Spyware / Malware / Virus Removal

need to find out if infected [Solved]

10 min read

Looking for the outcome? Ask AI

es4245 Topic Starter

Post #1August 16, 2012, 12:29 AM UTC

Can you please check out my log file. Someone has gotten my bank card number and been trying to use it. I want to try and find out if there is something on my machine or if they got it elsewhere.
Thank you for your help
Ed

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:41:20 PM, on 8/15/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe
C:\Program Files\Google\Update\1.3.21.115\GoogleCrashHandler.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Traysoft\PhoneTray\PhoneTray.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\program files\real\realone player\update\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Owner\My Documents\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT3131886
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\19.8.0.14\IPS\IPSBHO.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O2 - BHO: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\21.0.1180.79\npchrome_frame.dll
O2 - BHO: AlxHelper - {F443A627-5009-4323-9C1D-7FD598D0D712} - C:\Program Files\Amazon Browser Bar\AmazonBrowserBar.3.0.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Amazon Browser Bar - {EA582743-9076-4178-9AA6-7393FDF4D5CE} - C:\Program Files\Amazon Browser Bar\AmazonBrowserBar.3.0.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Freecorder FLV Service] "C:\Program Files\Freecorder\FLVSrvc.exe" /run
O4 - HKLM\..\Run: [TkBellExe] "C:\program files\real\realone player\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil11g_ActiveX.exe -update activex (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil11g_ActiveX.exe -update activex (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O18 - Protocol: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\21.0.1180.79\npchrome_frame.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: PhoneTray - Unknown owner - C:\Program Files\Traysoft\PhoneTray\PhoneTray.exe

–
End of file - 8934 bytes

NoodleTech

Post #2August 16, 2012, 10:40 PM UTC

Hi Ed,

My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
The fixes are specific to your problem and should only be used for the issues on this machine.
Do not delete anything unless instructed to.
DO NOT use tools such as ComboFix without supervision.
Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.

===================================================

Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

===================================================

Please download aswMBR.exe and save it to your desktop.

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan

Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat.
Right click that file and select Send To>Compressed (zipped) file.
Attach that zipped file in your next reply as well.

es4245

Post #3August 17, 2012, 2:53 AM UTC

First off I want to thank you for your help. I did have trouble running the aswMBR test. That one seemed to freeze about 15 minutes into the test. I let it run for about an hour and a half at the point that it stopped. I have included what I got. . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.5.1 Run by [removed] at 18:04:37 on 2012-08-16 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1016.653 [GMT -5:00] . AV: Norton AntiVirus Online *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe C:\Program Files\Google\Update\1.3.21.115\GoogleCrashHandler.exe C:\Program Files\Softex\OmniPass\Omniserv.exe C:\Program Files\Traysoft\PhoneTray\PhoneTray.exe C:\Program Files\Softex\OmniPass\OPXPApp.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\hphmon05.exe C:\HP\KBD\KBD.EXE C:\program files\real\realone player\update\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3131886 uSearch Page = hxxp://srch-us9.hpwis.com/ uDefault_Page_URL = hxxp://us9.hpwis.com/ uDefault_Search_URL = hxxp://srch-us9.hpwis.com/ uSearch Bar = hxxp://srch-us9.hpwis.com/ mSearch Bar = hxxp://srch-us9.hpwis.com/ uInternet Settings,ProxyOverride = localhost;*.local BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: Norton Vulnerability Protection: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton antivirus\engine\19.8.0.14\ips\IPSBHO.DLL BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll BHO: ChromeFrame BHO: {ecb3c477-1a0a-44bd-bb57-78f9efe34fa7} - c:\program files\google\chrome frame\application\21.0.1180.79\npchrome_frame.dll BHO: AlxHelper Class: {f443a627-5009-4323-9c1d-7fd598d0d712} - c:\program files\amazon browser bar\AmazonBrowserBar.3.0.dll TB: HP View: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hewlett-packard\digital imaging\bin\hpdtlk02.dll TB: Amazon Browser Bar: {ea582743-9076-4178-9aa6-7393fdf4d5ce} - c:\program files\amazon browser bar\AmazonBrowserBar.3.0.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File EB: {8F4902B6-6C04-4ade-8052-AA58578A21BD} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [BackupNotify] c:\program files\hewlett-packard\digital imaging\bin\backupnotify.exe uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [CamMonitor] c:\program files\hewlett-packard\digital imaging\\unload\hpqcmon.exe mRun: [HPHUPD05] c:\program files\hewlett-packard\{45b6180b-dcab-4093-8ee8-6164457517f0}\hphupd05.exe mRun: [HPHmon05] c:\windows\system32\hphmon05.exe mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [StorageGuard] "c:\program files\common files\sonic\update manager\sgtray.exe" /r mRun: [AutoTKit] c:\hp\bin\AUTOTKIT.EXE mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect mRun: [PS2] c:\windows\system32\ps2.exe mRun: [AlcxMonitor] ALCXMNTR.EXE mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [Freecorder FLV Service] "c:\program files\freecorder\FLVSrvc.exe" /run mRun: [TkBellExe] "c:\program files\real\realone player\update\realsched.exe" -osboot mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil11g_ActiveX.exe -update activex IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1330821282515 DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{1C0AC137-21CB-4F29-A92D-A6A5D9EB06FB} : DhcpNameServer = 192.168.1.1 Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome frame\application\21.0.1180.79\npchrome_frame.dll Notify: igfxcui - igfxsrvc.dll Notify: OPXPGina - c:\program files\softex\omnipass\opxpgina.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\2o7f3fwa.default user 2\ FF - prefs.js: browser.startup.homepage - hxxp://www.usatoday.com/ FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_19.1.0.28\ipsffplgn\components\IPSFFPl.dll FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll FF - plugin: c:\program files\oracle\javafx 2.1 runtime\bin\plugin2\npjp2.dll FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realone player\netscape6\nprpplugin.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_270.dll FF - plugin: c:\windows\system32\npDeployJava1.dll FF - plugin: c:\windows\system32\npptools.dll . ============= SERVICES / DRIVERS =============== . R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nav\1308000.00e\symds.sys [2012-8-14 340088] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nav\1308000.00e\symefa.sys [2012-8-14 924320] R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_19.1.0.28\definitions\bashdefs\20120811.003\BHDrvx86.sys [2012-8-10 995488] R1 ccSet_NAV;Norton AntiVirus Settings Manager;c:\windows\system32\drivers\nav\1308000.00e\ccsetx86.sys [2012-8-14 132768] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nav\1308000.00e\ironx86.sys [2012-8-14 149624] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-3-6 652360] R2 NAV;Norton AntiVirus;c:\program files\norton antivirus\engine\19.8.0.14\ccsvchst.exe [2012-8-14 138272] R2 PhoneTray;PhoneTray;c:\program files\traysoft\phonetray\phonetray.exe -startservice –> c:\program files\traysoft\phonetray\PhoneTray.exe -StartService [?] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-8-9 106656] R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_19.1.0.28\definitions\ipsdefs\20120815.002\IDSXpx86.sys [2012-8-15 369632] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-3-6 20464] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_19.1.0.28\definitions\virusdefs\20120816.002\NAVENG.SYS [2012-8-16 87928] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_19.1.0.28\definitions\virusdefs\20120816.002\NAVEX15.SYS [2012-8-16 1589752] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-3-4 136176] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-3-4 136176] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-5-5 113120] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2012-08-15 02:34:18 388216 —-a-w- c:\windows\system32\drivers\nav\1308000.00e\symtdi.sys 2012-08-15 02:34:18 345208 —-a-w- c:\windows\system32\drivers\nav\1308000.00e\symtdiv.sys 2012-08-15 02:34:18 318584 —-a-w- c:\windows\system32\drivers\nav\1308000.00e\symnets.sys 2012-08-15 02:34:17 924320 —-a-w- c:\windows\system32\drivers\nav\1308000.00e\symefa.sys 2012-08-15 02:34:17 574112 —-a-w- c:\windows\system32\drivers\nav\1308000.00e\srtsp.sys 2012-08-15 02:34:17 340088 —-a-r- c:\windows\system32\drivers\nav\1308000.00e\symds.sys 2012-08-15 02:34:17 32928 —-a-w- c:\windows\system32\drivers\nav\1308000.00e\srtspx.sys 2012-08-15 02:34:17 149624 —-a-w- c:\windows\system32\drivers\nav\1308000.00e\ironx86.sys 2012-08-15 02:34:17 132768 —-a-w- c:\windows\system32\drivers\nav\1308000.00e\ccsetx86.sys 2012-08-15 02:33:58 8942 —-a-w- c:\windows\system32\drivers\nav\1308000.00e\symvtcer.dat 2012-08-15 02:33:58 ——– d—–w- c:\windows\system32\drivers\nav\1308000.00E 2012-08-14 02:32:58 ——– d—–w- C:\old tax returns 2012-08-11 02:46:52 ——– d—–w- c:\documents and settings\owner\local settings\application data\CRE 2012-08-06 23:57:01 ——– d—–w- c:\program files\Oracle 2012-08-06 23:56:45 143872 —-a-w- c:\windows\system32\javacpl.cpl 2012-08-01 02:35:45 21504 -c–a-w- c:\windows\system32\dllcache\hidserv.dll 2012-08-01 02:35:45 21504 —-a-w- c:\windows\system32\hidserv.dll 2012-08-01 02:35:25 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys 2012-08-01 02:35:25 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys 2012-08-01 02:35:22 14592 -c–a-w- c:\windows\system32\dllcache\kbdhid.sys 2012-08-01 02:35:22 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys 2012-08-01 02:35:07 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys 2012-08-01 02:35:07 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys 2012-07-28 21:17:53 ——– d—–w- c:\documents and settings\owner\local settings\application data\Identities 2012-07-27 20:51:30 184248 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll . ==================== Find3M ==================== . 2012-08-04 15:29:15 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-08-04 15:29:15 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-07-06 13:58:51 78336 —-a-w- c:\windows\system32\browser.dll 2012-07-06 03:06:30 772544 —-a-w- c:\windows\system32\npDeployJava1.dll 2012-07-06 03:06:20 687544 —-a-w- c:\windows\system32\deployJava1.dll 2012-07-04 14:05:18 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-07-03 13:40:15 1866112 —-a-w- c:\windows\system32\win32k.sys 2012-07-02 17:49:33 916992 —-a-w- c:\windows\system32\wininet.dll 2012-07-02 17:49:32 43520 —-a-w- c:\windows\system32\licmgr10.dll 2012-07-02 17:49:32 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2012-07-02 12:05:43 385024 —-a-w- c:\windows\system32\html.iec 2012-06-05 15:50:25 1372672 ——w- c:\windows\system32\msxml6.dll 2012-06-05 15:50:25 1172480 —-a-w- c:\windows\system32\msxml3.dll 2012-06-04 04:32:08 152576 —-a-w- c:\windows\system32\schannel.dll 2012-06-02 20:19:44 22040 —-a-w- c:\windows\system32\wucltui.dll.mui 2012-06-02 20:19:38 219160 —-a-w- c:\windows\system32\wuaucpl.cpl 2012-06-02 20:19:38 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui 2012-06-02 20:19:34 15384 —-a-w- c:\windows\system32\wuapi.dll.mui 2012-06-02 20:19:30 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui 2012-06-02 20:18:58 275696 —-a-w- c:\windows\system32\mucltui.dll 2012-06-02 20:18:58 214256 —-a-w- c:\windows\system32\muweb.dll 2012-06-02 20:18:58 17136 —-a-w- c:\windows\system32\mucltui.dll.mui 2012-05-31 13:22:09 599040 —-a-w- c:\windows\system32\crypt32.dll . ============= FINISH: 18:05:37.07 =============== aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-08-16 19:51:00 —————————– 19:51:00.046 OS Version: Windows 5.1.2600 Service Pack 3 19:51:00.062 Number of processors: 1 586 0x209 19:51:00.062 ComputerName: YOUR-XHTR8HVC4P UserName: Owner 19:51:03.156 Initialize success 19:51:22.734 AVAST engine defs: 12081601 19:52:25.203 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 19:52:25.203 Disk 0 Vendor: WDC_WD2500JB-00REA0 20.00K20 Size: 238475MB BusType: 3 19:52:25.234 Disk 0 MBR read successfully 19:52:25.234 Disk 0 MBR scan 19:52:25.296 Disk 0 unknown MBR code 19:52:25.312 Disk 0 Partition 1 00 0B FAT32 RECOVERY 5426 MB offset 63 19:52:25.328 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 233038 MB offset 11113200 19:52:25.343 Disk 0 scanning sectors +488376000 19:52:25.421 Disk 0 scanning C:\WINDOWS\system32\drivers 19:52:46.265 Service scanning 19:53:12.203 Modules scanning 19:53:19.546 Disk 0 trace - called modules: 19:53:19.578 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys PCIIDEX.SYS 19:53:19.921 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861faab8] 19:53:19.921 3 CLASSPNP.SYS[f74c7fd7] -> nt!IofCallDriver -> \Device\00000062[0x86200f18] 19:53:19.937 5 ACPI.sys[f743e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x861fd940] 19:53:20.578 AVAST engine scan C:\WINDOWS 19:53:33.593 AVAST engine scan C:\WINDOWS\system32 19:59:14.140 AVAST engine scan C:\WINDOWS\system32\drivers 19:59:54.437 AVAST engine scan C:\Documents and Settings\Owner 21:25:31.000 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Owner\Desktop\MBR.dat" 21:25:31.296 The log file has been saved successfully to "C:\Documents and Settings\Owner\Desktop\aswMBR.txt"

Attachments:

NoodleTech

Post #4August 17, 2012, 6:32 AM UTC

Hi Ed,

You are very welcome :).

Next, Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to our sticky topic How to disable your security applications

====================================================

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

es4245

Post #5August 17, 2012, 11:56 PM UTC

NoodleTech, Here are the results from the combo fix scan:

ComboFix 12-08-17.03 - Owner 08/17/2012 18:18:52.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1016.496 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton AntiVirus Online *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\Owner\Application Data\PriceGong
c:\documents and settings\Owner\Application Data\PriceGong\Data\1.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\a.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\b.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\c.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\d.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\e.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\f.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\g.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\h.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\i.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\j.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\k.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\l.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\m.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Owner\Application Data\PriceGong\Data\n.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\o.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\p.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\q.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\r.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\s.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\t.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\u.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\v.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\w.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\wlu.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\x.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\y.txt
c:\documents and settings\Owner\Application Data\PriceGong\Data\z.txt
c:\documents and settings\Owner\WINDOWS
c:\windows\dasetup.log
c:\windows\help\wmplayer.bak
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\ps2.bat
c:\windows\system32\SET229.tmp
c:\windows\system32\SET22E.tmp
c:\windows\system32\SET78.tmp
c:\windows\system32\SET7A.tmp
c:\windows\system32\SET88.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
D:\Autorun.inf
.
.
((((((((((((((((((((((((( Files Created from 2012-07-17 to 2012-08-17 )))))))))))))))))))))))))))))))
.
.
2012-08-15 02:33 . 2012-08-15 18:55 ——– d—–w- c:\windows\system32\drivers\NAV\1308000.00E
2012-08-14 02:32 . 2012-08-14 02:34 ——– d—–w- C:\old tax returns
2012-08-12 15:04 . 2012-08-12 15:07 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2012-08-11 02:46 . 2012-08-11 02:46 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\CRE
2012-08-06 23:57 . 2012-08-06 23:57 ——– d—–w- c:\program files\Oracle
2012-08-06 23:56 . 2012-08-06 23:56 ——– d—–w- c:\documents and settings\Owner\Application Data\Oracle
2012-08-06 23:56 . 2012-07-06 03:07 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-08-06 23:52 . 2012-08-06 23:52 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2012-08-01 02:35 . 2008-04-14 10:41 21504 -c–a-w- c:\windows\system32\dllcache\hidserv.dll
2012-08-01 02:35 . 2008-04-14 10:41 21504 —-a-w- c:\windows\system32\hidserv.dll
2012-08-01 02:35 . 2001-08-17 18:48 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2012-08-01 02:35 . 2001-08-17 18:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2012-08-01 02:35 . 2008-04-14 05:09 14592 -c–a-w- c:\windows\system32\dllcache\kbdhid.sys
2012-08-01 02:35 . 2008-04-14 05:09 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2012-08-01 02:35 . 2008-04-14 05:15 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2012-08-01 02:35 . 2008-04-14 05:15 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2012-07-28 21:17 . 2012-07-28 21:17 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Identities
2012-07-27 20:51 . 2012-07-27 20:51 184248 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-04 15:29 . 2012-03-31 19:24 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-04 15:29 . 2012-03-04 14:25 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-06 13:58 . 2012-02-26 20:19 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-06 03:06 . 2012-06-17 04:19 772544 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-07-06 03:06 . 2012-03-04 13:41 687544 —-a-w- c:\windows\system32\deployJava1.dll
2012-07-04 14:05 . 2012-02-26 20:27 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2012-02-26 20:28 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2012-02-26 20:28 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2012-02-26 20:26 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2012-02-26 20:26 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2012-03-03 22:56 385024 —-a-w- c:\windows\system32\html.iec
2012-06-05 15:50 . 2012-03-03 23:49 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2012-02-26 20:27 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2012-02-26 20:27 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 20:19 . 2012-03-04 00:35 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 20:19 . 2012-03-04 00:35 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 20:19 . 2012-03-03 22:56 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 20:19 . 2012-03-03 22:56 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 20:19 . 2012-03-03 22:56 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 20:19 . 2012-03-04 00:35 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 20:19 . 2012-03-04 00:35 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 20:19 . 2012-03-03 22:56 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 20:19 . 2012-02-26 20:28 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 20:19 . 2012-02-26 20:25 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 20:19 . 2012-03-04 00:35 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 20:19 . 2012-03-03 22:56 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 20:19 . 2012-02-26 20:28 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 20:18 . 2012-05-02 01:17 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-06-02 20:18 . 2012-05-02 01:17 214256 —-a-w- c:\windows\system32\muweb.dll
2012-06-02 20:18 . 2012-05-02 01:17 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2012-02-26 20:25 599040 —-a-w- c:\windows\system32\crypt32.dll
2012-07-17 23:24 . 2012-03-03 22:32 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F443A627-5009-4323-9C1D-7FD598D0D712}]
2012-05-10 00:05 1607472 —-a-w- c:\program files\Amazon Browser Bar\AmazonBrowserBar.3.0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EA582743-9076-4178-9AA6-7393FDF4D5CE}"= "c:\program files\Amazon Browser Bar\AmazonBrowserBar.3.0.dll" [2012-05-10 1607472]
.
[HKEY_CLASSES_ROOT\clsid\{ea582743-9076-4178-9aa6-7393fdf4d5ce}]
[HKEY_CLASSES_ROOT\TypeLib\{33D0AD98-3347-4A54-8929-5163EBEB9F72}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\program files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-23 24576]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 90112]
"HPHUPD05"="c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 49152]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"AutoTKit"="c:\hp\bin\AUTOTKIT.EXE" [2003-06-19 53248]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"nwiz"="nwiz.exe" [2003-05-03 323584]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"TkBellExe"="c:\program files\real\realone player\update\realsched.exe" [2012-06-18 296056]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-08 421776]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil11g_ActiveX.exe" [2012-03-11 250528]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2003-6-18 53248]
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 —-a-w- c:\program files\Softex\OmniPass\OPXPGina.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1308000.00E\symds.sys [8/14/2012 9:34 PM 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1308000.00E\symefa.sys [8/14/2012 9:34 PM 924320]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\BASHDefs\20120811.003\BHDrvx86.sys [8/10/2012 7:25 PM 995488]
R1 ccSet_NAV;Norton AntiVirus Settings Manager;c:\windows\system32\drivers\NAV\1308000.00E\ccsetx86.sys [8/14/2012 9:34 PM 132768]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1308000.00E\ironx86.sys [8/14/2012 9:34 PM 149624]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [3/6/2012 6:37 PM 652360]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\19.8.0.14\ccsvchst.exe [8/14/2012 9:34 PM 138272]
R2 PhoneTray;PhoneTray;c:\program files\Traysoft\PhoneTray\PhoneTray.exe -StartService –> c:\program files\Traysoft\PhoneTray\PhoneTray.exe -StartService [?]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/9/2012 5:17 AM 106656]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\IPSDefs\20120817.001\IDSXpx86.sys [8/17/2012 4:13 PM 369632]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [3/6/2012 6:37 PM 20464]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3/4/2012 8:28 AM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/4/2012 8:28 AM 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [5/5/2012 9:20 AM 113120]
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 23:57]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-04 13:28]
.
2012-08-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-04 13:28]
.
2012-08-17 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-924828991-3198225323-34293018-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-08-17 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-924828991-3198225323-34293018-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3131886
uDefault_Search_URL = hxxp://srch-us9.hpwis.com/
mSearch Bar = hxxp://srch-us9.hpwis.com/
uInternet Settings,ProxyOverride = localhost;*.local
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\2o7f3fwa.Default User 2\
FF - prefs.js: browser.startup.homepage - hxxp://www.usatoday.com/
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-Freecorder FLV Service - c:\program files\Freecorder\FLVSrvc.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-17 18:41
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\19.8.0.14\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bd,6c,a9,ab,88,f6,19,40,a7,6e,6d,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bd,6c,a9,ab,88,f6,19,40,a7,6e,6d,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(544)
c:\program files\Softex\OmniPass\opxpgina.dll
.
Completion time: 2012-08-17 18:46:52
ComboFix-quarantined-files.txt 2012-08-17 23:46
.
Pre-Run: 145,800,888,320 bytes free
Post-Run: 148,790,530,048 bytes free
.
- - End Of File - - A4CE1F961CFC730FF6B3CF0CEEA49F81

Thanks,
Ed

NoodleTech

Post #6August 18, 2012, 6:38 AM UTC

Hi Ed,

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

DDS::
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3131886
uDefault_Search_URL = hxxp://srch-us9.hpwis.com/
mSearch Bar = hxxp://srch-us9.hpwis.com/

Registry::
[-HKEY_CLASSES_ROOT\clsid\{ea582743-9076-4178-9aa6-7393fdf4d5ce}]
[-HKEY_CLASSES_ROOT\TypeLib\{33D0AD98-3347-4A54-8929-5163EBEB9F72}]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

es4245

Post #7August 18, 2012, 5:54 PM UTC

Noodle Tech, here are the new results from combo fix:

ComboFix 12-08-17.03 - Owner 08/18/2012 12:20:13.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1016.558 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Norton AntiVirus Online *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\dllcache\wmpvis.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-07-18 to 2012-08-18 )))))))))))))))))))))))))))))))
.
.
2012-08-15 02:33 . 2012-08-15 18:55 ——– d—–w- c:\windows\system32\drivers\NAV\1308000.00E
2012-08-14 02:32 . 2012-08-14 02:34 ——– d—–w- C:\old tax returns
2012-08-12 15:04 . 2012-08-12 15:07 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2012-08-11 02:46 . 2012-08-11 02:46 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\CRE
2012-08-06 23:57 . 2012-08-06 23:57 ——– d—–w- c:\program files\Oracle
2012-08-06 23:56 . 2012-08-06 23:56 ——– d—–w- c:\documents and settings\Owner\Application Data\Oracle
2012-08-06 23:56 . 2012-07-06 03:07 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-08-06 23:52 . 2012-08-06 23:52 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2012-08-01 02:35 . 2008-04-14 10:41 21504 -c–a-w- c:\windows\system32\dllcache\hidserv.dll
2012-08-01 02:35 . 2008-04-14 10:41 21504 —-a-w- c:\windows\system32\hidserv.dll
2012-08-01 02:35 . 2001-08-17 18:48 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2012-08-01 02:35 . 2001-08-17 18:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2012-08-01 02:35 . 2008-04-14 05:09 14592 -c–a-w- c:\windows\system32\dllcache\kbdhid.sys
2012-08-01 02:35 . 2008-04-14 05:09 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2012-08-01 02:35 . 2008-04-14 05:15 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2012-08-01 02:35 . 2008-04-14 05:15 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2012-07-28 21:17 . 2012-07-28 21:17 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Identities
2012-07-27 20:51 . 2012-07-27 20:51 184248 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-04 15:29 . 2012-03-31 19:24 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-04 15:29 . 2012-03-04 14:25 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-06 13:58 . 2012-02-26 20:19 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-06 03:06 . 2012-06-17 04:19 772544 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-07-06 03:06 . 2012-03-04 13:41 687544 —-a-w- c:\windows\system32\deployJava1.dll
2012-07-04 14:05 . 2012-02-26 20:27 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2012-02-26 20:28 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2012-02-26 20:28 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2012-02-26 20:26 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2012-02-26 20:26 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2012-03-03 22:56 385024 —-a-w- c:\windows\system32\html.iec
2012-06-05 15:50 . 2012-03-03 23:49 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2012-02-26 20:27 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2012-02-26 20:27 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 20:19 . 2012-03-04 00:35 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 20:19 . 2012-03-04 00:35 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 20:19 . 2012-03-03 22:56 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 20:19 . 2012-03-03 22:56 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 20:19 . 2012-03-03 22:56 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 20:19 . 2012-03-04 00:35 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 20:19 . 2012-03-04 00:35 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 20:19 . 2012-03-03 22:56 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 20:19 . 2012-02-26 20:28 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 20:19 . 2012-02-26 20:25 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 20:19 . 2012-03-04 00:35 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 20:19 . 2012-03-03 22:56 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 20:19 . 2012-02-26 20:28 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 20:18 . 2012-05-02 01:17 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-06-02 20:18 . 2012-05-02 01:17 214256 —-a-w- c:\windows\system32\muweb.dll
2012-06-02 20:18 . 2012-05-02 01:17 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2012-02-26 20:25 599040 —-a-w- c:\windows\system32\crypt32.dll
2012-07-17 23:24 . 2012-03-03 22:32 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-17_23.41.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-08-18 10:36 . 2012-08-18 10:36 16384 c:\windows\Temp\Perflib_Perfdata_7e0.dat
+ 2012-08-18 10:33 . 2012-08-18 10:33 16384 c:\windows\Temp\Perflib_Perfdata_798.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F443A627-5009-4323-9C1D-7FD598D0D712}]
2012-05-10 00:05 1607472 —-a-w- c:\program files\Amazon Browser Bar\AmazonBrowserBar.3.0.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\program files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-23 24576]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 90112]
"HPHUPD05"="c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 49152]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"AutoTKit"="c:\hp\bin\AUTOTKIT.EXE" [2003-06-19 53248]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"nwiz"="nwiz.exe" [2003-05-03 323584]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"TkBellExe"="c:\program files\real\realone player\update\realsched.exe" [2012-06-18 296056]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-08 421776]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil11g_ActiveX.exe" [2012-03-11 250528]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2003-6-18 53248]
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 —-a-w- c:\program files\Softex\OmniPass\OPXPGina.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1308000.00E\symds.sys [8/14/2012 9:34 PM 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1308000.00E\symefa.sys [8/14/2012 9:34 PM 924320]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\BASHDefs\20120811.003\BHDrvx86.sys [8/10/2012 7:25 PM 995488]
R1 ccSet_NAV;Norton AntiVirus Settings Manager;c:\windows\system32\drivers\NAV\1308000.00E\ccsetx86.sys [8/14/2012 9:34 PM 132768]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1308000.00E\ironx86.sys [8/14/2012 9:34 PM 149624]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [3/6/2012 6:37 PM 652360]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\19.8.0.14\ccsvchst.exe [8/14/2012 9:34 PM 138272]
R2 PhoneTray;PhoneTray;c:\program files\Traysoft\PhoneTray\PhoneTray.exe -StartService –> c:\program files\Traysoft\PhoneTray\PhoneTray.exe -StartService [?]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/9/2012 5:17 AM 106656]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\IPSDefs\20120817.001\IDSXpx86.sys [8/17/2012 4:13 PM 369632]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [3/6/2012 6:37 PM 20464]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3/4/2012 8:28 AM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/4/2012 8:28 AM 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [5/5/2012 9:20 AM 113120]
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 23:57]
.
2012-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-04 13:28]
.
2012-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-04 13:28]
.
2012-08-18 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-924828991-3198225323-34293018-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-08-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-924828991-3198225323-34293018-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = localhost;*.local
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\kwmm03vn.Brandi\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3131886&SearchSource=2&q=
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{EA582743-9076-4178-9AA6-7393FDF4D5CE} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-18 12:41
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\19.8.0.14\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bd,6c,a9,ab,88,f6,19,40,a7,6e,6d,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bd,6c,a9,ab,88,f6,19,40,a7,6e,6d,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(548)
c:\program files\Softex\OmniPass\opxpgina.dll
.
Completion time: 2012-08-18 12:45:53
ComboFix-quarantined-files.txt 2012-08-18 17:45
ComboFix2.txt 2012-08-17 23:46
.
Pre-Run: 148,548,685,824 bytes free
Post-Run: 148,745,760,768 bytes free
.
- - End Of File - - C563F63A6328FDDC797CF294CDD43972

NoodleTech

Post #8August 19, 2012, 3:53 AM UTC

DDS::
uInternet Settings,ProxyOverride = localhost;*.local

Firefox::
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\kwmm03vn.Brandi\
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3131886&SearchSource=2&q=

es4245

Post #9August 19, 2012, 12:36 PM UTC

Here is the new ComboFix log.
Thanks,
Ed

ComboFix 12-08-18.03 - Owner 08/19/2012 7:04.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1016.487 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Norton AntiVirus Online *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
.
.
((((((((((((((((((((((((( Files Created from 2012-07-19 to 2012-08-19 )))))))))))))))))))))))))))))))
.
.
2012-08-15 02:33 . 2012-08-15 18:55 ——– d—–w- c:\windows\system32\drivers\NAV\1308000.00E
2012-08-14 02:32 . 2012-08-14 02:34 ——– d—–w- C:\old tax returns
2012-08-12 15:04 . 2012-08-12 15:07 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2012-08-11 02:46 . 2012-08-11 02:46 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\CRE
2012-08-06 23:57 . 2012-08-06 23:57 ——– d—–w- c:\program files\Oracle
2012-08-06 23:56 . 2012-08-06 23:56 ——– d—–w- c:\documents and settings\Owner\Application Data\Oracle
2012-08-06 23:56 . 2012-07-06 03:07 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-08-06 23:52 . 2012-08-06 23:52 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2012-08-01 02:35 . 2008-04-14 10:41 21504 -c–a-w- c:\windows\system32\dllcache\hidserv.dll
2012-08-01 02:35 . 2008-04-14 10:41 21504 —-a-w- c:\windows\system32\hidserv.dll
2012-08-01 02:35 . 2001-08-17 18:48 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2012-08-01 02:35 . 2001-08-17 18:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2012-08-01 02:35 . 2008-04-14 05:09 14592 -c–a-w- c:\windows\system32\dllcache\kbdhid.sys
2012-08-01 02:35 . 2008-04-14 05:09 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2012-08-01 02:35 . 2008-04-14 05:15 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2012-08-01 02:35 . 2008-04-14 05:15 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2012-07-28 21:17 . 2012-07-28 21:17 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Identities
2012-07-27 20:51 . 2012-07-27 20:51 184248 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-04 15:29 . 2012-03-31 19:24 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-04 15:29 . 2012-03-04 14:25 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-06 13:58 . 2012-02-26 20:19 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-06 03:06 . 2012-06-17 04:19 772544 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-07-06 03:06 . 2012-03-04 13:41 687544 —-a-w- c:\windows\system32\deployJava1.dll
2012-07-04 14:05 . 2012-02-26 20:27 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2012-02-26 20:28 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2012-02-26 20:28 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2012-02-26 20:26 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2012-02-26 20:26 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2012-03-03 22:56 385024 —-a-w- c:\windows\system32\html.iec
2012-06-05 15:50 . 2012-03-03 23:49 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2012-02-26 20:27 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2012-02-26 20:27 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 20:19 . 2012-03-04 00:35 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 20:19 . 2012-03-04 00:35 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 20:19 . 2012-03-03 22:56 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 20:19 . 2012-03-03 22:56 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 20:19 . 2012-03-03 22:56 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 20:19 . 2012-03-04 00:35 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 20:19 . 2012-03-04 00:35 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 20:19 . 2012-03-03 22:56 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 20:19 . 2012-02-26 20:28 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 20:19 . 2012-02-26 20:25 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 20:19 . 2012-03-04 00:35 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 20:19 . 2012-03-03 22:56 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 20:19 . 2012-02-26 20:28 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 20:18 . 2012-05-02 01:17 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-06-02 20:18 . 2012-05-02 01:17 214256 —-a-w- c:\windows\system32\muweb.dll
2012-06-02 20:18 . 2012-05-02 01:17 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-05-31 13:22 . 2012-02-26 20:25 599040 —-a-w- c:\windows\system32\crypt32.dll
2012-07-17 23:24 . 2012-03-03 22:32 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-17_23.41.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-08-18 19:38 . 2012-08-18 19:38 16384 c:\windows\Temp\Perflib_Perfdata_7dc.dat
+ 2012-08-18 19:35 . 2012-08-18 19:35 16384 c:\windows\Temp\Perflib_Perfdata_79c.dat
- 2012-08-17 02:36 . 2012-08-17 02:36 16384 c:\windows\Temp\Perflib_Perfdata_79c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F443A627-5009-4323-9C1D-7FD598D0D712}]
2012-05-10 00:05 1607472 —-a-w- c:\program files\Amazon Browser Bar\AmazonBrowserBar.3.0.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackupNotify"="c:\program files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe" [2003-06-23 24576]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 90112]
"HPHUPD05"="c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 49152]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"AutoTKit"="c:\hp\bin\AUTOTKIT.EXE" [2003-06-19 53248]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"nwiz"="nwiz.exe" [2003-05-03 323584]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"TkBellExe"="c:\program files\real\realone player\update\realsched.exe" [2012-06-18 296056]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-08 421776]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil11g_ActiveX.exe" [2012-03-11 250528]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2003-6-18 53248]
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 —-a-w- c:\program files\Softex\OmniPass\OPXPGina.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1308000.00E\symds.sys [8/14/2012 9:34 PM 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1308000.00E\symefa.sys [8/14/2012 9:34 PM 924320]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\BASHDefs\20120811.003\BHDrvx86.sys [8/10/2012 7:25 PM 995488]
R1 ccSet_NAV;Norton AntiVirus Settings Manager;c:\windows\system32\drivers\NAV\1308000.00E\ccsetx86.sys [8/14/2012 9:34 PM 132768]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1308000.00E\ironx86.sys [8/14/2012 9:34 PM 149624]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [3/6/2012 6:37 PM 652360]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\19.8.0.14\ccsvchst.exe [8/14/2012 9:34 PM 138272]
R2 PhoneTray;PhoneTray;c:\program files\Traysoft\PhoneTray\PhoneTray.exe -StartService –> c:\program files\Traysoft\PhoneTray\PhoneTray.exe -StartService [?]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/9/2012 5:17 AM 106656]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.1.0.28\Definitions\IPSDefs\20120817.001\IDSXpx86.sys [8/17/2012 4:13 PM 369632]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [3/6/2012 6:37 PM 20464]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3/4/2012 8:28 AM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/4/2012 8:28 AM 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [5/5/2012 9:20 AM 113120]
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 23:57]
.
2012-08-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-04 13:28]
.
2012-08-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-04 13:28]
.
2012-08-18 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-924828991-3198225323-34293018-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-08-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-924828991-3198225323-34293018-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
.
——- Supplementary Scan ——-
.
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\kwmm03vn.Brandi\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-19 07:26
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\19.8.0.14\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bd,6c,a9,ab,88,f6,19,40,a7,6e,6d,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bd,6c,a9,ab,88,f6,19,40,a7,6e,6d,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(544)
c:\program files\Softex\OmniPass\opxpgina.dll
.
- - - - - - - > 'explorer.exe'(880)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-08-19 07:31:25
ComboFix-quarantined-files.txt 2012-08-19 12:31
ComboFix2.txt 2012-08-18 17:45
ComboFix3.txt 2012-08-17 23:46
.
Pre-Run: 148,754,546,688 bytes free
Post-Run: 148,744,945,664 bytes free
.
- - End Of File - - 52AA45D8AC6B9B234789A1FD99F379CC

NoodleTech

Post #10August 19, 2012, 6:40 PM UTC

Hi Ed,

Please run Malwarebytes' Anti-Malware.

Click the Update tab, then click Check for Updates.
If an update is found, download and install the latest version.
Next, click Scanner, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

===================================================

I need you to run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Do Not place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.

es4245

Post #11August 19, 2012, 11:02 PM UTC

Noodle Tech here are the results for the last two tests. ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=5175b46d10b35c4ba4eb15fb15d304f8 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-08-19 10:45:31 # local_time=2012-08-19 05:45:31 (-0600, Central Daylight Time) # country="United States" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=3584 16777175 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=232346 # found=8 # cleaned=0 # scan_time=6567 C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_001ec9 Win32/Adware.Bundlore application (unable to clean) 00000000000000000000000000000000 I C:\Documents and Settings\Owner\My Documents\Downloads\Tank_-_I_Can't_Make_You_Love_Me_[Official_Music_Video]_-_YouTube.mp3_downloader.exe Win32/InstallCore.K application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP219\A0044238.exe Win32/Adware.Bundlore application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP219\A0044239.exe Win32/Adware.Bundlore application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP219\A0044240.exe Win32/Adware.Bundlore application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP219\A0044241.exe Win32/Adware.Bundlore application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP219\A0044242.exe Win32/Adware.Bundlore application (unable to clean) 00000000000000000000000000000000 I C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP219\A0044243.exe Win32/Adware.Bundlore application (unable to clean) 00000000000000000000000000000000 I Malwarebytes Anti-Malware (Trial) 1.60.1.1000 www.malwarebytes.org Database version: v2012.08.19.06 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Owner :: YOUR-XHTR8HVC4P [administrator] Protection: Disabled 8/19/2012 3:34:08 PM mbam-log-2012-08-19 (15-34-08).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 195903 Time elapsed: 7 minute(s), 39 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Thanks for all your help Ed

NoodleTech

Post #12August 20, 2012, 8:22 AM UTC

Hi Ed,

Your logs appear to be free of malware.

Please delete DDS and aswMBR.

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

===================================================

Here are some tips to reduce the potential for spyware infection in the future:

Updates

It is very important that you keep your Operating System and applications up to date so that you will be less susceptible to malware.
It's a good idea to have Windows Update automatically download and install updates as they become available.
Secunia Online Software Inspector is a great tool that will tell you which of your applications are outdated and vulnerable to attack.

Run Anti-Virus Software

For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.
IMPORTANT! Please make sure you only have ONE firewall and ONE real-time antivirus installed on your system.
When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
Once complete, remember to re-engage your resident security before going online.

Passwords

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection.
Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

Spyware Protection

This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
How to Prevent Malware by miekiemoes
PC Safety and Security–What Do I Need?

Additional Software

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements.
Google Chrome is a great alternative to Internet Explorer and Firefox.

Follow these steps, keep your antivirus program and antispyware programs updated, and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any further questions?

**Please respond one more time to confirm your problem is resolved so I can close this thread.

es4245

Post #13August 20, 2012, 9:13 PM UTC

Thank you for all your help NoodleTech. My computer seems to run quite well. One question thou, when I look at the files eset flagged is there anything that I should do about them? If not then I guess I'am good to go. Once again thanks for your help, Ed

NoodleTech

Post #14August 20, 2012, 9:26 PM UTC

Hi Ed, You are very welcome :). No need to worry about the files ESET found. They are just 3rd party applications bundled with some things you downloaded - not malware.

NoodleTech

Post #15August 24, 2012, 10:33 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

need to find out if infected [Solved]

✨ Ask AI

Ask AI