What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Resuming topic of mega mega comp probs. [Closed]

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi,

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:


    ClearJavaCache::

    FCopy::
    c:\windows\system32\dllcache\tcpip.sys | c:\windows\system32\drivers\tcpip.sys

    File::
    c:\documents and settings\lointusk\Application Data\advantage\AdVantage.exe

    Registry::
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "AdVantage"=-

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Post the new ComboFix log and let me know how your system is running now. :)
Post #17
ComboFix 13-02-13.02 - lointusk 02/16/2013 11:22:38.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1278.783 [GMT -7:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((( Files Created from 2013-01-16 to 2013-02-16 )))))))))))))))))))))))))))))))
.
.
2013-02-16 18:04 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B5DF0FBD-A957-43FB-9BB5-D57876DF9E5A}\mpengine.dll
2013-02-15 16:29 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\system32\wbem\snmp
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\srchasst
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\system32\xircom
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\program files\microsoft frontpage
2013-02-07 15:47 . 2013-02-07 15:48 ——– d—–w- c:\program files\Dropbox
2013-02-07 15:43 . 2013-02-16 17:52 ——– d—–w- c:\documents and settings\lointusk\Application Data\Dropbox
2013-02-07 07:26 . 2013-02-07 07:26 ——– d—–w- c:\documents and settings\lointusk\Local Settings\Application Data\CRE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-15 08:07 . 2009-10-10 12:45 98304 —-a-w- c:\windows\DUMP50cf.tmp
2013-01-30 10:53 . 2012-11-29 16:55 232336 ——w- c:\windows\system32\MpSigStub.exe
2013-01-26 03:55 . 2008-04-14 12:00 552448 —-a-w- c:\windows\system32\oleaut32.dll
2013-01-07 13:07 . 2009-02-07 23:02 2069760 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-07 01:16 . 2009-02-06 11:08 2193024 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-01-04 01:20 . 2009-04-17 12:26 1867264 —-a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2009-06-03 19:09 1292288 —-a-w- c:\windows\system32\quartz.dll
2013-01-02 06:49 . 2008-04-14 12:00 148992 —-a-w- c:\windows\system32\mpg2splt.ax
2012-12-26 20:15 . 2009-07-03 17:06 920064 —-a-w- c:\windows\system32\wininet.dll
2012-12-26 20:15 . 2009-08-05 21:06 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-12-26 20:15 . 2009-07-03 17:06 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-12-24 07:02 . 2009-03-08 02:35 385024 —-a-w- c:\windows\system32\html.iec
2012-12-16 12:23 . 2008-04-14 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-12-14 23:49 . 2012-11-29 17:34 21104 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-12-04 20:09 . 2012-12-04 20:09 697272 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-04 20:09 . 2012-12-04 20:09 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-06 01:32 . 2013-02-06 01:30 262552 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-08-05 . 25A740D70E8007814A48D3FA1B34FA34 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-03-19 7634944]
"nwiz"="nwiz.exe" [2007-03-19 1622016]
"NvMediaCenter"="NvMCTray.dll" [2007-03-19 86016]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-08-05 128512]
.
c:\documents and settings\lointusk\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\lointusk\Application Data\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HiCDEject.lnk - c:\program files\HiCDEject\HiCDEject.exe [2001-2-13 9248]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.313\SSScheduler.exe [2012-10-26 271808]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"AdVantage"=c:\documents and settings\lointusk\Application Data\advantage\AdVantage.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\utorrent\\utorrent.exe"=
"c:\\Documents and Settings\\lointusk\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/10/2009 10:34 AM 721904]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [11/29/2012 10:34 AM 398184]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/29/2012 10:34 AM 682344]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/29/2012 10:34 AM 21104]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.313\McCHSvc.exe [10/26/2012 11:15 AM 234776]
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001Core.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001UA.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-16 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 22:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1 [removed]
TCP: Interfaces\{3C2F8020-1F67-43A0-B7E4-678FBBA60FBA}: NameServer = 192.168.0.1
TCP: Interfaces\{58FA7B8E-4E10-4456-906A-8DF7B9D15259}: NameServer = 192.168.0.1
TCP: Interfaces\{595FCF1C-C74B-46AE-B3B1-6CD47E0297D6}: NameServer = 192.168.0.1
TCP: Interfaces\{6A9C593A-3C2B-4D4A-9DBD-6DB76CA920C6}: NameServer = 192.168.0.1
TCP: Interfaces\{8DF4D200-5EF5-45C5-B945-C7DFAE8DE4FA}: NameServer = 192.168.0.1
TCP: Interfaces\{9F9D5D91-3B90-408F-94E8-D822F7C38B25}: NameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\lointusk\Application Data\Mozilla\Firefox\Profiles\p2g3ajml.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/firefox/?fr=sfp-yff17
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-16 11:28
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(760)
c:\windows\system32\WININET.dll
c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-02-16 11:30:53
ComboFix-quarantined-files.txt 2013-02-16 18:30
ComboFix2.txt 2013-02-15 08:23
ComboFix3.txt 2013-02-15 01:25
.
Pre-Run: 9,376,591,872 bytes free
Post-Run: 9,373,638,656 bytes free
.
- - End Of File - - B1E13F43FFE594C11A5D94272F73AE03
Post #19
ComboFix 13-02-15.01 - lointusk 02/16/2013 15:58:43.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1278.763 [GMT -7:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\lointusk\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\documents and settings\lointusk\Application Data\advantage\AdVantage.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
————— FCopy —————
.
c:\windows\system32\dllcache\tcpip.sys –> c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((( Files Created from 2013-01-16 to 2013-02-16 )))))))))))))))))))))))))))))))
.
.
2013-02-16 18:04 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B5DF0FBD-A957-43FB-9BB5-D57876DF9E5A}\mpengine.dll
2013-02-15 16:29 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\system32\wbem\snmp
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\srchasst
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\system32\xircom
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\program files\microsoft frontpage
2013-02-07 15:47 . 2013-02-07 15:48 ——– d—–w- c:\program files\Dropbox
2013-02-07 15:43 . 2013-02-16 17:52 ——– d—–w- c:\documents and settings\lointusk\Application Data\Dropbox
2013-02-07 07:26 . 2013-02-07 07:26 ——– d—–w- c:\documents and settings\lointusk\Local Settings\Application Data\CRE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-15 08:07 . 2009-10-10 12:45 98304 —-a-w- c:\windows\DUMP50cf.tmp
2013-01-30 10:53 . 2012-11-29 16:55 232336 ——w- c:\windows\system32\MpSigStub.exe
2013-01-26 03:55 . 2008-04-14 12:00 552448 —-a-w- c:\windows\system32\oleaut32.dll
2013-01-07 13:07 . 2009-02-07 23:02 2069760 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-07 01:16 . 2009-02-06 11:08 2193024 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-01-04 01:20 . 2009-04-17 12:26 1867264 —-a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2009-06-03 19:09 1292288 —-a-w- c:\windows\system32\quartz.dll
2013-01-02 06:49 . 2008-04-14 12:00 148992 —-a-w- c:\windows\system32\mpg2splt.ax
2012-12-26 20:15 . 2009-07-03 17:06 920064 —-a-w- c:\windows\system32\wininet.dll
2012-12-26 20:15 . 2009-08-05 21:06 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-12-26 20:15 . 2009-07-03 17:06 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-12-24 07:02 . 2009-03-08 02:35 385024 —-a-w- c:\windows\system32\html.iec
2012-12-16 12:23 . 2008-04-14 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-12-14 23:49 . 2012-11-29 17:34 21104 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-12-04 20:09 . 2012-12-04 20:09 697272 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-04 20:09 . 2012-12-04 20:09 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-06 01:32 . 2013-02-06 01:30 262552 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-03-19 7634944]
"nwiz"="nwiz.exe" [2007-03-19 1622016]
"NvMediaCenter"="NvMCTray.dll" [2007-03-19 86016]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-08-05 128512]
.
c:\documents and settings\lointusk\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\lointusk\Application Data\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HiCDEject.lnk - c:\program files\HiCDEject\HiCDEject.exe [2001-2-13 9248]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.313\SSScheduler.exe [2012-10-26 271808]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\utorrent\\utorrent.exe"=
"c:\\Documents and Settings\\lointusk\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/10/2009 10:34 AM 721904]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [11/29/2012 10:34 AM 398184]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/29/2012 10:34 AM 682344]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/29/2012 10:34 AM 21104]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.313\McCHSvc.exe [10/26/2012 11:15 AM 234776]
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001Core.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001UA.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-16 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 22:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1 [removed]
TCP: Interfaces\{3C2F8020-1F67-43A0-B7E4-678FBBA60FBA}: NameServer = 192.168.0.1
TCP: Interfaces\{58FA7B8E-4E10-4456-906A-8DF7B9D15259}: NameServer = 192.168.0.1
TCP: Interfaces\{595FCF1C-C74B-46AE-B3B1-6CD47E0297D6}: NameServer = 192.168.0.1
TCP: Interfaces\{6A9C593A-3C2B-4D4A-9DBD-6DB76CA920C6}: NameServer = 192.168.0.1
TCP: Interfaces\{8DF4D200-5EF5-45C5-B945-C7DFAE8DE4FA}: NameServer = 192.168.0.1
TCP: Interfaces\{9F9D5D91-3B90-408F-94E8-D822F7C38B25}: NameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\lointusk\Application Data\Mozilla\Firefox\Profiles\p2g3ajml.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/firefox/?fr=sfp-yff17
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-16 16:04
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\wbem\wbemsvc.dll
.
- - - - - - - > 'explorer.exe'(768)
c:\windows\system32\WININET.dll
c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-02-16 16:05:53
ComboFix-quarantined-files.txt 2013-02-16 23:05
ComboFix2.txt 2013-02-16 18:30
ComboFix3.txt 2013-02-15 08:23
ComboFix4.txt 2013-02-15 01:25
.
Pre-Run: 9,364,385,792 bytes free
Post-Run: 9,355,325,440 bytes free
.
- - End Of File - - E3AFE9C3C387E009EE14845078E2F67E
Post #23
aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2013-02-16 23:03:53 —————————– 23:03:53.515 OS Version: Windows 5.1.2600 Service Pack 3 23:03:53.515 Number of processors: 1 586 0x401 23:03:53.515 ComputerName: FROGPUTER UserName: lointusk 23:03:56.640 Initialize success 23:04:12.671 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 23:04:12.671 Disk 0 Vendor: Maxtor_6E040L0 NAR61EA0 Size: 39205MB BusType: 3 23:04:12.703 Disk 0 MBR read successfully 23:04:12.703 Disk 0 MBR scan 23:04:12.703 Disk 0 Windows XP default MBR code 23:04:12.703 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 39197 MB offset 63 23:04:12.718 Disk 0 scanning sectors +80276805 23:04:12.796 Disk 0 scanning C:\WINDOWS\system32\drivers 23:04:19.265 Service scanning 23:04:38.593 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 23:04:44.437 Modules scanning 23:05:08.562 Disk 0 trace - called modules: 23:05:08.578 ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys sprl.sys hal.dll >>UNKNOWN [0x8974b938]<< 23:05:08.578 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89789ab8] 23:05:08.578 3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x896d2b00] 23:05:08.578 Scan finished successfully 23:08:32.234 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\lointusk\Desktop\MBR.dat" 23:08:32.250 The log file has been saved successfully to "C:\Documents and Settings\lointusk\Desktop\blue goue lowg.txt"
Post #26
Hi,

Please go to Start >> Control Panel >> Add/Remove Programs >> uninstall all versions of Adobe Flash Player.
You can download the current version HERE.
———-

[external image: Posted Image] Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.
———-
Post #27
SCAN 1 Malwarebytes Anti-Malware (Trial) 1.70.0.1100 www.malwarebytes.org Database version: v2013.02.17.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 lointusk :: FROGPUTER [administrator] Protection: Enabled 2/17/2013 10:28:26 PM mbam-log-2013-02-17 (22-28-26).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 207148 Time elapsed: 42 minute(s), 2 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) SCAN 2 attactch ment titled bad things

Attachments:

Post #28
ComboFix
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:
    ClearJavaCache::

File::
C:\Documents and Settings\lointusk\Desktop\movies\Sordid_Lives_the_movie_DvdRip (1).exe	
C:\Documents and Settings\lointusk\Desktop\movies\Sordid_Lives_the_movie_DvdRip.exe	
C:\Documents and Settings\lointusk\My Documents\Downloads\iLividSetup.exe	
C:\Other Programs\Installed\cpuz_152_setup.exe

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Post the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Post the new ComboFix log and let me know what remaining malware problems you are having. :)
Post #29
It's log log log!

ComboFix 13-02-15.01 - lointusk 02/18/2013 13:28:15.6.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1278.796 [GMT -7:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\lointusk\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\documents and settings\lointusk\Desktop\movies\Sordid_Lives_the_movie_DvdRip (1).exe"
"c:\documents and settings\lointusk\Desktop\movies\Sordid_Lives_the_movie_DvdRip.exe"
"c:\documents and settings\lointusk\My Documents\Downloads\iLividSetup.exe"
"c:\other programs\Installed\cpuz_152_setup.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\lointusk\Desktop\movies\Sordid_Lives_the_movie_DvdRip (1).exe
c:\documents and settings\lointusk\Desktop\movies\Sordid_Lives_the_movie_DvdRip.exe
c:\documents and settings\lointusk\My Documents\Downloads\iLividSetup.exe
c:\other programs\Installed\cpuz_152_setup.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-01-18 to 2013-02-18 )))))))))))))))))))))))))))))))
.
.
2013-02-18 18:02 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C043541-7C14-409D-8BAC-36BE31F5A390}\mpengine.dll
2013-02-18 07:14 . 2013-02-18 07:19 71024 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-18 07:14 . 2013-02-18 07:19 691568 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-18 06:13 . 2013-02-18 06:13 ——– d—–w- c:\program files\ESET
2013-02-17 18:03 . 2013-01-08 04:57 6991832 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\system32\wbem\snmp
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\srchasst
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\windows\system32\xircom
2013-02-15 08:08 . 2013-02-15 08:08 ——– d—–w- c:\program files\microsoft frontpage
2013-02-07 15:47 . 2013-02-07 15:48 ——– d—–w- c:\program files\Dropbox
2013-02-07 15:43 . 2013-02-16 17:52 ——– d—–w- c:\documents and settings\lointusk\Application Data\Dropbox
2013-02-07 07:26 . 2013-02-07 07:26 ——– d—–w- c:\documents and settings\lointusk\Local Settings\Application Data\CRE
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-15 08:07 . 2009-10-10 12:45 98304 —-a-w- c:\windows\DUMP50cf.tmp
2013-01-30 10:53 . 2012-11-29 16:55 232336 ——w- c:\windows\system32\MpSigStub.exe
2013-01-26 03:55 . 2008-04-14 12:00 552448 —-a-w- c:\windows\system32\oleaut32.dll
2013-01-07 13:07 . 2009-02-07 23:02 2069760 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-07 01:16 . 2009-02-06 11:08 2193024 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-01-04 01:20 . 2009-04-17 12:26 1867264 —-a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2009-06-03 19:09 1292288 —-a-w- c:\windows\system32\quartz.dll
2013-01-02 06:49 . 2008-04-14 12:00 148992 —-a-w- c:\windows\system32\mpg2splt.ax
2012-12-26 20:15 . 2009-07-03 17:06 920064 —-a-w- c:\windows\system32\wininet.dll
2012-12-26 20:15 . 2009-08-05 21:06 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-12-26 20:15 . 2009-07-03 17:06 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-12-24 07:02 . 2009-03-08 02:35 385024 —-a-w- c:\windows\system32\html.iec
2012-12-16 12:23 . 2008-04-14 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-12-14 23:49 . 2012-11-29 17:34 21104 —-a-w- c:\windows\system32\drivers\mbam.sys
2013-02-06 01:32 . 2013-02-06 01:30 262552 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\lointusk\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-03-19 7634944]
"nwiz"="nwiz.exe" [2007-03-19 1622016]
"NvMediaCenter"="NvMCTray.dll" [2007-03-19 86016]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-08-05 128512]
.
c:\documents and settings\lointusk\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\lointusk\Application Data\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HiCDEject.lnk - c:\program files\HiCDEject\HiCDEject.exe [2001-2-13 9248]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.313\SSScheduler.exe [2012-10-26 271808]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\utorrent\\utorrent.exe"=
"c:\\Documents and Settings\\lointusk\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/10/2009 10:34 AM 721904]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [11/29/2012 10:34 AM 398184]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/29/2012 10:34 AM 682344]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/29/2012 10:34 AM 21104]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.313\McCHSvc.exe [10/26/2012 11:15 AM 234776]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - ADOBEFLASHPLAYERUPDATESVC
*Deregistered* - aswMBR
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-18 07:19]
.
2013-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 06:32]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001Core.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1482476501-1123561945-1644491937-1001UA.job
- c:\documents and settings\lointusk\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-05-02 19:27]
.
2013-02-18 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 22:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1 [removed]
TCP: Interfaces\{3C2F8020-1F67-43A0-B7E4-678FBBA60FBA}: NameServer = 192.168.0.1
TCP: Interfaces\{58FA7B8E-4E10-4456-906A-8DF7B9D15259}: NameServer = 192.168.0.1
TCP: Interfaces\{595FCF1C-C74B-46AE-B3B1-6CD47E0297D6}: NameServer = 192.168.0.1
TCP: Interfaces\{6A9C593A-3C2B-4D4A-9DBD-6DB76CA920C6}: NameServer = 192.168.0.1
TCP: Interfaces\{8DF4D200-5EF5-45C5-B945-C7DFAE8DE4FA}: NameServer = 192.168.0.1
TCP: Interfaces\{9F9D5D91-3B90-408F-94E8-D822F7C38B25}: NameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\lointusk\Application Data\Mozilla\Firefox\Profiles\p2g3ajml.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/firefox/?fr=sfp-yff17
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-18 13:34
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\wbem\wbemsvc.dll
.
Completion time: 2013-02-18 13:36:48
ComboFix-quarantined-files.txt 2013-02-18 20:36
ComboFix2.txt 2013-02-16 23:05
ComboFix3.txt 2013-02-16 18:30
ComboFix4.txt 2013-02-15 08:23
ComboFix5.txt 2013-02-18 20:26
.
Pre-Run: 9,126,719,488 bytes free
Post-Run: 9,126,379,520 bytes free
.
- - End Of File - - D6B9A4F3EAF638A3C9A83DBD566B712F

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI