What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Dads PF usage overflows in NO TIME (Need help) [Solved]

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
It will remove the ones that are infected. I don't know if there are other files there. If there are… they aren't infected and will not be removed.
Post #17
ComboFix 12-08-25.04 - Protoman 08/25/2012 22:20:35.14.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1538 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Protoman\Desktop\CFScript.txt
.
FILE ::
"c:\documents and settings\All Users\Application Data\YouTube Downloader\ytd_installer.exe"
"c:\documents and settings\Protoman\Desktop\Page\Old kof\Botcon2008\index.html"
"c:\documents and settings\Protoman\Desktop\Page\Old kof\default.php"
"c:\documents and settings\Protoman\Desktop\Page\Old kof\iacon\index.html"
"c:\documents and settings\Protoman\Desktop\Page\Old kof\index.html"
"c:\documents and settings\Protoman\Desktop\Page\Old kof\nes\index.html"
"c:\documents and settings\Protoman\Desktop\Page\Old kof\protoman\index.html"
"c:\documents and settings\Protoman\Local Settings\Application Data\{8363DA2C-C976-11E1-8270-B8AC6F996F26}\chrome\content\browser.xul"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\YouTube Downloader\ytd_installer.exe
c:\documents and settings\Protoman\Desktop\Page\Old kof\Botcon2008\index.html
c:\documents and settings\Protoman\Desktop\Page\Old kof\default.php
c:\documents and settings\Protoman\Desktop\Page\Old kof\iacon\index.html
c:\documents and settings\Protoman\Desktop\Page\Old kof\index.html
c:\documents and settings\Protoman\Desktop\Page\Old kof\nes\index.html
c:\documents and settings\Protoman\Desktop\Page\Old kof\protoman\index.html
c:\documents and settings\Protoman\Local Settings\Application Data\{8363DA2C-C976-11E1-8270-B8AC6F996F26}\chrome\content\browser.xul
c:\documents and settings\Protoman\Local Settings\Application Data\{8fbe83f6-cd2a-ea73-912c-8fd940d1935a}
c:\documents and settings\Protoman\Local Settings\Application Data\{8fbe83f6-cd2a-ea73-912c-8fd940d1935a}\@
c:\documents and settings\Protoman\Local Settings\Application Data\{8fbe83f6-cd2a-ea73-912c-8fd940d1935a}\U\80000000.@
.
.
((((((((((((((((((((((((( Files Created from 2012-07-26 to 2012-08-26 )))))))))))))))))))))))))))))))
.
.
2012-07-27 20:51 . 2012-07-27 20:51 184248 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-07-27 20:51 . 2012-07-27 20:51 184248 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-06 13:58 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2005-11-11 22:14 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 17:46 . 2010-08-19 23:20 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 13:40 . 2004-08-04 12:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2004-08-04 12:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2004-08-04 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2004-08-04 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-04 12:00 385024 —-a-w- c:\windows\system32\html.iec
2012-06-29 01:55 . 2012-05-01 23:39 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-29 01:55 . 2011-07-14 15:27 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-29 00:23 . 2012-05-03 00:07 476976 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-06-29 00:23 . 2010-04-29 21:52 472880 —-a-w- c:\windows\system32\deployJava1.dll
2012-06-28 22:50 . 2012-05-03 00:07 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-06-05 15:50 . 2008-07-28 20:58 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 12:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 12:00 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 19:19 . 2007-05-30 18:14 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 19:19 . 2007-05-30 18:14 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 19:19 . 2005-11-11 22:16 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 19:19 . 2005-11-11 22:16 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 19:19 . 2005-11-11 22:16 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 19:19 . 2007-05-30 18:14 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 19:19 . 2005-11-11 22:16 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 19:19 . 2005-11-11 22:16 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 19:19 . 2005-05-26 09:16 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 19:19 . 2004-08-04 12:00 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 19:19 . 2007-05-30 18:14 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 19:19 . 2005-11-11 22:16 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 19:19 . 2005-11-11 22:16 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 19:18 . 2009-07-26 14:31 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 19:18 . 2009-07-26 14:31 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-06-02 19:18 . 2008-10-16 18:07 214256 —-a-w- c:\windows\system32\muweb.dll
2012-05-31 13:22 . 2004-08-04 12:00 599040 —-a-w- c:\windows\system32\crypt32.dll
2008-02-16 09:35 . 2008-02-16 09:35 2293848 —-a-w- c:\program files\FLV PlayerFCSetup.exe
2004-03-11 18:27 . 2005-11-12 14:12 40960 —-a-w- c:\program files\Uninstall_CDS.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-24_02.55.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-08-25 07:23 . 2012-08-25 07:23 16384 c:\windows\temp\Perflib_Perfdata_358.dat
+ 2004-08-04 12:00 . 2012-07-02 17:49 67072 c:\windows\system32\mshtmled.dll
- 2004-08-04 12:00 . 2012-05-11 14:42 67072 c:\windows\system32\mshtmled.dll
+ 2009-03-08 08:31 . 2012-07-02 17:49 55296 c:\windows\system32\msfeedsbs.dll
- 2009-03-08 08:31 . 2012-05-11 14:42 55296 c:\windows\system32\msfeedsbs.dll
- 2004-08-04 12:00 . 2012-05-11 14:42 25600 c:\windows\system32\jsproxy.dll
+ 2004-08-04 12:00 . 2012-07-02 17:49 25600 c:\windows\system32\jsproxy.dll
- 2009-07-15 00:46 . 2012-05-11 14:42 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2009-07-15 00:46 . 2012-07-02 17:49 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2009-03-08 08:31 . 2012-07-02 17:49 67072 c:\windows\system32\dllcache\mshtmled.dll
- 2009-03-08 08:31 . 2012-05-11 14:42 67072 c:\windows\system32\dllcache\mshtmled.dll
- 2009-07-28 21:31 . 2012-05-11 14:42 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2009-07-28 21:31 . 2012-07-02 17:49 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2009-03-08 08:34 . 2012-05-11 14:42 43520 c:\windows\system32\dllcache\licmgr10.dll
+ 2009-03-08 08:34 . 2012-07-02 17:49 43520 c:\windows\system32\dllcache\licmgr10.dll
+ 2009-03-08 08:33 . 2012-07-02 17:49 25600 c:\windows\system32\dllcache\jsproxy.dll
- 2009-03-08 08:33 . 2012-05-11 14:42 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2012-07-06 13:58 . 2012-07-06 13:58 78336 c:\windows\system32\dllcache\browser.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 12800 c:\windows\ie8updates\KB2722913-IE8\xpshims.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 67072 c:\windows\ie8updates\KB2722913-IE8\mshtmled.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 55296 c:\windows\ie8updates\KB2722913-IE8\msfeedsbs.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 43520 c:\windows\ie8updates\KB2722913-IE8\licmgr10.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 25600 c:\windows\ie8updates\KB2722913-IE8\jsproxy.dll
+ 2004-08-04 12:00 . 2012-07-02 17:49 105984 c:\windows\system32\url.dll
- 2004-08-04 12:00 . 2012-05-11 14:42 105984 c:\windows\system32\url.dll
+ 2004-08-04 12:00 . 2012-07-02 17:49 206848 c:\windows\system32\occache.dll
- 2004-08-04 12:00 . 2012-05-11 14:42 206848 c:\windows\system32\occache.dll
+ 2004-08-04 12:00 . 2012-07-06 13:58 337920 c:\windows\system32\netapi32.dll
- 2004-08-04 12:00 . 2012-05-11 14:42 611840 c:\windows\system32\mstime.dll
+ 2004-08-04 12:00 . 2012-07-02 17:49 611840 c:\windows\system32\mstime.dll
- 2009-03-08 08:32 . 2012-05-11 14:42 629760 c:\windows\system32\msfeeds.dll
+ 2009-03-08 08:32 . 2012-07-02 17:49 629760 c:\windows\system32\msfeeds.dll
- 2004-08-04 12:00 . 2009-05-07 15:32 345600 c:\windows\system32\localspl.dll
+ 2004-08-04 12:00 . 2012-05-14 09:22 345600 c:\windows\system32\localspl.dll
- 2004-08-04 12:00 . 2012-05-11 14:42 184320 c:\windows\system32\iepeers.dll
+ 2004-08-04 12:00 . 2012-07-02 17:49 184320 c:\windows\system32\iepeers.dll
+ 2004-08-04 12:00 . 2012-07-02 17:49 387584 c:\windows\system32\iedkcs32.dll
- 2004-08-04 12:00 . 2012-05-11 14:42 387584 c:\windows\system32\iedkcs32.dll
- 2004-08-04 12:00 . 2012-05-11 11:38 174080 c:\windows\system32\ie4uinit.exe
+ 2004-08-04 12:00 . 2012-07-02 12:05 174080 c:\windows\system32\ie4uinit.exe
- 2005-11-12 06:15 . 2012-07-11 07:24 164320 c:\windows\system32\FNTCACHE.DAT
+ 2005-11-12 06:15 . 2012-08-25 07:22 164320 c:\windows\system32\FNTCACHE.DAT
- 2008-04-21 06:44 . 2012-05-16 15:08 916992 c:\windows\system32\dllcache\wininet.dll
+ 2008-04-21 06:44 . 2012-07-02 17:49 916992 c:\windows\system32\dllcache\wininet.dll
- 2009-03-08 08:34 . 2012-05-11 14:42 105984 c:\windows\system32\dllcache\url.dll
+ 2009-03-08 08:34 . 2012-07-02 17:49 105984 c:\windows\system32\dllcache\url.dll
+ 2011-08-10 21:02 . 2012-07-04 14:05 139784 c:\windows\system32\dllcache\rdpwd.sys
- 2009-03-08 08:34 . 2012-05-11 14:42 206848 c:\windows\system32\dllcache\occache.dll
+ 2009-03-08 08:34 . 2012-07-02 17:49 206848 c:\windows\system32\dllcache\occache.dll
+ 2008-10-23 22:02 . 2012-07-06 13:58 337920 c:\windows\system32\dllcache\netapi32.dll
+ 2009-03-08 08:32 . 2012-07-02 17:49 611840 c:\windows\system32\dllcache\mstime.dll
- 2009-03-08 08:32 . 2012-05-11 14:42 611840 c:\windows\system32\dllcache\mstime.dll
- 2009-07-28 21:31 . 2012-05-11 14:42 629760 c:\windows\system32\dllcache\msfeeds.dll
+ 2009-07-28 21:31 . 2012-07-02 17:49 629760 c:\windows\system32\dllcache\msfeeds.dll
- 2009-05-07 15:32 . 2009-05-07 15:32 345600 c:\windows\system32\dllcache\localspl.dll
+ 2009-05-07 15:32 . 2012-05-14 09:22 345600 c:\windows\system32\dllcache\localspl.dll
- 2012-06-14 01:15 . 2012-05-11 14:42 521728 c:\windows\system32\dllcache\jsdbgui.dll
+ 2012-06-14 01:15 . 2012-07-02 17:49 521728 c:\windows\system32\dllcache\jsdbgui.dll
- 2009-07-15 00:46 . 2012-05-11 14:42 247808 c:\windows\system32\dllcache\ieproxy.dll
+ 2009-07-15 00:46 . 2012-07-02 17:49 247808 c:\windows\system32\dllcache\ieproxy.dll
- 2009-03-08 08:31 . 2012-05-11 14:42 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2009-03-08 08:31 . 2012-07-02 17:49 184320 c:\windows\system32\dllcache\iepeers.dll
- 2010-06-10 01:24 . 2012-05-11 14:42 743424 c:\windows\system32\dllcache\iedvtool.dll
+ 2010-06-10 01:24 . 2012-07-02 17:49 743424 c:\windows\system32\dllcache\iedvtool.dll
- 2009-03-08 18:09 . 2012-05-11 14:42 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2009-03-08 18:09 . 2012-07-02 17:49 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2009-03-08 08:32 . 2012-07-02 12:05 174080 c:\windows\system32\dllcache\ie4uinit.exe
- 2009-03-08 08:32 . 2012-05-11 11:38 174080 c:\windows\system32\dllcache\ie4uinit.exe
+ 2012-08-24 09:04 . 2012-08-24 09:04 348160 c:\windows\Installer\70b7282.msi
+ 2012-08-25 07:03 . 2012-05-16 15:08 916992 c:\windows\ie8updates\KB2722913-IE8\wininet.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 105984 c:\windows\ie8updates\KB2722913-IE8\url.dll
+ 2012-08-25 07:03 . 2010-07-05 13:16 382840 c:\windows\ie8updates\KB2722913-IE8\spuninst\updspapi.dll
+ 2012-08-25 07:03 . 2010-07-05 13:15 231288 c:\windows\ie8updates\KB2722913-IE8\spuninst\spuninst.exe
+ 2012-08-25 07:03 . 2012-05-11 14:42 206848 c:\windows\ie8updates\KB2722913-IE8\occache.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 611840 c:\windows\ie8updates\KB2722913-IE8\mstime.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 629760 c:\windows\ie8updates\KB2722913-IE8\msfeeds.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 521728 c:\windows\ie8updates\KB2722913-IE8\jsdbgui.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 247808 c:\windows\ie8updates\KB2722913-IE8\ieproxy.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 184320 c:\windows\ie8updates\KB2722913-IE8\iepeers.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 743424 c:\windows\ie8updates\KB2722913-IE8\iedvtool.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 387584 c:\windows\ie8updates\KB2722913-IE8\iedkcs32.dll
+ 2012-08-25 07:03 . 2012-05-11 11:38 174080 c:\windows\ie8updates\KB2722913-IE8\ie4uinit.exe
+ 2004-08-04 12:00 . 2012-07-02 17:49 1212416 c:\windows\system32\urlmon.dll
- 2004-08-04 12:00 . 2012-05-11 14:42 1212416 c:\windows\system32\urlmon.dll
+ 2004-08-04 12:00 . 2012-07-02 17:49 6008320 c:\windows\system32\mshtml.dll
- 2009-03-08 08:32 . 2012-05-11 14:42 2000384 c:\windows\system32\iertutil.dll
+ 2009-03-08 08:32 . 2012-07-02 17:49 2000384 c:\windows\system32\iertutil.dll
- 2008-10-14 21:22 . 2012-06-13 13:19 1866112 c:\windows\system32\dllcache\win32k.sys
+ 2008-10-14 21:22 . 2012-07-03 13:40 1866112 c:\windows\system32\dllcache\win32k.sys
- 2008-06-26 08:15 . 2012-05-11 14:42 1212416 c:\windows\system32\dllcache\urlmon.dll
+ 2008-06-26 08:15 . 2012-07-02 17:49 1212416 c:\windows\system32\dllcache\urlmon.dll
+ 2008-04-21 06:44 . 2012-07-02 17:49 6008320 c:\windows\system32\dllcache\mshtml.dll
- 2009-07-15 00:46 . 2012-05-11 14:42 2000384 c:\windows\system32\dllcache\iertutil.dll
+ 2009-07-15 00:46 . 2012-07-02 17:49 2000384 c:\windows\system32\dllcache\iertutil.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 1212416 c:\windows\ie8updates\KB2722913-IE8\urlmon.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 6007808 c:\windows\ie8updates\KB2722913-IE8\mshtml.dll
+ 2012-08-25 07:03 . 2012-05-11 14:42 2000384 c:\windows\ie8updates\KB2722913-IE8\iertutil.dll
- 2009-03-08 08:39 . 2012-05-12 00:12 11111424 c:\windows\system32\ieframe.dll
+ 2009-03-08 08:39 . 2012-07-03 03:19 11111424 c:\windows\system32\ieframe.dll
- 2009-07-15 00:46 . 2012-05-12 00:12 11111424 c:\windows\system32\dllcache\ieframe.dll
+ 2009-07-15 00:46 . 2012-07-03 03:19 11111424 c:\windows\system32\dllcache\ieframe.dll
+ 2012-08-25 07:03 . 2012-05-12 00:12 11111424 c:\windows\ie8updates\KB2722913-IE8\ieframe.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn0\yt.dll" [2012-01-12 1517368]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\documents and settings\Protoman\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YahooAUService"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"SpyroService"=2 (0x2)
"aawservice"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"Host-process Windows (Rundll32.exe)"= c:\documents and settings\Protoman\Application Data\System32\csrss.exe
"Client Server Runtime Process"= c:\documents and settings\Protoman\Application Data\csrss.exe
"Service Host Process for Windows"= c:\documents and settings\Protoman\Application Data\svchost.exe
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R3 scrcap;scrcap;c:\windows\system32\drivers\scrcap.sys [12/27/2006 10:47 AM 9006]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [7/13/2012 1:28 PM 160944]
S4 SpyroService;Spyro Portal Service;c:\program files\FS\Spyro Portal\FlashPortal.exe [9/9/2011 10:44 AM 48128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-562591055-2147167427-1004Core.job
- c:\documents and settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-10 01:10]
.
2012-08-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-562591055-2147167427-1004UA.job
- c:\documents and settings\Protoman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-10 01:10]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - hxxp://cafeimg.hanmail.net/cab9_1/dmcc2.cab?Version=1,0,0,10
FF - ProfilePath - c:\documents and settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(yahoo.ytff.general.dontshowhpoffer, true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-25 22:36
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(732)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2012-08-25 22:39:08
ComboFix-quarantined-files.txt 2012-08-26 02:39
ComboFix2.txt 2012-08-24 04:31
ComboFix3.txt 2012-08-24 02:58
.
Pre-Run: 656,309,268,480 bytes free
Post-Run: 657,283,117,056 bytes free
.
- - End Of File - - 691B3A1E1318F03A2CA3AE5DD9C56888
Post #18
Good. Now let's update your Java.

Your Java is out of date and you have other old versions still on your computer, those old versions are now a security vulnerability:

Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer - Version 7 update 6

Then got to your add or remove programs in your control panel. Once the programs have populated… make sure that Version 7 update 6 is the only version of Java that is still listed. If others show - please uninstall them.

Then please let me know of any issues you are still having.
Post #19
Alright did it. Everything seems fine now. I guess I will just have to wait a couple of days and see if it's ok. With all this rebooting and back and forth I didn't really get to open up Twitter, facebook and so on and see if the PC PF usage goes overboard after an hour. Thanks again and here is hoping for the best. You guys are awesome!
Post #20
Time for some housekeeping
  • Click START then RUN
  • Now type ComboFix /Uninstall in the runbox and click OK.
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Now to remove most of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI