743\bckfg.tmp
c:\windows\$NtUninstallKB8372$\2274600743\cfg.ini
c:\windows\$NtUninstallKB8372$\2274600743\Desktop.ini
c:\windows\$NtUninstallKB8372$\2274600743\keywords
c:\windows\$NtUninstallKB8372$\2274600743\kwrd.dll
c:\windows\$NtUninstallKB8372$\2274600743\L\akygdmgo
c:\windows\$NtUninstallKB8372$\2274600743\lsflt7.ver
c:\windows\$NtUninstallKB8372$\2274600743\oemid
c:\windows\$NtUninstallKB8372$\2274600743\U\00000001.@
c:\windows\$NtUninstallKB8372$\2274600743\U\00000002.@
c:\windows\$NtUninstallKB8372$\2274600743\U\00000004.@
c:\windows\$NtUninstallKB8372$\2274600743\U\80000000.@
c:\windows\$NtUninstallKB8372$\2274600743\U\80000004.@
c:\windows\$NtUninstallKB8372$\2274600743\U\80000032.@
c:\windows\$NtUninstallKB8372$\2274600743\version
c:\windows\$NtUninstallKB8372$\4092227533
c:\windows\system32\Cache
c:\windows\system32\Cache\0a49bc3dbbcc0641.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\3f08882fa2a48543.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\dds_trash_log.cmd
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\dllcache\wmpvis.dll
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\Packet.dll
c:\windows\system32\wpcap.dll
c:\windows\$NtUninstallKB8372$ . . . . Failed to delete
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_NPF
——-\Service_NPF
——-\Legacy_FTSvc
——-\Legacy_FTSvc
——-\Service_FTSvc
——-\Service_FTSvc
.
.
((((((((((((((((((((((((( Files Created from 2012-04-07 to 2012-05-07 )))))))))))))))))))))))))))))))
.
.
2012-05-07 22:40 . 2008-04-13 18:36 187776 —-a-w- c:\windows\system32\drivers\acpi.sys
2012-05-02 03:05 . 2012-05-02 03:05 1324 —-a-w- c:\documents and settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\d3d9caps.tmp
2012-04-27 23:58 . 2012-04-27 23:58 ——– d—–w- c:\documents and settings\Ken.KENSCOMPUTER\Local Settings\Application Data\Help
2012-04-27 20:33 . 2011-09-23 04:28 134104 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-04-27 20:33 . 2011-09-23 04:28 719832 —-a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2012-04-27 20:33 . 2011-09-23 04:28 715736 —-a-w- c:\program files\Mozilla Firefox\mozcrt19.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 19:07 . 2012-04-04 21:01 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 19:07 . 2011-08-21 18:02 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-23 04:28 . 2012-04-27 20:33 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"="Mixer.exe" [2002-10-16 1818624]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-04-07 417792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...fe70f9bf1" [?]
.
c:\documents and settings\Ken.KENSCOMPUTER\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [1/5/2012 6:22 PM 150856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/4/2012 2:01 PM 257696]
S3 dsiarhwprog;dsiarhwprog;c:\windows\system32\drivers\dsiarhwprog.sys [12/23/2009 1:00 PM 29184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
vmauthdservice
smartscaps
pav_service
DCamUSBGrandTek
spcflt
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 19:07]
.
2012-05-07 c:\windows\Tasks\User_Feed_Synchronization-{168FC4ED-BC2A-4CA7-BBA6-9475F500336D}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Ken.KENSCOMPUTER\Application Data\Mozilla\Firefox\Profiles\36a57sz9.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B6769e734-6725-442f-9bdf-7c69f859f1ba%7D&mid=3d0d8e7ad9e647d19a93d14d1c978d9b-dab3fd35dbbe67f699e0cb7c8077504fe70f9bf1&ds=AVG&v=9.0.0.22&lang=en&pr=pr&d=2011-10-12%2018%3A54%3A36&sap=ku&q=
user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);FF - user.js: extentions.y2layers.installId - 7396ecbf-66fb-4de8-9619-c71d1f173c5b
FF - user.js: extentions.y2layers.defaultEnableAppsList - bestvideodownloader,ezLooker,pagerage,buzzdock,toprelatedtopics,twittube
FF - user.js: extensions.autoDisableScopes - 14
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{27a220b7-bb43-4faf-b27b-f803d18eea28} - (no file)
BHO-{9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
BHO-{FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - (no file)
Toolbar-Locked - (no file)
Toolbar-{9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
HKLM-Run-Spybot-S&D Cleaning - c:\program files\Spybot - Search & Destroy 2\SDCleaner.exe
HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil10v_ActiveX.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-07 16:17
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,80,f4,38,8b,99,89,85,40,b4,ec,ea,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,80,f4,38,8b,99,89,85,40,b4,ec,ea,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2320)
c:\windows\system32\WININET.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\rundll32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\Mixer.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Completion time: 2012-05-07 16:24:12 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-07 23:24
.
Pre-Run: 135,351,681,024 bytes free
Post-Run: 135,735,664,640 bytes free
.
- - End Of File - - B7CE900461AB8B2ABFB04CB7BD07CDF0

Attachments:

Post #10
Good Job Kenny :thumbup:

A lot of bad stuff was removed but there may be more hiding, so lets do this.


You need to enable windows to show all files and folders, instructions Here

Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, if it says this file has been checked before, have them recheck it. When the scan is done just copy and paste the link back to this forum for me to see.

c:\windows\system32\drivers\acpi.sys <–This file

If the site is busy you can try this one
http://virusscan.jotti.org/en





Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please
Post #11
Still with me Kenny, You can forget about checking that file, its ok but you need to download , install and run Malwarebytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI