----------------
try to go on in normal mode, first.
If that fails, boot into safe mode and try again
Spyware / Malware / Virus Removal
mssams.exe (Part of RBOT-SV WORM) & More... [Closed]
23 min read
No_More_Struggle
Okay, I had a serious error at stage 5 but it did not shut down the computer it went ahead and finished. I hope the script was still in it. Here is the log:
ComboFix 13-07-18.01 - Owner 07/18/2013 8:56.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1271.759 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Anti-Virus Free *Enabled/Outdated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 )))))))))))))))))))))))))))))))
.
.
2013-07-16 11:10 . 2013-07-16 11:10 ——– d—–w- C:\Badware removal
2013-07-16 09:17 . 2013-07-16 09:17 ——– d—–w- C:\hjt
2013-07-15 21:19 . 2004-11-02 14:04 163840 —-a-w- c:\windows\system32\igfxrdan.lrc
2013-07-15 18:05 . 2013-07-15 18:05 45056 —ha-w- c:\windows\NCUNINST.EXE
2013-07-15 15:40 . 2013-07-15 15:40 ——– d—–w- c:\program files\ToniArts
2013-07-15 15:39 . 2004-07-16 05:20 69715 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
2013-07-15 15:39 . 2004-07-16 05:19 266240 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
2013-07-15 15:39 . 2004-07-16 05:18 172032 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
2013-07-15 15:39 . 2004-07-16 05:16 32768 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2013-07-15 15:39 . 2004-07-16 05:20 733184 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
2013-07-15 15:39 . 2004-07-16 05:18 5632 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
2013-07-15 15:39 . 2013-07-15 15:39 180356 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
2013-07-15 15:39 . 2013-07-15 15:39 303236 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
2013-07-15 01:25 . 2013-07-15 14:09 ——– d—–w- c:\program files\MyPC Backup
2013-07-15 01:25 . 2013-07-15 14:13 ——– d—–w- c:\documents and settings\Owner\Application Data\Systweak
2013-07-14 19:09 . 2013-07-14 19:15 ——– d—–w- c:\windows\system32\MRT
2013-07-07 01:35 . 2013-07-07 01:35 ——– d—–w- c:\windows\system32\wbem\Repository
2013-06-29 07:09 . 2013-07-18 07:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\FileTypeAssistant
2013-06-29 07:07 . 2013-06-29 07:18 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\FileTypeAssistant
2013-06-29 07:07 . 2013-07-18 07:09 ——– d—–w- c:\program files\File Type Assistant
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-16 05:11 . 2013-04-14 10:39 770344 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2013-07-16 05:11 . 2013-04-14 10:39 175176 —-a-w- c:\windows\system32\drivers\aswVmm.sys
2013-07-16 05:11 . 2009-06-25 02:46 369584 —-a-w- c:\windows\system32\drivers\aswSP.sys
2013-06-08 04:55 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2013-06-07 21:56 . 2005-06-18 04:49 920064 —-a-w- c:\windows\system32\wininet.dll
2013-06-07 21:56 . 2003-09-18 07:10 43520 —-a-w- c:\windows\system32\licmgr10.dll
2013-06-07 21:56 . 2003-09-18 07:05 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-06-04 07:23 . 2002-12-12 14:14 562688 —-a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40 . 2003-09-18 06:10 1876736 —-a-w- c:\windows\system32\win32k.sys
2013-05-09 08:59 . 2013-04-14 10:39 49376 —-a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2009-06-25 02:46 56080 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2013-04-14 10:39 66336 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:59 . 2009-06-25 02:46 49760 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2013-05-09 08:59 . 2009-06-25 02:46 29816 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:58 . 2010-06-29 06:25 41664 —-a-w- c:\windows\avastSS.scr
2013-05-09 08:58 . 2009-06-25 02:46 229648 —-a-w- c:\windows\system32\aswBoot.exe
2013-05-09 05:28 . 2006-10-19 02:47 1543680 ——w- c:\windows\system32\wmvdecod.dll
2013-05-03 01:26 . 2003-09-18 06:08 2193536 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 00:38 . 2002-08-29 08:04 2070144 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-07-29 10:41 . 2009-07-23 17:57 661352 -c–a-w- c:\program files\autoruns.exe
2009-07-29 10:41 . 2009-07-23 17:57 553832 -c–a-w- c:\program files\autorunsc.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LWBMOUSE"="c:\program files\Tech\MagicBall\1.1\LWBWHEEL.exe" [2001-07-31 435712]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2004-11-02 126976]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled\
Updates from HP.lnk - c:\program files\Updates from HP\137903\Program\BackWeb-137903.exe -startup [2003-8-23 16384]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2003-6-18 53248]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 15:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-05-03 06:19 323584 -c–a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2006-02-14 09:32 507904 -c–a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SymWSC"=2 (0x2)
"navapsvc"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\wjview.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\File Type Assistant\\tsassist.exe"=
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [4/14/2013 5:39 AM 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [4/14/2013 5:39 AM 175176]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [4/14/2013 5:39 AM 770344]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/24/2009 9:46 PM 369584]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/4/2009 3:38 PM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/4/2009 3:38 PM 108552]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/24/2009 9:46 PM 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [4/14/2013 5:39 AM 66336]
S2 mrtRate;mrtRate; [x]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 00:47 1173456 —-a-w- c:\program files\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-18 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\Alwil Software\Avast5\AvastEmUpdate.exe [2013-04-14 08:58]
.
2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-20 10:15]
.
2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-20 10:15]
.
2013-07-18 c:\windows\Tasks\ProgramRefresh-ATFST.job
- c:\program files\File Type Assistant\TSASetup.exe [2013-06-29 18:10]
.
2013-07-18 c:\windows\Tasks\ProgramUpdateCheck.job
- c:\program files\File Type Assistant\tsassist.exe [2013-06-29 18:09]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/advanced_search?hl=en
uDefault_Search_URL = hxxp://srch-us9.hpwis.com/
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"
uInternet Settings,ProxyOverride = localhost
uSearchAssistant = hxxp://www.the818search-co.com/sp2.php
TCP: DhcpNameServer = [removed] [removed]
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-18 09:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
[1].sys"
.
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\rootrepeal[1]]
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Shared Tools\MSConfig\startupreg\¢ 0 ¸ u 0 4 C
} ï Á z î [ 8 C : \Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="fktltll"
"hkey"="HKLM"
"inimapping"="0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3484)
c:\windows\system32\WININET.dll
c:\program files\Google\Drive\googledrivesync32.dll
c:\windows\system32\ieframe.dll
c:\program files\Tech\MagicBall\1.1\MOUSEDLL.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-07-18 09:19:50
ComboFix-quarantined-files.txt 2013-07-18 14:19
ComboFix2.txt 2013-07-18 13:05
.
Pre-Run: 13,264,195,584 bytes free
Post-Run: 13,250,834,432 bytes free
.
- - End Of File - - 2A28B654BE5BA6F09A0F8E9F754B7C74
B716B775FCBDABF0E2DDFF76F15C6790
ComboFix 13-07-18.01 - Owner 07/18/2013 8:56.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1271.759 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Anti-Virus Free *Enabled/Outdated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 )))))))))))))))))))))))))))))))
.
.
2013-07-16 11:10 . 2013-07-16 11:10 ——– d—–w- C:\Badware removal
2013-07-16 09:17 . 2013-07-16 09:17 ——– d—–w- C:\hjt
2013-07-15 21:19 . 2004-11-02 14:04 163840 —-a-w- c:\windows\system32\igfxrdan.lrc
2013-07-15 18:05 . 2013-07-15 18:05 45056 —ha-w- c:\windows\NCUNINST.EXE
2013-07-15 15:40 . 2013-07-15 15:40 ——– d—–w- c:\program files\ToniArts
2013-07-15 15:39 . 2004-07-16 05:20 69715 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
2013-07-15 15:39 . 2004-07-16 05:19 266240 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
2013-07-15 15:39 . 2004-07-16 05:18 172032 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
2013-07-15 15:39 . 2004-07-16 05:16 32768 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2013-07-15 15:39 . 2004-07-16 05:20 733184 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
2013-07-15 15:39 . 2004-07-16 05:18 5632 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
2013-07-15 15:39 . 2013-07-15 15:39 180356 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
2013-07-15 15:39 . 2013-07-15 15:39 303236 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
2013-07-15 01:25 . 2013-07-15 14:09 ——– d—–w- c:\program files\MyPC Backup
2013-07-15 01:25 . 2013-07-15 14:13 ——– d—–w- c:\documents and settings\Owner\Application Data\Systweak
2013-07-14 19:09 . 2013-07-14 19:15 ——– d—–w- c:\windows\system32\MRT
2013-07-07 01:35 . 2013-07-07 01:35 ——– d—–w- c:\windows\system32\wbem\Repository
2013-06-29 07:09 . 2013-07-18 07:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\FileTypeAssistant
2013-06-29 07:07 . 2013-06-29 07:18 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\FileTypeAssistant
2013-06-29 07:07 . 2013-07-18 07:09 ——– d—–w- c:\program files\File Type Assistant
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-16 05:11 . 2013-04-14 10:39 770344 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2013-07-16 05:11 . 2013-04-14 10:39 175176 —-a-w- c:\windows\system32\drivers\aswVmm.sys
2013-07-16 05:11 . 2009-06-25 02:46 369584 —-a-w- c:\windows\system32\drivers\aswSP.sys
2013-06-08 04:55 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2013-06-07 21:56 . 2005-06-18 04:49 920064 —-a-w- c:\windows\system32\wininet.dll
2013-06-07 21:56 . 2003-09-18 07:10 43520 —-a-w- c:\windows\system32\licmgr10.dll
2013-06-07 21:56 . 2003-09-18 07:05 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-06-04 07:23 . 2002-12-12 14:14 562688 —-a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40 . 2003-09-18 06:10 1876736 —-a-w- c:\windows\system32\win32k.sys
2013-05-09 08:59 . 2013-04-14 10:39 49376 —-a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2009-06-25 02:46 56080 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2013-04-14 10:39 66336 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:59 . 2009-06-25 02:46 49760 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2013-05-09 08:59 . 2009-06-25 02:46 29816 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:58 . 2010-06-29 06:25 41664 —-a-w- c:\windows\avastSS.scr
2013-05-09 08:58 . 2009-06-25 02:46 229648 —-a-w- c:\windows\system32\aswBoot.exe
2013-05-09 05:28 . 2006-10-19 02:47 1543680 ——w- c:\windows\system32\wmvdecod.dll
2013-05-03 01:26 . 2003-09-18 06:08 2193536 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 00:38 . 2002-08-29 08:04 2070144 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-07-29 10:41 . 2009-07-23 17:57 661352 -c–a-w- c:\program files\autoruns.exe
2009-07-29 10:41 . 2009-07-23 17:57 553832 -c–a-w- c:\program files\autorunsc.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LWBMOUSE"="c:\program files\Tech\MagicBall\1.1\LWBWHEEL.exe" [2001-07-31 435712]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2004-11-02 126976]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled\
Updates from HP.lnk - c:\program files\Updates from HP\137903\Program\BackWeb-137903.exe -startup [2003-8-23 16384]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2003-6-18 53248]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 15:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-05-03 06:19 323584 -c–a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2006-02-14 09:32 507904 -c–a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SymWSC"=2 (0x2)
"navapsvc"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\wjview.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\File Type Assistant\\tsassist.exe"=
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [4/14/2013 5:39 AM 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [4/14/2013 5:39 AM 175176]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [4/14/2013 5:39 AM 770344]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/24/2009 9:46 PM 369584]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/4/2009 3:38 PM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/4/2009 3:38 PM 108552]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/24/2009 9:46 PM 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [4/14/2013 5:39 AM 66336]
S2 mrtRate;mrtRate; [x]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 00:47 1173456 —-a-w- c:\program files\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-18 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\Alwil Software\Avast5\AvastEmUpdate.exe [2013-04-14 08:58]
.
2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-20 10:15]
.
2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-20 10:15]
.
2013-07-18 c:\windows\Tasks\ProgramRefresh-ATFST.job
- c:\program files\File Type Assistant\TSASetup.exe [2013-06-29 18:10]
.
2013-07-18 c:\windows\Tasks\ProgramUpdateCheck.job
- c:\program files\File Type Assistant\tsassist.exe [2013-06-29 18:09]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/advanced_search?hl=en
uDefault_Search_URL = hxxp://srch-us9.hpwis.com/
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"
uInternet Settings,ProxyOverride = localhost
uSearchAssistant = hxxp://www.the818search-co.com/sp2.php
TCP: DhcpNameServer = [removed] [removed]
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-18 09:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
[1].sys"
.
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\rootrepeal[1]]
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Shared Tools\MSConfig\startupreg\¢ 0 ¸ u 0 4 C
} ï Á z î [ 8 C : \Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="fktltll"
"hkey"="HKLM"
"inimapping"="0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3484)
c:\windows\system32\WININET.dll
c:\program files\Google\Drive\googledrivesync32.dll
c:\windows\system32\ieframe.dll
c:\program files\Tech\MagicBall\1.1\MOUSEDLL.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-07-18 09:19:50
ComboFix-quarantined-files.txt 2013-07-18 14:19
ComboFix2.txt 2013-07-18 13:05
.
Pre-Run: 13,264,195,584 bytes free
Post-Run: 13,250,834,432 bytes free
.
- - End Of File - - 2A28B654BE5BA6F09A0F8E9F754B7C74
B716B775FCBDABF0E2DDFF76F15C6790
----------------
Nope, it didn´t get the script. Start in safe mode and drag the script file into the exe.
No_More_Struggle
Hi Marius,
Is this what you need?
ComboFix 13-07-18.01 - Owner 07/18/2013 9:44.4.1 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1271.895 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Anti-Virus Free *Enabled/Outdated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\documents and settings\Default User\Start Menu\Programs\Startup\AutoTBar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Owner\Application Data\Systweak
c:\program files\MyPC Backup
c:\program files\MyPC Backup\DEL_AWSSDK.dll
c:\program files\MyPC Backup\DEL_GetText.dll
c:\program files\MyPC Backup\DEL_MPCBClient.dll
c:\program files\MyPC Backup\DEL_MyPC Backup.exe
c:\program files\MyPC Backup\DEL_Shared Stack.dll
c:\program files\MyPC Backup\DEL_UnRegisterExtensions.exe
c:\program files\MyPC Backup\x86\System.Data.SQLite.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 )))))))))))))))))))))))))))))))
.
.
2013-07-16 11:10 . 2013-07-16 11:10 ——– d—–w- C:\Badware removal
2013-07-16 09:17 . 2013-07-16 09:17 ——– d—–w- C:\hjt
2013-07-15 21:19 . 2004-11-02 14:04 163840 —-a-w- c:\windows\system32\igfxrdan.lrc
2013-07-15 18:05 . 2013-07-15 18:05 45056 —ha-w- c:\windows\NCUNINST.EXE
2013-07-15 15:40 . 2013-07-15 15:40 ——– d—–w- c:\program files\ToniArts
2013-07-15 15:39 . 2004-07-16 05:20 69715 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
2013-07-15 15:39 . 2004-07-16 05:19 266240 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
2013-07-15 15:39 . 2004-07-16 05:18 172032 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
2013-07-15 15:39 . 2004-07-16 05:16 32768 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2013-07-15 15:39 . 2004-07-16 05:20 733184 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
2013-07-15 15:39 . 2004-07-16 05:18 5632 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
2013-07-15 15:39 . 2013-07-15 15:39 180356 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
2013-07-15 15:39 . 2013-07-15 15:39 303236 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
2013-07-14 19:09 . 2013-07-14 19:15 ——– d—–w- c:\windows\system32\MRT
2013-07-07 01:35 . 2013-07-07 01:35 ——– d—–w- c:\windows\system32\wbem\Repository
2013-06-29 07:09 . 2013-07-18 07:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\FileTypeAssistant
2013-06-29 07:07 . 2013-06-29 07:18 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\FileTypeAssistant
2013-06-29 07:07 . 2013-07-18 07:09 ——– d—–w- c:\program files\File Type Assistant
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-16 05:11 . 2013-04-14 10:39 770344 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2013-07-16 05:11 . 2013-04-14 10:39 175176 —-a-w- c:\windows\system32\drivers\aswVmm.sys
2013-07-16 05:11 . 2009-06-25 02:46 369584 —-a-w- c:\windows\system32\drivers\aswSP.sys
2013-06-08 04:55 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2013-06-07 21:56 . 2005-06-18 04:49 920064 —-a-w- c:\windows\system32\wininet.dll
2013-06-07 21:56 . 2003-09-18 07:10 43520 —-a-w- c:\windows\system32\licmgr10.dll
2013-06-07 21:56 . 2003-09-18 07:05 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-06-04 07:23 . 2002-12-12 14:14 562688 —-a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40 . 2003-09-18 06:10 1876736 —-a-w- c:\windows\system32\win32k.sys
2013-05-09 08:59 . 2013-04-14 10:39 49376 —-a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2009-06-25 02:46 56080 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2013-04-14 10:39 66336 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:59 . 2009-06-25 02:46 49760 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2013-05-09 08:59 . 2009-06-25 02:46 29816 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:58 . 2010-06-29 06:25 41664 —-a-w- c:\windows\avastSS.scr
2013-05-09 08:58 . 2009-06-25 02:46 229648 —-a-w- c:\windows\system32\aswBoot.exe
2013-05-09 05:28 . 2006-10-19 02:47 1543680 ——w- c:\windows\system32\wmvdecod.dll
2013-05-03 01:26 . 2003-09-18 06:08 2193536 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 00:38 . 2002-08-29 08:04 2070144 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-07-29 10:41 . 2009-07-23 17:57 661352 -c–a-w- c:\program files\autoruns.exe
2009-07-29 10:41 . 2009-07-23 17:57 553832 -c–a-w- c:\program files\autorunsc.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LWBMOUSE"="c:\program files\Tech\MagicBall\1.1\LWBWHEEL.exe" [2001-07-31 435712]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2004-11-02 126976]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled\
Updates from HP.lnk - c:\program files\Updates from HP\137903\Program\BackWeb-137903.exe -startup [2003-8-23 16384]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2003-6-18 53248]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 15:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-05-03 06:19 323584 -c–a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2006-02-14 09:32 507904 -c–a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SymWSC"=2 (0x2)
"navapsvc"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\wjview.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\File Type Assistant\\tsassist.exe"=
.
S0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [4/14/2013 5:39 AM 49376]
S0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [4/14/2013 5:39 AM 175176]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [4/14/2013 5:39 AM 770344]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/24/2009 9:46 PM 369584]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/4/2009 3:38 PM 327688]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/4/2009 3:38 PM 108552]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/24/2009 9:46 PM 29816]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [4/14/2013 5:39 AM 66336]
S2 mrtRate;mrtRate; [x]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 00:47 1173456 —-a-w- c:\program files\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-18 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\Alwil Software\Avast5\AvastEmUpdate.exe [2013-04-14 08:58]
.
2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-20 10:15]
.
2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-20 10:15]
.
2013-07-18 c:\windows\Tasks\ProgramRefresh-ATFST.job
- c:\program files\File Type Assistant\TSASetup.exe [2013-06-29 18:10]
.
2013-07-18 c:\windows\Tasks\ProgramUpdateCheck.job
- c:\program files\File Type Assistant\tsassist.exe [2013-06-29 18:09]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/advanced_search?hl=en
uDefault_Search_URL = hxxp://srch-us9.hpwis.com/
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"
uInternet Settings,ProxyOverride = localhost
uSearchAssistant = hxxp://www.the818search-co.com/sp2.php
TCP: DhcpNameServer = [removed] [removed]
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-18 09:56
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
[1].sys"
.
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\rootrepeal[1]]
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Shared Tools\MSConfig\startupreg\¢ 0 ¸ u 0 4 C
} ï Á z î [ 8 C : \Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="fktltll"
"hkey"="HKLM"
"inimapping"="0"
.
Completion time: 2013-07-18 09:59:47
ComboFix-quarantined-files.txt 2013-07-18 14:59
ComboFix2.txt 2013-07-18 14:19
ComboFix3.txt 2013-07-18 13:05
.
Pre-Run: 14,719,266,816 bytes free
Post-Run: 14,692,380,672 bytes free
.
- - End Of File - - C70BA4B9CF0106FF5B9A139F50026CAD
B716B775FCBDABF0E2DDFF76F15C6790
Just commenting that my icon tray where avast should be is still empty.
Also, of course it goes without saying that I would like anything to do with AVG to disappear completely if it can be found.
I appreciate your patience with me so much!
Thank You, \
Nan
Is this what you need?
ComboFix 13-07-18.01 - Owner 07/18/2013 9:44.4.1 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1271.895 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Anti-Virus Free *Enabled/Outdated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\documents and settings\Default User\Start Menu\Programs\Startup\AutoTBar.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Owner\Application Data\Systweak
c:\program files\MyPC Backup
c:\program files\MyPC Backup\DEL_AWSSDK.dll
c:\program files\MyPC Backup\DEL_GetText.dll
c:\program files\MyPC Backup\DEL_MPCBClient.dll
c:\program files\MyPC Backup\DEL_MyPC Backup.exe
c:\program files\MyPC Backup\DEL_Shared Stack.dll
c:\program files\MyPC Backup\DEL_UnRegisterExtensions.exe
c:\program files\MyPC Backup\x86\System.Data.SQLite.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 )))))))))))))))))))))))))))))))
.
.
2013-07-16 11:10 . 2013-07-16 11:10 ——– d—–w- C:\Badware removal
2013-07-16 09:17 . 2013-07-16 09:17 ——– d—–w- C:\hjt
2013-07-15 21:19 . 2004-11-02 14:04 163840 —-a-w- c:\windows\system32\igfxrdan.lrc
2013-07-15 18:05 . 2013-07-15 18:05 45056 —ha-w- c:\windows\NCUNINST.EXE
2013-07-15 15:40 . 2013-07-15 15:40 ——– d—–w- c:\program files\ToniArts
2013-07-15 15:39 . 2004-07-16 05:20 69715 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
2013-07-15 15:39 . 2004-07-16 05:19 266240 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
2013-07-15 15:39 . 2004-07-16 05:18 172032 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
2013-07-15 15:39 . 2004-07-16 05:16 32768 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2013-07-15 15:39 . 2004-07-16 05:20 733184 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
2013-07-15 15:39 . 2004-07-16 05:18 5632 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
2013-07-15 15:39 . 2013-07-15 15:39 180356 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
2013-07-15 15:39 . 2013-07-15 15:39 303236 —-a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
2013-07-14 19:09 . 2013-07-14 19:15 ——– d—–w- c:\windows\system32\MRT
2013-07-07 01:35 . 2013-07-07 01:35 ——– d—–w- c:\windows\system32\wbem\Repository
2013-06-29 07:09 . 2013-07-18 07:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\FileTypeAssistant
2013-06-29 07:07 . 2013-06-29 07:18 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\FileTypeAssistant
2013-06-29 07:07 . 2013-07-18 07:09 ——– d—–w- c:\program files\File Type Assistant
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-16 05:11 . 2013-04-14 10:39 770344 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2013-07-16 05:11 . 2013-04-14 10:39 175176 —-a-w- c:\windows\system32\drivers\aswVmm.sys
2013-07-16 05:11 . 2009-06-25 02:46 369584 —-a-w- c:\windows\system32\drivers\aswSP.sys
2013-06-08 04:55 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2013-06-07 21:56 . 2005-06-18 04:49 920064 —-a-w- c:\windows\system32\wininet.dll
2013-06-07 21:56 . 2003-09-18 07:10 43520 —-a-w- c:\windows\system32\licmgr10.dll
2013-06-07 21:56 . 2003-09-18 07:05 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-06-04 07:23 . 2002-12-12 14:14 562688 —-a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40 . 2003-09-18 06:10 1876736 —-a-w- c:\windows\system32\win32k.sys
2013-05-09 08:59 . 2013-04-14 10:39 49376 —-a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2009-06-25 02:46 56080 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2013-04-14 10:39 66336 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:59 . 2009-06-25 02:46 49760 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2013-05-09 08:59 . 2009-06-25 02:46 29816 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:58 . 2010-06-29 06:25 41664 —-a-w- c:\windows\avastSS.scr
2013-05-09 08:58 . 2009-06-25 02:46 229648 —-a-w- c:\windows\system32\aswBoot.exe
2013-05-09 05:28 . 2006-10-19 02:47 1543680 ——w- c:\windows\system32\wmvdecod.dll
2013-05-03 01:26 . 2003-09-18 06:08 2193536 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 00:38 . 2002-08-29 08:04 2070144 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-07-29 10:41 . 2009-07-23 17:57 661352 -c–a-w- c:\program files\autoruns.exe
2009-07-29 10:41 . 2009-07-23 17:57 553832 -c–a-w- c:\program files\autorunsc.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 121968 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-06-07 04:57 578512 —-a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LWBMOUSE"="c:\program files\Tech\MagicBall\1.1\LWBWHEEL.exe" [2001-07-31 435712]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2004-11-02 126976]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled\
Updates from HP.lnk - c:\program files\Updates from HP\137903\Program\BackWeb-137903.exe -startup [2003-8-23 16384]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2003-6-18 53248]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4C
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 15:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-05-03 06:19 323584 -c–a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2006-02-14 09:32 507904 -c–a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SymWSC"=2 (0x2)
"navapsvc"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\wjview.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\File Type Assistant\\tsassist.exe"=
.
S0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [4/14/2013 5:39 AM 49376]
S0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [4/14/2013 5:39 AM 175176]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [4/14/2013 5:39 AM 770344]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/24/2009 9:46 PM 369584]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/4/2009 3:38 PM 327688]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/4/2009 3:38 PM 108552]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/24/2009 9:46 PM 29816]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [4/14/2013 5:39 AM 66336]
S2 mrtRate;mrtRate; [x]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 00:47 1173456 —-a-w- c:\program files\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-18 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\Alwil Software\Avast5\AvastEmUpdate.exe [2013-04-14 08:58]
.
2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-20 10:15]
.
2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-20 10:15]
.
2013-07-18 c:\windows\Tasks\ProgramRefresh-ATFST.job
- c:\program files\File Type Assistant\TSASetup.exe [2013-06-29 18:10]
.
2013-07-18 c:\windows\Tasks\ProgramUpdateCheck.job
- c:\program files\File Type Assistant\tsassist.exe [2013-06-29 18:09]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/advanced_search?hl=en
uDefault_Search_URL = hxxp://srch-us9.hpwis.com/
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"
uInternet Settings,ProxyOverride = localhost
uSearchAssistant = hxxp://www.the818search-co.com/sp2.php
TCP: DhcpNameServer = [removed] [removed]
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-18 09:56
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
[1].sys"
.
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\rootrepeal[1]]
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Shared Tools\MSConfig\startupreg\¢ 0 ¸ u 0 4 C
} ï Á z î [ 8 C : \Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="fktltll"
"hkey"="HKLM"
"inimapping"="0"
.
Completion time: 2013-07-18 09:59:47
ComboFix-quarantined-files.txt 2013-07-18 14:59
ComboFix2.txt 2013-07-18 14:19
ComboFix3.txt 2013-07-18 13:05
.
Pre-Run: 14,719,266,816 bytes free
Post-Run: 14,692,380,672 bytes free
.
- - End Of File - - C70BA4B9CF0106FF5B9A139F50026CAD
B716B775FCBDABF0E2DDFF76F15C6790
Just commenting that my icon tray where avast should be is still empty.
Also, of course it goes without saying that I would like anything to do with AVG to disappear completely if it can be found.
I appreciate your patience with me so much!
Thank You, \
Nan
----------------
Yes, thats what we need! 
We´ll fix avast! later - first we have to get this virus out…
Scan with RogueKiller
Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
We´ll fix avast! later - first we have to get this virus out…
Scan with RogueKiller
Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
- Quit all programs that you may have started.
- Please disconnect any external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished …
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- You´ll find the log as RKreport[1].txt on your desktop also.
- Exit/Close RogueKiller.
No_More_Struggle
Hello There Marius, 
Goody, I got it right! I have just sent you a Private Message that is totally related to my system and it's problems but that I felt might not be appropriate to post here because of it's being personal to just MY system.
You may want to read it to see if you find anything helpful to you in it so your work might be a bit easier especially in deciding what to do next. I would love to be able to make it easier for you given all the patience you have shown with me.
In the meantime, I will now go and follow your latest instruction. I'm not sure whether I should also close this browser window also during the scan but it might be a good idea. It can't hurt. So I will be back soon.
Nan
Goody, I got it right! I have just sent you a Private Message that is totally related to my system and it's problems but that I felt might not be appropriate to post here because of it's being personal to just MY system.
You may want to read it to see if you find anything helpful to you in it so your work might be a bit easier especially in deciding what to do next. I would love to be able to make it easier for you given all the patience you have shown with me.
In the meantime, I will now go and follow your latest instruction. I'm not sure whether I should also close this browser window also during the scan but it might be a good idea. It can't hurt. So I will be back soon.
Nan
No_More_Struggle
Hi Marius,
When I was closing out of it, a dialog box asked if I was really sure I wanted to quit without deleting. Your instructions didn't say anything about deleting so I clicked yes and closed out and DID NOT delete what it found. I hope that was what you wanted.
Here is the log:
RogueKiller V8.6.3 [Jul 17 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Owner [Admin rights]
Mode : Scan – Date : 07/19/2013 06:25:53
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 2 ¤¤¤
[HJ POL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Scheduled tasks : 0 ¤¤¤
¤¤¤ Startup Entries : 0 ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
¤¤¤ External Hives: ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
–> %SystemRoot%\System32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD400EB-11CPF0 +++++
— User —
[MBR] 86a0d5297b273c1bb2d7da59499f7bf0
[BSP] 4fad7fac273bd84cfc1128669fa120fc : Legit.B MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 63 | Size: 5692 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 11657520 | Size: 32462 Mo
User = LL1 … OK!
User = LL2 … OK!
Finished : << RKreport[0]_S_07192013_062553.txt >>
When I was closing out of it, a dialog box asked if I was really sure I wanted to quit without deleting. Your instructions didn't say anything about deleting so I clicked yes and closed out and DID NOT delete what it found. I hope that was what you wanted.
Here is the log:
RogueKiller V8.6.3 [Jul 17 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Owner [Admin rights]
Mode : Scan – Date : 07/19/2013 06:25:53
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 2 ¤¤¤
[HJ POL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Scheduled tasks : 0 ¤¤¤
¤¤¤ Startup Entries : 0 ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
¤¤¤ External Hives: ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
–> %SystemRoot%\System32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD400EB-11CPF0 +++++
— User —
[MBR] 86a0d5297b273c1bb2d7da59499f7bf0
[BSP] 4fad7fac273bd84cfc1128669fa120fc : Legit.B MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 63 | Size: 5692 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 11657520 | Size: 32462 Mo
User = LL1 … OK!
User = LL2 … OK!
Finished : << RKreport[0]_S_07192013_062553.txt >>
----------------
I´ll have to get further advice. This may take some time, please be patient with me.
The infection requires careful reaction…
No_More_Struggle
Hello Marius,
This is perfectly fine with me. Take all the time that you need. Absolutely no worries, my friend.
I have COMPLETE CONFIDENCE IN YOUR ABILITY TO SOLVE THIS PROBLEM AND I KNOW THAT YOU WILL NO MATTER HOW LONG IT TAKES!
In the meantime, while you are researching this infection, may I do some things that might be helpful such as deleting the programs and the extra guest user that I absolutely do not want on my pc anyway? I will be careful and use only conventional (end user) methods to delete these things and take it slowly by rebooting a lot during it to see how the system is reacting and not deleting too many things at once without rebooting.
I know that it will change a lot of things but I am perfectly willing to re-run all of the tools so that you can get an updated look at what we are dealing with without having to read through so much garbage.
I will do anything I can to help, and would enjoy the opportunity to do so, but, because there is a notice in the instructions about this, I will not begin to proceed with any deletions until you give me permission to do so.
So please let me know if this is all right.
Thank You so much for your time!
Nan
P.S.
Have you had a chance to read the Private Message I sent you?
I sent you a Private Message that is totally related to my system and it's problems but that I felt might not be appropriate to post here because of it's being personal to just MY system.
You may want to read it to see if you find anything helpful to you in it so your work might be a bit easier especially in deciding what to do next. I would love to be able to make it easier for you given all the patience you have shown with me.
This is perfectly fine with me. Take all the time that you need. Absolutely no worries, my friend.
I have COMPLETE CONFIDENCE IN YOUR ABILITY TO SOLVE THIS PROBLEM AND I KNOW THAT YOU WILL NO MATTER HOW LONG IT TAKES!
In the meantime, while you are researching this infection, may I do some things that might be helpful such as deleting the programs and the extra guest user that I absolutely do not want on my pc anyway? I will be careful and use only conventional (end user) methods to delete these things and take it slowly by rebooting a lot during it to see how the system is reacting and not deleting too many things at once without rebooting.
I know that it will change a lot of things but I am perfectly willing to re-run all of the tools so that you can get an updated look at what we are dealing with without having to read through so much garbage.
I will do anything I can to help, and would enjoy the opportunity to do so, but, because there is a notice in the instructions about this, I will not begin to proceed with any deletions until you give me permission to do so.
So please let me know if this is all right.
Thank You so much for your time!
Nan
P.S.
Have you had a chance to read the Private Message I sent you?
I sent you a Private Message that is totally related to my system and it's problems but that I felt might not be appropriate to post here because of it's being personal to just MY system.
You may want to read it to see if you find anything helpful to you in it so your work might be a bit easier especially in deciding what to do next. I would love to be able to make it easier for you given all the patience you have shown with me.
----------------
I have no time to read personal messages because of the load of topics I have to manage, sorry.
Will have a look at it if I have some spare time due to the fact it contains information about your system.
Please attacht C:\combofix.txt to your next reply.
No_More_Struggle
Hi Marius, Just so I am clear on this since I did not see any instructions on how to run combo fix.
Are you wanting a copy of the one above? Or
Are you wanting me to run it again? Am I suppose to drag a script into it? How are the settings supposed to be on it. Should I try to use normal mode or safe mode? Remember the troubles we have because of the Hidden AVG and my corrupted AVAST?
I Guess since there is no script I will follow the same settings and directions from page 1 of this topic and If that is incorrect, give me a bit more detail about what you want and I will run it again. I will attempt it now.
Nan
----------------
no, don´t run it again. Just attach the existing C:\combofix.txt
No_More_Struggle
Hello Marius,
Please attacht C:\combofix.txt to your next reply.
It appears that I have made a misjudgement. Because the most recent ComboFix.txt (the one you liked because it took the script.) was posted above (Post #19), I assumed that you wanted another scan for some reason so I proceeded to try to get that for you.
This went very badly. I The computer slowed to an absolute crawl and finally stopped responding. I would get error messages and the browser would have to close. Then rebooting from a "serious error" and basically I couldn't go anywhere or do anything.
I'm afraid I finally had to use System Restore to get my system functioning. I only had to go back to the 16th of July (A restore Point I had set myself when things were going okay- (but I had planned to do some cleaning up of my PC and felt a restore point would be wise.) Alas, in my first clean-up activity - The Start-ups with easy Cleaner - I learned I had the mssams.exe worm.. and so stopped there and came here to What the tech.
Restoring to that date means that the tools were no longer on the desktop and any small bits of the infection we had gotten out so far were back but the PC was stable…. So, since I realized that I was going to have to start over and re-run tools and post fresh logs anyway, I decided to take care of a few things first.
I got a CD-r and backed up my documents and favorites and so forth.
I deleted some garbage that I will never use using safe (end user) methods.
I uninstalled and then reinstalled IE8 and then updated it.
I uninstalled the corrupted AVAST and I sort of used some NOT SO SAFE methods (after creating a new restore point) to OBLITERATE every reference to AVG from my PC that I could find since it could not be uninstalled in any other way I could find.
I am not at all certain that I got it all out but I DID get enough of it that now I can run the online scanning software and other tools without interference from any hidden anti-virus programs!
I made sure windows, microsoft and what bits of programs that I might like to keep were updated.
I Downloaded (from a link from here) a fresh malwarebytes, checked for updates, ran it and let it fix the items that it found.
I Downloaded (from a link from here) Super anti-spyware and let it get some bad guys that Antimalwarebytes missed.
Then, with no current AV protection and after adjusting my security settings in IE. I was FINALLY, FINALLY able to get the eset Online Scanner to work for me and it was moving along albeit slowly and after over 2 hours when it was well over half-way finished and it had found 7 things that were missed by the above tools, when the Electricity in my home Flashed off and on very quickly. … Very Frustrating.
I didn't have to reboot the PC but the scan stopped there. Thankfully it did save a record of what it had found at that point, but I have only deleted 2 of them because the other 5 are in C:Sytem Volume Information\_restore…and I didn't want to delete anything if I shouldn't.
From here, if it's all right with you, I'd like to (before I get new AV software) run a couple more user friendly tools and a get through at least one if not 2 or 3 online scans to see what is found. And then do a final clean up (temps and so forth) and come back here and run whichever tools you want me to and get fresh logs with less clutter and (hopefully with fewer pests) posted to you. :unsure This might take another day or so to finish up but I'm still here.
Nan
P.S. I have 2 questions:
1. Should I wait until after we finish cleaning to install the AV software? (I am only surfing 3 websites I trust and do have Super Anti-spyware running.)
2. Which tools would you like me to fresh download and post logs to you from? (Be sure and tell me if they have special instructions I need to follow.
)
----------------
I´m afraid but we have to start with the initial scans again as this system is in a completely different state…
Scan with DDS
Download DDS and save it to your desktop from here or here or
here.
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs
DDS.txt
Attach.txt
Save both reports to your desktop.
Scan with Gmer rootkit scanner
Please download Gmer from here by clicking on the "Download EXE" Button.
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
You told us that you removed several items with Malwarebytes´ Antimalware. This tool creates a log on every run and we need to see them.
Scan with DDS
Download DDS and save it to your desktop from here or here or
here.
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs
DDS.txt
Attach.txt
Save both reports to your desktop.
Scan with Gmer rootkit scanner
Please download Gmer from here by clicking on the "Download EXE" Button.
- Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
- If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
- In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Show All ( should be unchecked by default )
- Leave everything else as it is.
- Close all other running programs as well as your Browser.
- Click the Scan button & wait for it to finish.
- Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
- Save it where you can easily find it, such as your desktop.
- Please post the content of the ark.txt here.
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
You told us that you removed several items with Malwarebytes´ Antimalware. This tool creates a log on every run and we need to see them.
- The logs can be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt - Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
- Zip any and all of these logs and attach the file to your next reply.
----------------
Due to inactivity this topic will be closed.
If you need help please start a new thread.
New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic
If you need help please start a new thread.
New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI