[RESOLVED] Something is still infecting my laptop

Printable View

Show 40 post(s) from this thread on one page

January 1st, 2011, 08:38 PM
MPTech

[RESOLVED] Something is still infecting my laptop

I've had this laptop for a couple years, running XP Pro.
I noticed it getting slower lately, but a couple days ago it got SIGNIFICANTLY slower. So I ran a battery of AV programs. Started with CC-Cleaner, then MSE, Super Anti-Spyware, Malwarebytes, Microsoft Security Essentials, and AVG. And even a RegCleaner. I've also removed everything from the Startup (System Configuration Utilities) and ran Reg-XP.

I don't know what else to try, but it's hi-jacking my internet, particularly when I use a google search.

AV captured and gave me this message:
URL: thedeplace.com/stop/izxmxojt.php?ID=21427&fb=WVRveU9udHpPamc2SW5WelpYSmtZWFJoSWp0aE9qTTZlM002TWpvaWFXUWlPM002TmpvaU56a3lNVFV3SWp0ek9qRXlPaUpoWkhabGNuUnBj
MlZmYVdRaU8zTTZOam9pTVRBMk16WTVJanR6T2pRNkltdHdjR2tpTzA0N2ZYTTZNem9pYldRMUlqdHpPak15T2lJNFptVXlZamMwT1
Name: Phoenix Exploit Kit (type 1834)

I tried looking up "Phoenix Exploit Kit", but it hi-jacked my search, directing me to Stop-Zilla Anti Adware.

Please help.
Will hijackthis help? (I'll need to download it from another PC and copy it to a jump-drive)
January 2nd, 2011, 01:43 AM
Broni
Please, observe following rules:
- Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
- If you're stuck, or you're not sure about certain step, always ask before doing anything else.
- Please refrain from running tools or applying updates other than those I suggest.
- Never run more than one scan at a time.
- Keep updating me regarding your computer behavior, good, or bad.
- The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
- If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
- I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
=====================================================

Quote:

Microsoft Security Essentials, and AVG

If you're running two AV programs, one of them has to go.
If AVG (preferably), use this tool to remove it: http://www.avg.com/download-tools

===================================================

Quote:

And even a RegCleaner

Registry cleaners/optimizers are not recommended for several reasons:
- Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.
  
  The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
- Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
- Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
- Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
- The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".
Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.
- Ed Bott's Webog: Why I don’t use registry cleaners
- Do I need a Registry Cleaner?
===================================================

Please, complete all steps listed here: http://discussions.virtualdr.com/forumdisplay.php?f=71
January 2nd, 2011, 02:15 PM
MPTech

THANKS so much for your help!

OK, I deleted my Reg Cleaners and won’t use them again.
I also uninstalled AVG and ran the latest Malware:

------------------------------------------

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5443

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

1/2/2011 10:19:08 AM
mbam-log-2011-01-02 (10-19-08).txt

Scan type: Quick scan
Objects scanned: 169503
Time elapsed: 7 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 4
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\WINNT\system32\hny.dll (Worm.Koobface) -> Delete on reboot.

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00572D69-36F3-4459-A76E-B681ABC2C799} (Adware.MyFunCards) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{00572D69-36F3-4459-A76E-B681ABC2C799} (Adware.MyFunCards) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hhny (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hny (Worm.KoobFace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\hhny (Worm.KoobFace) -> Value: hhny -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\program files\myfuncards_3vei (Adware.MyFunCards) -> Quarantined and deleted successfully.
c:\program files\myfuncards_3vei\Installr (Adware.MyFunCards) -> Quarantined and deleted successfully.
c:\program files\myfuncards_3vei\Installr\1.bin (Adware.MyFunCards) -> Quarantined and deleted successfully.
c:\program files\myfuncards_3vei\Installr\1.bin\chrome (Adware.MyFunCards) -> Quarantined and deleted successfully.

Files Infected:
c:\WINNT\system32\hny.dll (Worm.Koobface) -> Delete on reboot.
c:\WINNT\5456456z (Koobface.Trace) -> Quarantined and deleted successfully.

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-02 11:30:26
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 Hitachi_HTS541040G9SA00 rev.MB2OC60R
Running: hm9m3uvq.exe; Driver: C:\WINNT\Profiles\mp9259\LOCALS~1\Temp\pgddyfoc.sys

---- User code sections - GMER 1.0.15 ----

.text C:\WINNT\System32\svchost.exe[1060] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 007D000A
.text C:\WINNT\System32\svchost.exe[1060] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 007E000A
.text C:\WINNT\System32\svchost.exe[1060] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 007C000C
.text C:\WINNT\System32\svchost.exe[1060] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00BF000A
.text C:\WINNT\system32\SearchIndexer.exe[3432] kernel32.dll!WriteFile 7C810D87 7 Bytes JMP 00D91B19 C:\WINNT\system32\mssrch.dll (mssrch.lib/Microsoft Corporation)
.text C:\WINNT\Explorer.EXE[3648] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00C1000A
.text C:\WINNT\Explorer.EXE[3648] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00C2000A
.text C:\WINNT\Explorer.EXE[3648] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00C0000C

---- Devices - GMER 1.0.15 ----

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

AttachedDevice \Driver\Tcpip \Device\Ip mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 86F6139B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 86F6139B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 86F6139B

AttachedDevice \Driver\Tcpip \Device\Udp mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp mvstdi5x.sys (Anti-Virus Mini-Firewall Driver/Network Associates, Inc.)

Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskHitachi_HTS541040G9SA00_________________MB2OC60R#5&1f698b3f&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5D3F62C5-928D-93D7-877F-4C2130FA86ED}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5D3F62C5-928D-93D7-877F-4C2130FA86ED}@nanomdfmnioemcjmmbdnnedooipk 0x6A 0x61 0x69 0x66 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5D3F62C5-928D-93D7-877F-4C2130FA86ED}@mapooccckjgbbjafpgmbbofpjd 0x69 0x61 0x68 0x66 ...

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 10: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 57: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 191):
0x804D7000 \WINNT\system32\ntoskrnl.exe
0x806EC000 \WINNT\system32\hal.dll
0x86EDF000 \WINNT\system32\KDCOM.DLL
0xF7B60000 \WINNT\system32\BOOTVID.dll
0xF76FD000 ACPI.sys
0xF7C4C000 \WINNT\system32\DRIVERS\WMILIB.SYS
0xF76EC000 pci.sys
0xF774C000 isapnp.sys
0xF7B64000 compbatt.sys
0xF7B68000 \WINNT\system32\DRIVERS\BATTC.SYS
0xF7D14000 pciide.sys
0xF79CC000 \WINNT\system32\DRIVERS\PCIIDEX.SYS
0xF7C4E000 aliide.sys
0xF7C50000 intelide.sys
0xF7C52000 toside.sys
0xF7C54000 viaide.sys
0xF7C56000 cmdide.sys
0xF76CE000 pcmcia.sys
0xF775C000 MountMgr.sys
0xF76AF000 ftdisk.sys
0xF7C58000 dmload.sys
0xF7689000 dmio.sys
0xF7B6C000 ACPIEC.sys
0xF7D15000 \WINNT\system32\DRIVERS\OPRGHDLR.SYS
0xF79D4000 PartMgr.sys
0xF776C000 VolSnap.sys
0xF7B70000 cpqarray.sys
0xF7671000 \WINNT\system32\DRIVERS\SCSIPORT.SYS
0xF7659000 atapi.sys
0xF7B74000 aha154x.sys
0xF79DC000 sparrow.sys
0xF7B78000 symc810.sys
0xF777C000 aic78xx.sys
0xF7B7C000 dac960nt.sys
0xF778C000 ql10wnt.sys
0xF7B80000 amsint.sys
0xF79E4000 asc.sys
0xF7B84000 asc3550.sys
0xF79EC000 mraid35x.sys
0xF79F4000 i2omp.sys
0xF7B88000 ini910u.sys
0xF779C000 ql1240.sys
0xF77AC000 aic78u2.sys
0xF79FC000 symc8xx.sys
0xF7A04000 sym_hi.sys
0xF7A0C000 sym_u3.sys
0xF7A14000 ABP480N5.SYS
0xF7A1C000 asc3350p.sys
0xF7C5A000 cd20xrnt.sys
0xF77BC000 ultra.sys
0xF7640000 adpu160m.sys
0xF7A24000 dpti2o.sys
0xF77CC000 ql1080.sys
0xF77DC000 ql1280.sys
0xF77EC000 ql12160.sys
0xF7A2C000 perc2.sys
0xF7C5C000 perc2hib.sys
0xF7A34000 hpn.sys
0xF7B8C000 cbidf2k.sys
0xF7614000 dac2w2k.sys
0xF77FC000 disk.sys
0xF780C000 \WINNT\system32\DRIVERS\CLASSPNP.SYS
0xF75F4000 fltMgr.sys
0xF75E2000 sr.sys
0xF75CD000 drvmcdb.sys
0xF7A3C000 PxHelp20.sys
0xF75B6000 KSecDD.sys
0xF7529000 Ntfs.sys
0xF74FC000 NDIS.sys
0xF781C000 sisagp.sys
0xF782C000 viaagp.sys
0xF74E1000 Mup.sys
0xF783C000 agp440.sys
0xF784C000 alim1541.sys
0xF785C000 amdagp.sys
0xF786C000 agpCPQ.sys
0xF7400000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF7470000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF746C000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF6A7D000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xF6A69000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF6A43000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF68A1000 \SystemRoot\system32\DRIVERS\NETw3x32.sys
0xF7A7C000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF687E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7A84000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF73F0000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF6863000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0xF7A8C000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7A94000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF73E0000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7464000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF73D0000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7C90000 \SystemRoot\system32\drivers\sscdbhk5.sys
0xF73C0000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF788C000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6840000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7A9C000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF6825000 \SystemRoot\system32\DRIVERS\dne2000.sys
0xF7D99000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7AA4000 \SystemRoot\system32\DRIVERS\rasirda.sys
0xF7AAC000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF789C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7C0C000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF680E000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF6FC1000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF6FB1000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7AB4000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF6C0B000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF67DD000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF6FA1000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7C92000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF67A9000 \SystemRoot\system32\DRIVERS\update.sys
0xF7C24000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF6F91000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xA7A31000 \SystemRoot\system32\drivers\sthda.sys
0xA7A0F000 \SystemRoot\system32\drivers\portcls.sys
0xAA6EB000 \SystemRoot\system32\drivers\drmk.sys
0xA79D5000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0xA78DE000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0xA7828000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0xF7B24000 \SystemRoot\System32\Drivers\Modem.SYS
0xAA6DB000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7CD4000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7CD6000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xA71EB000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0xF7D02000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7DC9000 \SystemRoot\System32\Drivers\Null.SYS
0xF7D04000 \SystemRoot\System32\Drivers\Beep.SYS
0xA77E8000 \SystemRoot\system32\drivers\ssrtln.sys
0xA77E0000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xA77D8000 \SystemRoot\System32\drivers\vga.sys
0xF7D06000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7D08000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7B2C000 \SystemRoot\System32\Drivers\Msfs.SYS
0xA7133000 \SystemRoot\System32\Drivers\Npfs.SYS
0xAA56F000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA41EA000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA7C0A000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xA4192000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA7BFA000 \SystemRoot\system32\drivers\mvstdi5x.sys
0xA416A000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA4148000 \SystemRoot\System32\drivers\afd.sys
0xA7BEA000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA4126000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
0xA712B000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xA40FB000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA4064000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA7BDA000 \SystemRoot\System32\Drivers\Fips.SYS
0xA4043000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xA7BCA000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xA6CC5000 \SystemRoot\system32\DRIVERS\usbccid.sys
0xA701A000 \SystemRoot\system32\DRIVERS\SMCLIB.SYS
0x9E66F000 \SystemRoot\System32\Drivers\Cdfs.SYS
0x9D490000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7D12000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0x9DB9B000 \SystemRoot\System32\drivers\Dxapi.sys
0x9E81B000 \SystemRoot\System32\watchdog.sys
0xBF9C3000 \SystemRoot\System32\drivers\dxg.sys
0x9D632000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF9E4000 \SystemRoot\System32\ialmdnt5.dll
0xBF9D5000 \SystemRoot\System32\ialmrnt5.dll
0xBFA06000 \SystemRoot\System32\ialmdev5.DLL
0xBFA41000 \SystemRoot\System32\ialmdd5.DLL
0x9D69D000 \SystemRoot\system32\drivers\drvnddm.sys
0xA28BF000 \SystemRoot\system32\dla\tfsndres.sys
0x9D47A000 \SystemRoot\system32\dla\tfsnifs.sys
0xA7C73000 \SystemRoot\system32\dla\tfsnopio.sys
0xF7C66000 \SystemRoot\system32\dla\tfsnpool.sys
0x9D621000 \SystemRoot\system32\dla\tfsnboio.sys
0x9D68D000 \SystemRoot\system32\dla\tfsncofs.sys
0xA28BE000 \SystemRoot\system32\dla\tfsndrct.sys
0x9D461000 \SystemRoot\system32\dla\tfsnudf.sys
0x9D448000 \SystemRoot\system32\dla\tfsnudfa.sys
0x9E10C000 \SystemRoot\system32\DRIVERS\AegisP.sys
0x9D432000 \SystemRoot\system32\DRIVERS\irda.sys
0xAAD26000 \SystemRoot\system32\DRIVERS\s24trans.sys
0x9F70A000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9D316000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0x9D1A1000 \??\C:\WINNT\system32\Drivers\CVPNDRVA.sys
0x9D127000 \SystemRoot\system32\DRIVERS\srv.sys
0x9CF82000 \SystemRoot\system32\drivers\wdmaud.sys
0x9D01F000 \SystemRoot\system32\drivers\sysaudio.sys
0x9D067000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0x9CA08000 \SystemRoot\system32\drivers\naiavf5x.sys
0x9CD9F000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys
0x9C440000 \SystemRoot\System32\Drivers\HTTP.sys
0x9BE38000 \??\C:\WINNT\Profiles\mp9259\LOCALS~1\Temp\pgddyfoc.sys
0x9BE0E000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINNT\system32\ntdll.dll

Processes (total 45):
0 System Idle Process
4 System
592 C:\WINNT\system32\smss.exe
640 csrss.exe
664 C:\WINNT\system32\winlogon.exe
712 C:\WINNT\system32\services.exe
724 C:\WINNT\system32\lsass.exe
896 C:\WINNT\system32\svchost.exe
976 svchost.exe
1172 C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
1252 C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
1292 C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
1372 svchost.exe
1416 svchost.exe
1720 C:\WINNT\system32\spoolsv.exe
1852 scardsvr.exe
152 C:\Program Files\DRU\bin\DRUService.exe
964 C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
984 C:\Program Files\Network Associates\VirusScan\mcshield.exe
1392 C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
1552 naPrdMgr.exe
2364 C:\Program Files\HP OpenView\Discovery Agent\bin32\discagnt.exe
2392 C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
2488 C:\WINNT\system32\rcmdsvc.exe
2540 C:\WINNT\system32\svchost.exe
2552 C:\Program Files\HP OpenView\Discovery Agent\Plugins\usage\discusge.exe
3488 alg.exe
3648 C:\WINNT\explorer.exe
472 C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
2880 C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
2824 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
3432 C:\WINNT\system32\searchindexer.exe
2812 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1560 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
2472 C:\WINNT\system32\CCM\CcmExec.exe
3312 C:\WINNT\system32\taskmgr.exe
3852 C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
3752 C:\WINNT\system32\ctfmon.exe
3756 C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe
2664 C:\WINNT\system32\svchost.exe
2856 C:\Program Files\Internet Explorer\iexplore.exe
3220 C:\Program Files\Internet Explorer\iexplore.exe
2832 C:\Program Files\Internet Explorer\iexplore.exe
2584 wmiprvse.exe
1360 C:\WINNT\Profiles\mp9259\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS541040G9SA00, Rev: MB2OC60R

Size Device Name MBR Status
--------------------------------------------
37 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!
January 2nd, 2011, 02:26 PM
MPTech

I'm having troubles replying with the DDS results.
I'll continue to try until I get it to post.
January 2nd, 2011, 02:27 PM
MPTech

DDS (Ver_10-12-12.02) - NTFSx86
Run by mp9259 at 12:02:03.30 on Sun 01/02/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.262 [GMT -6:00]

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

============== Running Processes ===============

C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRAM FILES\DRU\bin\DRUService.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\HP OpenView\Discovery Agent\bin32\discagnt.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINNT\system32\rcmdsvc.exe
C:\WINNT\system32\svchost.exe -k imgsvc
C:\Program Files\HP OpenView\Discovery Agent\Plugins\usage\discusge.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINNT\system32\SearchIndexer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\CCM\CcmExec.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINNT\system32\ctfmon.exe
c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe
C:\WINNT\System32\svchost.exe -k netsvcs
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\Profiles\mp9259\Desktop\dds.scr
January 2nd, 2011, 02:33 PM
MPTech

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie
uWindow Title = Microsoft Internet Explorer provided by SBC Services
uStart Page = hxxp://us.mg201.mail.yahoo.com/dc/launch?.partner=sbc&.gx=1&.rand=cgas9hhtqn3u1
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = <local>
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\reader\activex\AcroIEHelper.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\winnt\system32\dla\tfswshx.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {4E7BD74F-2B8D-469E-99FF-FD60BB9AAE2D} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {4E7BD74F-2B8D-469E-85A6-FD7CA39AB631} - No File
uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
January 2nd, 2011, 02:46 PM
MPTech

OK, I can't get the rest of it to post, I've tried multiple times and keep getting a message:

Quote:

Internet Explorer cannot display the webpage

any suggestions?
January 2nd, 2011, 03:11 PM
MPTech

Performance seems to have improved, but Google searches are still being hi-jacked / redirected.
January 2nd, 2011, 03:27 PM
Broni
It looks like we're dealing with a rootkit here...

Download TDSSKiller and save it to your desktop.
- Extract (unzip) its contents to your desktop.
- Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
- If an infected file is detected, the default action will be Cure, click on Continue.
- If a suspicious file is detected, the default action will be Skip, click on Continue.
- It may ask you to reboot the computer to complete the process. Click on Reboot Now.
- If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
- If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
January 2nd, 2011, 05:22 PM
MPTech

Appears to be working better, no hi-jacking / re-directing and the pages seem to be loading faster.

(when this is complete, what should I run to prevent it?)

2011/01/02 14:50:23.0374 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46
2011/01/02 14:50:23.0374 ================================================================================
2011/01/02 14:50:23.0374 SystemInfo:
2011/01/02 14:50:23.0374
2011/01/02 14:50:23.0374 OS Version: 5.1.2600 ServicePack: 2.0
2011/01/02 14:50:23.0374 Product type: Workstation
2011/01/02 14:50:23.0374 ComputerName: OBCPCMP9259
2011/01/02 14:50:23.0374 UserName: mp9259
2011/01/02 14:50:23.0374 Windows directory: C:\WINNT
2011/01/02 14:50:23.0374 System windows directory: C:\WINNT
2011/01/02 14:50:23.0374 Processor architecture: Intel x86
2011/01/02 14:50:23.0374 Number of processors: 1
2011/01/02 14:50:23.0374 Page size: 0x1000
2011/01/02 14:50:23.0374 Boot type: Normal boot
2011/01/02 14:50:23.0374 ================================================================================
2011/01/02 14:50:24.0416 Initialize success
2011/01/02 14:50:28.0702 ================================================================================
2011/01/02 14:50:28.0702 Scan started
2011/01/02 14:50:28.0702 Mode: Manual;
2011/01/02 14:50:28.0702 ================================================================================
2011/01/02 14:50:31.0265 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINNT\system32\DRIVERS\ABP480N5.SYS
2011/01/02 14:50:31.0966 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINNT\system32\DRIVERS\ACPI.sys
2011/01/02 14:50:32.0958 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINNT\system32\DRIVERS\ACPIEC.sys
2011/01/02 14:50:33.0909 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINNT\system32\DRIVERS\adpu160m.sys
2011/01/02 14:50:34.0790 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINNT\system32\drivers\aec.sys
2011/01/02 14:50:36.0243 AegisP (15e655baa989444f56787ef558823643) C:\WINNT\system32\DRIVERS\AegisP.sys
2011/01/02 14:50:36.0753 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINNT\System32\drivers\afd.sys
2011/01/02 14:50:37.0554 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINNT\system32\DRIVERS\agp440.sys
2011/01/02 14:50:38.0676 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINNT\system32\DRIVERS\agpCPQ.sys
2011/01/02 14:50:39.0768 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINNT\system32\DRIVERS\aha154x.sys
2011/01/02 14:50:40.0469 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINNT\system32\DRIVERS\aic78u2.sys
2011/01/02 14:50:40.0859 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINNT\system32\DRIVERS\aic78xx.sys
2011/01/02 14:50:41.0410 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINNT\system32\DRIVERS\aliide.sys
2011/01/02 14:50:41.0861 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINNT\system32\DRIVERS\alim1541.sys
2011/01/02 14:50:42.0271 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINNT\system32\DRIVERS\amdagp.sys
2011/01/02 14:50:42.0602 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINNT\system32\DRIVERS\amsint.sys
2011/01/02 14:50:43.0112 ApfiltrService (090880e9bf20f928bc341f96d27c019e) C:\WINNT\system32\DRIVERS\Apfiltr.sys
2011/01/02 14:50:43.0623 asc (62d318e9a0c8fc9b780008e724283707) C:\WINNT\system32\DRIVERS\asc.sys
2011/01/02 14:50:43.0944 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINNT\system32\DRIVERS\asc3350p.sys
2011/01/02 14:50:44.0254 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINNT\system32\DRIVERS\asc3550.sys
2011/01/02 14:50:44.0655 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINNT\system32\DRIVERS\asyncmac.sys
2011/01/02 14:50:45.0085 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINNT\system32\DRIVERS\atapi.sys
2011/01/02 14:50:46.0277 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINNT\system32\DRIVERS\atmarpc.sys
2011/01/02 14:50:47.0228 ATP (a05a3f5692a17f9b0353f0c64fbb103c) C:\WINNT\system32\DRIVERS\atpdrvr.sys
2011/01/02 14:50:48.0330 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINNT\system32\DRIVERS\audstub.sys
2011/01/02 14:50:49.0331 b57w2k (c0acd392ece55784884cc208aafa06ce) C:\WINNT\system32\DRIVERS\b57xp32.sys
2011/01/02 14:50:50.0653 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINNT\system32\drivers\Beep.sys
2011/01/02 14:50:51.0154 black (58b9f2b0a2da13f04734070b76ef9742) C:\WINNT\system32\drivers\BlackDrv.sys
2011/01/02 14:50:51.0905 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINNT\system32\DRIVERS\cbidf2k.sys
2011/01/02 14:50:52.0256 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINNT\system32\drivers\cbidf2k.sys
2011/01/02 14:50:52.0566 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINNT\system32\DRIVERS\cd20xrnt.sys
2011/01/02 14:50:52.0907 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINNT\system32\drivers\Cdaudio.sys
2011/01/02 14:50:53.0297 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINNT\system32\drivers\Cdfs.sys
2011/01/02 14:50:53.0758 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINNT\system32\DRIVERS\cdrom.sys
2011/01/02 14:50:54.0429 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINNT\system32\DRIVERS\CmBatt.sys
2011/01/02 14:50:54.0749 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINNT\system32\DRIVERS\cmdide.sys
2011/01/02 14:50:55.0040 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINNT\system32\DRIVERS\compbatt.sys
2011/01/02 14:50:55.0390 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINNT\system32\DRIVERS\cpqarray.sys
2011/01/02 14:50:55.0761 CVirtA (5c706c06c1279952d2cc1a609ca948bf) C:\WINNT\system32\DRIVERS\CVirtA.sys
2011/01/02 14:50:56.0392 CVPNDRVA (5ba042bcab6246c6bba51606afd7b488) C:\WINNT\system32\Drivers\CVPNDRVA.sys
2011/01/02 14:50:56.0932 cvspydr2 (c6644d1a70c050fdd7ecbe8c3ac05313) C:\WINNT\system32\DRIVERS\cvspydr2.sys
2011/01/02 14:50:57.0353 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINNT\system32\DRIVERS\dac2w2k.sys
2011/01/02 14:50:57.0763 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINNT\system32\DRIVERS\dac960nt.sys
2011/01/02 14:50:58.0144 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINNT\system32\DRIVERS\disk.sys
2011/01/02 14:50:58.0605 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINNT\system32\drivers\dmboot.sys
2011/01/02 14:50:59.0075 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINNT\system32\drivers\dmio.sys
2011/01/02 14:50:59.0436 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINNT\system32\drivers\dmload.sys
2011/01/02 14:50:59.0776 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINNT\system32\drivers\DMusic.sys
2011/01/02 14:51:00.0197 DNE (2eddbb3ef1dd5a28cb07c149d36e7286) C:\WINNT\system32\DRIVERS\dne2000.sys
2011/01/02 14:51:00.0547 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINNT\system32\DRIVERS\dpti2o.sys
2011/01/02 14:51:00.0898 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINNT\system32\drivers\drmkaud.sys
2011/01/02 14:51:01.0279 drvmcdb (b15f9e526ba511a48b1b1b8537815740) C:\WINNT\system32\drivers\drvmcdb.sys
2011/01/02 14:51:01.0729 drvnddm (fa4670cae95ae2bb857c68e535661145) C:\WINNT\system32\drivers\drvnddm.sys
2011/01/02 14:51:03.0271 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINNT\system32\drivers\Fastfat.sys
2011/01/02 14:51:03.0692 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINNT\system32\DRIVERS\fdc.sys
2011/01/02 14:51:04.0012 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINNT\system32\drivers\Fips.sys
2011/01/02 14:51:04.0333 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINNT\system32\drivers\Flpydisk.sys
2011/01/02 14:51:04.0724 FltMgr (54fd90f0038f07920cb9fb6591bde82f) C:\WINNT\system32\DRIVERS\fltMgr.sys
2011/01/02 14:51:05.0094 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINNT\system32\drivers\Fs_Rec.sys
2011/01/02 14:51:05.0515 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINNT\system32\DRIVERS\ftdisk.sys
2011/01/02 14:51:05.0925 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINNT\system32\Drivers\GEARAspiWDM.sys
2011/01/02 14:51:06.0346 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINNT\system32\DRIVERS\msgpc.sys
2011/01/02 14:51:06.0746 HDAudBus (e31363d186b3e1d7c4e9117884a6aee5) C:\WINNT\system32\DRIVERS\HDAudBus.sys
2011/01/02 14:51:07.0067 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINNT\system32\DRIVERS\hidusb.sys
2011/01/02 14:51:07.0457 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINNT\system32\DRIVERS\hpn.sys
2011/01/02 14:51:08.0259 HSF_DPV (e8ec1767ea315a39a0dd8989952ca0e9) C:\WINNT\system32\DRIVERS\HSX_DPV.sys
2011/01/02 14:51:09.0220 HSXHWAZL (61478fa42ee04562e7f11f4dca87e9c8) C:\WINNT\system32\DRIVERS\HSXHWAZL.sys
2011/01/02 14:51:09.0871 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINNT\system32\Drivers\HTTP.sys
2011/01/02 14:51:10.0402 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINNT\system32\drivers\i2omgmt.sys
2011/01/02 14:51:10.0792 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINNT\system32\DRIVERS\i2omp.sys
2011/01/02 14:51:11.0523 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINNT\system32\DRIVERS\i8042prt.sys
2011/01/02 14:51:12.0995 ialm (bb39146eaeaa07d3ea2ef0d07c8f9d21) C:\WINNT\system32\DRIVERS\ialmnt5.sys
2011/01/02 14:51:13.0987 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINNT\system32\DRIVERS\imapi.sys
2011/01/02 14:51:14.0347 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINNT\system32\DRIVERS\ini910u.sys
2011/01/02 14:51:14.0658 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINNT\system32\DRIVERS\intelide.sys
2011/01/02 14:51:14.0998 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINNT\system32\DRIVERS\intelppm.sys
2011/01/02 14:51:15.0339 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINNT\system32\DRIVERS\Ip6Fw.sys
2011/01/02 14:51:15.0749 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINNT\system32\DRIVERS\ipfltdrv.sys
2011/01/02 14:51:16.0060 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINNT\system32\DRIVERS\ipinip.sys
2011/01/02 14:51:16.0440 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINNT\system32\DRIVERS\ipnat.sys
2011/01/02 14:51:17.0021 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINNT\system32\DRIVERS\ipsec.sys
2011/01/02 14:51:17.0432 irda (86c204836feec22510d434982d4221b8) C:\WINNT\system32\DRIVERS\irda.sys
2011/01/02 14:51:17.0902 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINNT\system32\DRIVERS\irenum.sys
2011/01/02 14:51:18.0263 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINNT\system32\DRIVERS\isapnp.sys
2011/01/02 14:51:18.0593 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINNT\system32\DRIVERS\kbdclass.sys
2011/01/02 14:51:18.0914 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINNT\system32\DRIVERS\kbdhid.sys
2011/01/02 14:51:19.0335 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINNT\system32\drivers\kmixer.sys
2011/01/02 14:51:19.0765 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINNT\system32\drivers\KSecDD.sys
2011/01/02 14:51:20.0857 mdmxsdk (e246a32c445056996074a397da56e815) C:\WINNT\system32\DRIVERS\mdmxsdk.sys
2011/01/02 14:51:21.0217 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINNT\system32\drivers\mnmdd.sys
2011/01/02 14:51:21.0548 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINNT\system32\drivers\Modem.sys
2011/01/02 14:51:21.0998 motmodem (5023875a94b0766d98a62a72bc4cb055) C:\WINNT\system32\DRIVERS\motmodem.sys
2011/01/02 14:51:22.0349 Mouclass (34e1f0031153e491910e12551400192c) C:\WINNT\system32\DRIVERS\mouclass.sys
2011/01/02 14:51:22.0799 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINNT\system32\DRIVERS\mouhid.sys
2011/01/02 14:51:23.0160 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINNT\system32\drivers\MountMgr.sys
2011/01/02 14:51:23.0631 MpFilter (7e34bfa1a7b60bba1da03d677f16cd63) C:\WINNT\system32\DRIVERS\MpFilter.sys
2011/01/02 14:51:24.0191 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINNT\system32\DRIVERS\mraid35x.sys
2011/01/02 14:51:24.0632 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINNT\system32\DRIVERS\mrxdav.sys
2011/01/02 14:51:25.0573 MRxSmb (025af03ce51645c62f3b6907a7e2be5e) C:\WINNT\system32\DRIVERS\mrxsmb.sys
2011/01/02 14:51:26.0224 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINNT\system32\drivers\Msfs.sys
2011/01/02 14:51:26.0615 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINNT\system32\drivers\MSKSSRV.sys
2011/01/02 14:51:27.0086 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINNT\system32\drivers\MSPCLOCK.sys
2011/01/02 14:51:27.0406 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINNT\system32\drivers\MSPQM.sys
2011/01/02 14:51:27.0807 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINNT\system32\DRIVERS\mssmbios.sys
2011/01/02 14:51:28.0227 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINNT\system32\drivers\Mup.sys
2011/01/02 14:51:28.0918 NaiAvFilter1 (b7334eee4ad6d63daea7ce109a0dc7ae) C:\WINNT\system32\drivers\naiavf5x.sys
2011/01/02 14:51:29.0399 NaiAvTdi1 (091fe5ecd720eacd54a1d9abec2a0505) C:\WINNT\system32\drivers\mvstdi5x.sys
2011/01/02 14:51:29.0950 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINNT\system32\drivers\NDIS.sys
2011/01/02 14:51:30.0350 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINNT\system32\DRIVERS\ndistapi.sys
2011/01/02 14:51:30.0811 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINNT\system32\DRIVERS\ndisuio.sys
2011/01/02 14:51:31.0202 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINNT\system32\DRIVERS\ndiswan.sys
2011/01/02 14:51:31.0632 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINNT\system32\drivers\NDProxy.sys
2011/01/02 14:51:31.0993 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINNT\system32\DRIVERS\netbios.sys
2011/01/02 14:51:32.0413 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINNT\system32\DRIVERS\netbt.sys
2011/01/02 14:51:33.0795 NETw3x32 (3b9f072a0bec6dc3e047927458682723) C:\WINNT\system32\DRIVERS\NETw3x32.sys
2011/01/02 14:51:34.0977 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINNT\system32\drivers\Npfs.sys
2011/01/02 14:51:35.0688 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINNT\system32\drivers\Ntfs.sys
2011/01/02 14:51:36.0810 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINNT\system32\drivers\Null.sys
2011/01/02 14:51:37.0731 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINNT\system32\DRIVERS\nwlnkflt.sys
2011/01/02 14:51:38.0522 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINNT\system32\DRIVERS\nwlnkfwd.sys
2011/01/02 14:51:38.0943 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINNT\system32\DRIVERS\parport.sys
2011/01/02 14:51:39.0493 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINNT\system32\drivers\PartMgr.sys
2011/01/02 14:51:39.0844 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINNT\system32\drivers\ParVdm.sys
2011/01/02 14:51:40.0325 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINNT\system32\DRIVERS\pci.sys
2011/01/02 14:51:41.0296 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINNT\system32\DRIVERS\pciide.sys
2011/01/02 14:51:41.0817 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINNT\system32\DRIVERS\pcmcia.sys
2011/01/02 14:51:43.0740 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINNT\system32\DRIVERS\perc2.sys
2011/01/02 14:51:44.0150 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINNT\system32\DRIVERS\perc2hib.sys
2011/01/02 14:51:44.0651 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINNT\system32\DRIVERS\raspptp.sys
2011/01/02 14:51:45.0152 prepdrvr (9b322103efe09f5f4a957af62b0387b1) C:\WINNT\system32\CCM\prepdrv.sys
2011/01/02 14:51:46.0093 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINNT\system32\DRIVERS\ptilink.sys
2011/01/02 14:51:46.0504 PxHelp20 (30cbae0a34359f1cd19d1576245149ed) C:\WINNT\system32\Drivers\PxHelp20.sys
2011/01/02 14:51:47.0064 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINNT\system32\DRIVERS\ql1080.sys
2011/01/02 14:51:47.0755 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINNT\system32\DRIVERS\ql10wnt.sys
2011/01/02 14:51:48.0216 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINNT\system32\DRIVERS\ql12160.sys
2011/01/02 14:51:48.0777 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINNT\system32\DRIVERS\ql1240.sys
2011/01/02 14:51:49.0187 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINNT\system32\DRIVERS\ql1280.sys
2011/01/02 14:51:49.0658 RapFile (4a1dd4ccc5a08fee9b96e7b4f1368df6) C:\WINNT\system32\drivers\RapFile.sys
2011/01/02 14:51:50.0289 RapNet (dbbd61e13e5a7c5e9c2ccaf3c3a4e06d) C:\WINNT\system32\drivers\RapNet.sys
2011/01/02 14:51:50.0820 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINNT\system32\DRIVERS\rasacd.sys
2011/01/02 14:51:51.0270 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINNT\system32\DRIVERS\rasirda.sys
2011/01/02 14:51:51.0931 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINNT\system32\DRIVERS\rasl2tp.sys
2011/01/02 14:51:52.0632 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINNT\system32\DRIVERS\raspppoe.sys
2011/01/02 14:51:53.0053 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINNT\system32\DRIVERS\raspti.sys
2011/01/02 14:51:53.0544 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINNT\system32\DRIVERS\rdbss.sys
2011/01/02 14:51:54.0054 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINNT\system32\DRIVERS\RDPCDD.sys
2011/01/02 14:51:54.0615 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINNT\system32\DRIVERS\rdpdr.sys
2011/01/02 14:51:55.0206 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINNT\system32\drivers\RDPWD.sys
2011/01/02 14:51:55.0777 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINNT\system32\DRIVERS\redbook.sys
2011/01/02 14:51:56.0258 s24trans (2862adb14481ac28f98105ff33a99eb0) C:\WINNT\system32\DRIVERS\s24trans.sys
2011/01/02 14:51:56.0979 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/01/02 14:51:57.0209 SASENUM (7ce61c25c159f50f9eaf6d77fc83fa35) C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
2011/01/02 14:51:57.0399 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
2011/01/02 14:51:58.0110 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINNT\system32\DRIVERS\secdrv.sys
2011/01/02 14:51:58.0681 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINNT\system32\DRIVERS\serenum.sys
2011/01/02 14:51:59.0092 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINNT\system32\DRIVERS\serial.sys
2011/01/02 14:51:59.0522 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINNT\system32\DRIVERS\sfloppy.sys
2011/01/02 14:52:00.0434 sisagp (732d859b286da692119f286b21a2a114) C:\WINNT\system32\DRIVERS\sisagp.sys
2011/01/02 14:52:00.0884 SMCIRDA (707647a1aa0edb6cbef61b0c75c28ed3) C:\WINNT\system32\DRIVERS\smcirda.sys
2011/01/02 14:52:01.0225 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINNT\system32\DRIVERS\sparrow.sys
2011/01/02 14:52:01.0735 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINNT\system32\drivers\splitter.sys
2011/01/02 14:52:02.0477 sr (e41b6d037d6cd08461470af04500dc24) C:\WINNT\system32\DRIVERS\sr.sys
2011/01/02 14:52:03.0148 Srv (ea554a3ffc3f536fe8320eb38f5e4843) C:\WINNT\system32\DRIVERS\srv.sys
2011/01/02 14:52:04.0229 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINNT\system32\drivers\sscdbhk5.sys
2011/01/02 14:52:04.0760 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINNT\system32\drivers\ssrtln.sys
2011/01/02 14:52:06.0172 STHDA (3ad78e22210d3fbd9f76de84a8df19b5) C:\WINNT\system32\drivers\sthda.sys
2011/01/02 14:52:08.0716 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINNT\system32\DRIVERS\serscan.sys
2011/01/02 14:52:09.0587 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINNT\system32\DRIVERS\swenum.sys
2011/01/02 14:52:10.0598 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINNT\system32\drivers\swmidi.sys
2011/01/02 14:52:11.0379 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINNT\system32\DRIVERS\symc810.sys
2011/01/02 14:52:11.0980 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINNT\system32\DRIVERS\symc8xx.sys
2011/01/02 14:52:12.0431 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINNT\system32\DRIVERS\sym_hi.sys
2011/01/02 14:52:13.0202 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINNT\system32\DRIVERS\sym_u3.sys
2011/01/02 14:52:13.0753 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINNT\system32\drivers\sysaudio.sys
2011/01/02 14:52:14.0624 Tcpip (90caff4b094573449a0872a0f919b178) C:\WINNT\system32\DRIVERS\tcpip.sys
2011/01/02 14:52:15.0625 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINNT\system32\drivers\TDPIPE.sys
2011/01/02 14:52:16.0026 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINNT\system32\drivers\TDTCP.sys
2011/01/02 14:52:16.0647 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINNT\system32\DRIVERS\termdd.sys
2011/01/02 14:52:17.0568 tfsnboio (1d265cd2fb1673a0873bf8cec19ddc7f) C:\WINNT\system32\dla\tfsnboio.sys
2011/01/02 14:52:18.0159 tfsncofs (62e4901295e0467cac78e5b4b131ae5c) C:\WINNT\system32\dla\tfsncofs.sys
2011/01/02 14:52:18.0650 tfsndrct (a2f380f9252ab3464c859adf91eead9c) C:\WINNT\system32\dla\tfsndrct.sys
2011/01/02 14:52:19.0080 tfsndres (eee79bbefe9c6a2a3ce6c8753cfea950) C:\WINNT\system32\dla\tfsndres.sys
2011/01/02 14:52:19.0491 tfsnifs (9d644eb11fec9487450c4cfcd63a5df4) C:\WINNT\system32\dla\tfsnifs.sys
2011/01/02 14:52:20.0512 tfsnopio (e656af05c67edb7c0e9230a5df71ed1b) C:\WINNT\system32\dla\tfsnopio.sys
2011/01/02 14:52:21.0324 tfsnpool (64fccb9cce703ca507dffc3cebf6b2cb) C:\WINNT\system32\dla\tfsnpool.sys
2011/01/02 14:52:21.0834 tfsnudf (48bc9d8ab4e4b9bff70fb18e55cec3d6) C:\WINNT\system32\dla\tfsnudf.sys
2011/01/02 14:52:22.0295 tfsnudfa (79f60822224256b49bfc855da8d651d5) C:\WINNT\system32\dla\tfsnudfa.sys
2011/01/02 14:52:22.0956 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINNT\system32\DRIVERS\toside.sys
2011/01/02 14:52:23.0447 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINNT\system32\drivers\Udfs.sys
2011/01/02 14:52:24.0228 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINNT\system32\DRIVERS\ultra.sys
2011/01/02 14:52:24.0759 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINNT\system32\DRIVERS\update.sys
2011/01/02 14:52:25.0430 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINNT\system32\Drivers\usbaapl.sys
2011/01/02 14:52:25.0950 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINNT\system32\DRIVERS\usbccgp.sys
2011/01/02 14:52:26.0611 USBCCID (6b5e4d5e6e5ecd6acd14aed59768ce5c) C:\WINNT\system32\DRIVERS\usbccid.sys
2011/01/02 14:52:27.0452 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINNT\system32\DRIVERS\usbehci.sys
2011/01/02 14:52:28.0043 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINNT\system32\DRIVERS\usbhub.sys
2011/01/02 14:52:28.0554 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINNT\system32\DRIVERS\usbprint.sys
2011/01/02 14:52:29.0055 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINNT\system32\DRIVERS\usbscan.sys
2011/01/02 14:52:29.0696 usbstor (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINNT\system32\DRIVERS\USBSTOR.SYS
2011/01/02 14:52:30.0337 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINNT\system32\DRIVERS\usbuhci.sys
2011/01/02 14:52:31.0528 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINNT\System32\drivers\vga.sys
2011/01/02 14:52:32.0059 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINNT\system32\DRIVERS\viaagp.sys
2011/01/02 14:52:32.0670 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINNT\system32\DRIVERS\viaide.sys
2011/01/02 14:52:33.0251 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINNT\system32\drivers\VolSnap.sys
2011/01/02 14:52:33.0742 vsdatant (27b3dd12a19eec50220df15b64913dda) C:\WINNT\system32\vsdatant.sys
2011/01/02 14:52:34.0402 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINNT\system32\DRIVERS\wanarp.sys
2011/01/02 14:52:35.0224 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINNT\system32\DRIVERS\Wdf01000.sys
2011/01/02 14:52:36.0505 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINNT\system32\drivers\wdmaud.sys
2011/01/02 14:52:38.0198 winachsf (ba6b6fb242a6ba4068c8b763063beb63) C:\WINNT\system32\DRIVERS\HSX_CNXT.sys
2011/01/02 14:52:39.0510 WmiAcpi (ae2c8544e747c20062db27456ea2d67a) C:\WINNT\system32\DRIVERS\wmiacpi.sys
2011/01/02 14:52:40.0111 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINNT\system32\Drivers\wpdusb.sys
2011/01/02 14:52:40.0812 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINNT\system32\DRIVERS\WudfPf.sys
2011/01/02 14:52:41.0483 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINNT\system32\DRIVERS\wudfrd.sys
2011/01/02 14:52:41.0773 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/01/02 14:52:41.0783 ================================================================================
2011/01/02 14:52:41.0783 Scan finished
2011/01/02 14:52:41.0783 ================================================================================
2011/01/02 14:52:41.0803 Detected object count: 1
2011/01/02 14:57:41.0023 \HardDisk0 - will be cured after reboot
2011/01/02 14:57:41.0023 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/01/02 14:57:47.0753 Deinitialize success
January 2nd, 2011, 05:31 PM
Broni
Good job :)

Quote:

(when this is complete, what should I run to prevent it?)

I'll give you some hints at the end of this topic.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista or Windows 7 right-click on it and choose Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
- Do not reboot until instructed.
- If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
January 2nd, 2011, 07:14 PM
MPTech

OK, ComboFix completed:

ComboFix 11-01-02.02 - mp9259 01/02/2011 16:34:01.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.491 [GMT -6:00]
Running from: c:\winnt\Profiles\mp9259\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\winnt\Profiles\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\winnt\Profiles\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\winnt\Profiles\mp9259\libeay32.dll
c:\winnt\Profiles\mp9259\ssleay32.dll
c:\winnt\Profiles\mp9259\wget.exe
c:\winnt\system32\Thumbs.db

----- BITS: Possible infected sites -----

hxxp://TXDLLS8Y3FILE01:80
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_HHNY
-------\Legacy_HNY

((((((((((((((((((((((((( Files Created from 2010-12-02 to 2011-01-02 )))))))))))))))))))))))))))))))
.

2011-01-01 09:05 . 2011-01-01 09:05 -------- d-----w- C:\$AVG
2010-12-31 08:37 . 2011-01-02 03:54 -------- d-----w- c:\winnt\Profiles\All Users\Application Data\avg9
2010-12-31 05:42 . 2010-10-19 16:41 222080 ------w- c:\winnt\system32\MpSigStub.exe
2010-12-31 05:27 . 2010-12-31 05:27 -------- d--h--w- c:\winnt\$hf_mig$
2010-12-31 04:44 . 2010-12-31 04:44 -------- d-----w- c:\winnt\Profiles\mp9259\Application Data\Malwarebytes
2010-12-31 04:44 . 2010-12-21 00:09 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2010-12-31 04:44 . 2010-12-31 04:44 -------- d-----w- c:\winnt\Profiles\All Users\Application Data\Malwarebytes
2010-12-31 04:44 . 2010-12-31 04:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-31 04:44 . 2010-12-21 00:08 20952 ----a-w- c:\winnt\system32\drivers\mbam.sys
2010-12-31 03:35 . 2010-12-31 03:35 -------- d-sh--w- c:\winnt\Profiles\LocalService\PrivacIE
2010-12-31 03:13 . 2010-12-31 03:13 -------- d-sh--w- c:\winnt\Profiles\NetworkService\IETldCache
2010-12-24 04:00 . 2001-08-18 04:36 5632 ----a-w- c:\winnt\system32\ptpusb.dll
2010-12-24 04:00 . 2004-08-04 06:56 159232 ----a-w- c:\winnt\system32\ptpusd.dll
2010-12-24 04:00 . 2004-08-04 04:58 15104 -c--a-w- c:\winnt\system32\dllcache\usbscan.sys
2010-12-24 04:00 . 2004-08-04 04:58 15104 ----a-w- c:\winnt\system32\drivers\usbscan.sys
2010-12-24 02:44 . 2010-12-24 02:44 -------- d-----w- c:\program files\iPod
2010-12-24 02:43 . 2010-12-24 02:45 -------- d-----w- c:\winnt\Profiles\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-12-24 02:37 . 2010-12-24 02:37 -------- d-----w- c:\winnt\Profiles\mp9259\Local Settings\Application Data\Apple
2010-12-24 02:37 . 2010-12-24 02:37 -------- d-----w- c:\program files\Apple Software Update
2010-12-24 02:36 . 2010-09-28 21:44 41984 ----a-w- c:\winnt\system32\drivers\usbaapl.sys
2010-12-24 02:36 . 2010-09-28 21:44 4184352 ----a-w- c:\winnt\system32\usbaaplrc.dll
2010-12-24 02:35 . 2010-12-24 02:35 -------- d-----w- c:\program files\Bonjour
2010-12-24 02:35 . 2010-12-24 04:00 -------- d-----w- c:\winnt\Profiles\All Users\Application Data\Apple
2010-12-24 02:35 . 2010-12-24 02:44 -------- d-----w- c:\program files\Common Files\Apple
2010-12-20 00:03 . 2010-12-21 06:00 -------- d---a-w- c:\program files\MyFunCardsIE_3w
2010-12-16 04:15 . 2010-12-21 06:05 -------- d-----w- c:\winnt\SxsCaPendDel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2040-02-05 19:28 . 2005-06-02 13:10 9728 ----a-r- c:\winnt\system32\HPW9lmn.dll
2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\winnt\system32\QuickTimeVR.qtx
2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\winnt\system32\QuickTime.qts
2010-10-07 18:23 . 2010-10-07 18:23 91424 ----a-w- c:\winnt\system32\dnssd.dll
2010-10-07 18:23 . 2010-10-07 18:23 75040 ----a-w- c:\winnt\system32\jdns_sd.dll
2010-10-07 18:23 . 2010-10-07 18:23 197920 ----a-w- c:\winnt\system32\dnssdX.dll
2010-10-07 18:23 . 2010-10-07 18:23 107808 ----a-w- c:\winnt\system32\dns-sd.exe
1996-06-25 11:46 . 2007-04-20 14:01 518 -c--a-w- c:\program files\LAYOUT.REG
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-08-02 696320]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoAutoUpdate"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^WINNT^Profiles^All Users^Start Menu^Programs^Startup^Microsoft Office(1).lnk]
path=c:\winnt\Profiles\All Users\Start Menu\Programs\Startup\Microsoft Office(1).lnk
backup=c:\winnt\pss\Microsoft Office(1).lnkCommon Startup

[HKLM\~\startupfolder\C:^WINNT^Profiles^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\winnt\Profiles\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^WINNT^Profiles^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk]
path=c:\winnt\Profiles\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk
backup=c:\winnt\pss\Windows Desktop Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2005-10-07 20:13 176128 ----a-r- c:\program files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2007-04-04 01:50 1603152 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2007-05-15 01:01 644696 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 12:00 15360 ----a-w- c:\winnt\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-08-13 07:05 122939 ----a-w- c:\winnt\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW6]
2010-04-16 16:25 818288 ----a-w- c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2006-07-14 23:04 77824 ----a-w- c:\winnt\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2006-07-14 23:08 118784 ----a-w- c:\winnt\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2006-07-14 23:07 94208 ----a-w- c:\winnt\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-02 06:38 802816 ----a-w- c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 23:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
2004-08-06 08:50 139320 ----a-w- c:\program files\Network Associates\Common Framework\UpdaterUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-04 06:06 1667584 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service]
2003-10-07 14:48 147514 ----a-w- c:\program files\Common Files\Network Associates\TalkBack\tbmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2007-02-04 18:02 79400 ----a-w- c:\program files\ScanSoft\OmniPageSE4\OpWareSE4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTIM.exe]
2009-01-31 03:30 210248 ----a-w- c:\program files\WebEx\Productivity Tools\PTIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ptmsgfrm.exe]
2009-01-31 03:30 42312 ----a-w- c:\program files\WebEx\Productivity Tools\ptmsgfrm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
2004-09-23 01:00 94208 ----a-w- c:\program files\Network Associates\VirusScan\shstat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2006-03-24 23:30 282624 ----a-w- c:\winnt\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 15:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-12-30 06:43 2424560 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2004-01-07 07:01 110592 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-09-14 02:07 328568 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VPN_MTU]
2006-04-20 13:34 218160 ----a-w- c:\program files\Cisco Systems\VPN Client\SetMTU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WrtMon.exe]
2006-09-20 14:35 20480 ----a-w- c:\winnt\system32\spool\drivers\w32x86\3\WrtMon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP OpenView\\Discovery Agent\\bin32\\discagnt.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8087:TCP"= 8087:TCP:hny

R1 NaiAvTdi1;NaiAvTdi1;c:\winnt\system32\drivers\mvstdi5x.sys [8/24/2005 7:16 AM 58048]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [1/5/2010 7:56 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 67656]
R2 Array_Utility_Service8.2.0.8;Array Utility Service 8,2,0,8;c:\program files\Array Networks\Common\8,2,0,8\arr_isrv.exe [11/21/2007 4:09 PM 303164]
R2 ArraySSL_VPN_Service8.2.0.8;Array SSL VPN Service 8,2,0,8;c:\program files\Array Networks\Array SSL VPN\8,2,0,8\arr_srvs.exe [11/21/2007 4:11 PM 188476]
R2 BlackICE;BlackICE;c:\program files\ISS\RSDP\blackd.exe [11/28/2010 11:59 AM 847872]
R2 DRUAgent;DRUAgent;c:\program files\DRU\bin\DRUService.exe [8/1/2007 10:55 AM 139264]
R2 prgnDiscAgent;HP OpenView Discovery Agent;c:\program files\HP OpenView\Discovery Agent\bin32\discagnt.exe [9/27/2007 10:03 PM 1048576]
R2 Remote Command Server;Remote Command Server;c:\winnt\system32\rcmdsvc.exe [3/19/2007 8:25 AM 41472]
R4 black;black;c:\winnt\system32\drivers\blackdrv.sys [3/8/2007 8:08 AM 229367]
S0 Lbd;Lbd;c:\winnt\system32\DRIVERS\Lbd.sys --> c:\winnt\system32\DRIVERS\Lbd.sys [?]
S3 ATP;ArrayNetworks SSL VPN Miniport Driver;c:\winnt\system32\drivers\atpdrvr.sys [11/21/2007 4:11 PM 16896]
S3 OracleORA92CLClientCache;OracleORA92CLClientCache;c:\oracle\ORA92CL\bin\ONRSD.EXE [4/26/2002 6:34 PM 242328]
S3 RapFile;RapFile;c:\winnt\system32\drivers\RapFile.sys [3/8/2007 8:08 AM 36676]
S3 RapNet;RapNet;c:\winnt\system32\drivers\RapNet.sys [3/8/2007 8:08 AM 24344]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 12872]
.
Contents of the 'Scheduled Tasks' folder

2011-01-02 c:\winnt\Tasks\User_Feed_Synchronization-{D8CFDF9C-73C7-4472-AC68-9BB8E221C515}.job
- c:\winnt\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://us.mg201.mail.yahoo.com/dc/launch?.partner=sbc&.gx=1&.rand=cgas9hhtqn3u1
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = <local>
Trusted Zone: amdocs.com
Trusted Zone: ameritech.com
Trusted Zone: pacbell.com
Trusted Zone: sbc.com
Trusted Zone: snet.com
Trusted Zone: amdocs.com
Trusted Zone: ameritech.com
Trusted Zone: pacbell.com
Trusted Zone: sbc.com
Trusted Zone: snet.com
TCP: {B213F37A-DA61-420E-9828-6024A3A6F761} = 10.26.48.70,10.8.0.7,10.26.252.70
DPF: {37775067-8350-11D4-A7DA-00C04F14FB69} - hxxp://frfntdap022.sbcdo.com/trackdoc/trkpm660ie.cab
DPF: {CCF028C4-4631-11D3-90BD-00A0C9B727E1} - hxxp://frfntdap022/vminet_images/vmi660ie.cab
FF - ProfilePath - c:\winnt\Profiles\mp9259\Application Data\Mozilla\Firefox\Profiles\5h90gysk.default\
FF - prefs.js: browser.startup.homepage - hxxp://gatewaycobraclub.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Personas for Firefox: [email protected]d - c:\program files\Mozilla Firefox\extensions\[email protected]
FF - Ext: CoolPreviews : {CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B} - %profile%\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-AVG9_TRAY - c:\progra~1\AVG\AVG9\avgtray.exe
MSConfigStartUp-dfg49df - c:\windows\mike148.exe
MSConfigStartUp-EPSON Stylus Photo R280 Series - c:\winnt\System32\spool\DRIVERS\W32X86\3\E_FATICKA.EXE
MSConfigStartUp-Gamevance - c:\program files\Gamevance\gamevance32.exe
MSConfigStartUp-MSC - c:\program files\Microsoft Security Client\msseces.exe
AddRemove-Array SSL VPN8,2,0,8 - c:\program files\Array Networks\Common\8
AddRemove-PVCS Version Manager Web Client - c:\utils\Logs\Installs\VMWebClient\Unwise32.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-02 17:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1085031214-1580818891-839522115-31566\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5D3F62C5-928D-93D7-877F-4C2130FA86ED}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"nanomdfmnioemcjmmbdnnedooipk"=hex:6a,61,69,66,64,70,66,62,6c,61,6b,66,6a,63,
70,62,6a,64,67,6c,00,07
"mapooccckjgbbjafpgmbbofpjd"=hex:69,61,68,66,67,70,70,62,61,62,68,69,65,6d,6c,
66,6c,70,00,ff

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(3976)
c:\winnt\system32\ieframe.dll
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\winnt\System32\SCardSvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\program files\Network Associates\VirusScan\mcshield.exe
c:\program files\Network Associates\VirusScan\vstskmgr.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\HP OpenView\Discovery Agent\Plugins\usage\discusge.exe
c:\winnt\system32\SearchIndexer.exe
c:\winnt\system32\CCM\CcmExec.exe
c:\winnt\system32\taskmgr.exe
.
**************************************************************************
.
Completion time: 2011-01-02 17:12:11 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-02 23:12

Pre-Run: 7,737,331,712 bytes free
Post-Run: 7,760,404,480 bytes free

- - End Of File - - E8AD6D386E3B776E6F72D1692477164F
January 2nd, 2011, 07:21 PM
Broni
1. Please open Notepad
- Click Start , then Run
- Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

Folder:: C:\$AVG c:\winnt\Profiles\All Users\Application Data\avg9 DDS:: uInternet Settings,ProxyOverride = <local> Trusted Zone: amdocs.com Trusted Zone: ameritech.com Trusted Zone: pacbell.com Trusted Zone: sbc.com Trusted Zone: snet.com Trusted Zone: amdocs.com Trusted Zone: ameritech.com Trusted Zone: pacbell.com Trusted Zone: sbc.com Trusted Zone: snet.com RegNull:: [HKEY_USERS\S-1-5-21-1085031214-1580818891-839522115-31566\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5D3F62C5-928D-93D7-877F-4C2130FA86ED}*]

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

https://discussions.virtualdr.com/im.../2016/03/2.gif

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
- Combofix.txt
January 2nd, 2011, 08:52 PM
MPTech

Ran the CFSScript, then reran ComboFix:
--------------------------------

ComboFix 11-01-02.02 - mp9259 01/02/2011 18:14:47.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.486 [GMT -6:00]
Running from: c:\winnt\Profiles\mp9259\Desktop\ComboFix.exe
Command switches used :: c:\winnt\Profiles\mp9259\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\$AVG
c:\$avg\$VAULT\V_00000001.fil
c:\$avg\$VAULT\V_00000002.fil
c:\$avg\$VAULT\V_00000003.fil
c:\$avg\$VAULT\vvfolder.idx
c:\winnt\Profiles\All Users\Application Data\avg9
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\changecfgreg.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\krnl.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\mail.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\malrep.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\scan.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\sched.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\setup.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\update.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\updatecomps.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Cfg\user.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\CfgAll\falsealarm.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\CfgAll\krnlall.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\CfgAll\updateall.cfg
c:\winnt\Profiles\All Users\Application Data\avg9\Log\7fb221ed-b19c-46d6-90f2-c845468ad7d9
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgcfg.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgcfg.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgchjw.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgchjw.log.1
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgchjw.log.2
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgchjw.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgchjwsrv.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgchjwsrv.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgcore.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgcore.log.1
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgcore.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgfrw.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgfrw.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgldr.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgldr.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avglng.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avglng.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgns.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgns.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.1
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.10
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.2
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.3
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.4
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.5
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.6
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.7
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.8
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.9
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgrs.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgscan.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgscan.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.1
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.2
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.3
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.4
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.5
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.6
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.7
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.8
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.9
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsched.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsrm.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsrm.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsrmacstat.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgsrmacstat.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgtdi.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgtdi.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgui.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgui.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avguilog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgupd.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgupd.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgwd.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgwd.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgwdsvc.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\avgwdsvc.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\cfgexlog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\cfglog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\commonpriv.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\commonpriv.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\corelog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\fixcfg.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\fixcfg.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\history.xml
c:\winnt\Profiles\All Users\Application Data\avg9\Log\ldrlog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\lnglog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\nslog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\privlog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\publog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\rslog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\scanlog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\schedlog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\srmlog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\updlog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\vault.log
c:\winnt\Profiles\All Users\Application Data\avg9\Log\vault.log.lock
c:\winnt\Profiles\All Users\Application Data\avg9\Log\vaultlog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\wdlog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\Log\wdsvclog.cfg.install_backup
c:\winnt\Profiles\All Users\Application Data\avg9\scanlogs\I_00000001.log
c:\winnt\Profiles\All Users\Application Data\avg9\scanlogs\I_00000003.log
c:\winnt\Profiles\All Users\Application Data\avg9\scanlogs\I_00000005.log
c:\winnt\Profiles\All Users\Application Data\avg9\scanlogs\I_00000006.log
c:\winnt\Profiles\All Users\Application Data\avg9\scanlogs\I_00000007.log
c:\winnt\Profiles\All Users\Application Data\avg9\scanlogs\srm.idx
c:\winnt\Profiles\All Users\Application Data\avg9\Temp\0bfd3c6e-7630-4f4b-ad67-0960138384c0-db4-oopp.tmp
c:\winnt\Profiles\All Users\Application Data\avg9\Temp\55ffa2c9-5618-4458-8728-67345ea14405-4d4-oopp.tmp
c:\winnt\Profiles\All Users\Application Data\avg9\Temp\7be8959f-8244-4ba0-b067-c1a74bc9be84-d58-oopp.tmp
c:\winnt\Profiles\All Users\Application Data\avg9\Temp\a66b5696-c0b0-4936-b414-179864434dea-4d8-oopp.tmp
c:\winnt\Profiles\All Users\Application Data\avg9\Temp\c313c8a9-3a5a-4b18-a6af-e9e6214be8b5-c14-oopp.tmp
c:\winnt\Profiles\All Users\Application Data\avg9\Temp\f2324ed6-5871-46e6-8c69-d53daf44f508-4d0-oopp.tmp
c:\winnt\Profiles\All Users\Application Data\avg9\Temp\fe9a4f88-0487-46a4-a875-f188d13cd473-f18-oopp.tmp
c:\winnt\Profiles\All Users\Application Data\avg9\Temp\file9514.tmp
c:\winnt\Profiles\All Users\Application Data\avg9\update\backup\incavi.avm
c:\winnt\Profiles\All Users\Application Data\avg9\update\backup\sb.dat
c:\winnt\Profiles\All Users\Application Data\avg9\update\backup\sb.dat.xcd
c:\winnt\Profiles\All Users\Application Data\avg9\update\backup\sb2.dat
c:\winnt\Profiles\All Users\Application Data\avg9\update\backup\sc.dat
c:\winnt\Profiles\All Users\Application Data\avg9\update\backup\sc.dat.xcd
c:\winnt\Profiles\mp9259\.exe

.
((((((((((((((((((((((((( Files Created from 2010-12-03 to 2011-01-03 )))))))))))))))))))))))))))))))
.

2011-01-02 22:25 . 2011-01-02 22:25 -------- d--h--w- c:\winnt\system32\GroupPolicy
2010-12-31 05:42 . 2010-10-19 16:41 222080 ------w- c:\winnt\system32\MpSigStub.exe
2010-12-31 05:27 . 2010-12-31 05:27 -------- d--h--w- c:\winnt\$hf_mig$
2010-12-31 04:44 . 2010-12-31 04:44 -------- d-----w- c:\winnt\Profiles\mp9259\Application Data\Malwarebytes
2010-12-31 04:44 . 2010-12-21 00:09 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2010-12-31 04:44 . 2010-12-31 04:44 -------- d-----w- c:\winnt\Profiles\All Users\Application Data\Malwarebytes
2010-12-31 04:44 . 2010-12-31 04:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-31 04:44 . 2010-12-21 00:08 20952 ----a-w- c:\winnt\system32\drivers\mbam.sys
2010-12-31 03:35 . 2010-12-31 03:35 -------- d-sh--w- c:\winnt\Profiles\LocalService\PrivacIE
2010-12-31 03:13 . 2010-12-31 03:13 -------- d-sh--w- c:\winnt\Profiles\NetworkService\IETldCache
2010-12-24 04:00 . 2001-08-18 04:36 5632 ----a-w- c:\winnt\system32\ptpusb.dll
2010-12-24 04:00 . 2004-08-04 06:56 159232 ----a-w- c:\winnt\system32\ptpusd.dll
2010-12-24 04:00 . 2004-08-04 04:58 15104 -c--a-w- c:\winnt\system32\dllcache\usbscan.sys
2010-12-24 04:00 . 2004-08-04 04:58 15104 ----a-w- c:\winnt\system32\drivers\usbscan.sys
2010-12-24 02:44 . 2010-12-24 02:44 -------- d-----w- c:\program files\iPod
2010-12-24 02:43 . 2010-12-24 02:45 -------- d-----w- c:\winnt\Profiles\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-12-24 02:37 . 2010-12-24 02:37 -------- d-----w- c:\winnt\Profiles\mp9259\Local Settings\Application Data\Apple
2010-12-24 02:37 . 2010-12-24 02:37 -------- d-----w- c:\program files\Apple Software Update
2010-12-24 02:36 . 2010-09-28 21:44 41984 ----a-w- c:\winnt\system32\drivers\usbaapl.sys
2010-12-24 02:36 . 2010-09-28 21:44 4184352 ----a-w- c:\winnt\system32\usbaaplrc.dll
2010-12-24 02:35 . 2010-12-24 02:35 -------- d-----w- c:\program files\Bonjour
2010-12-24 02:35 . 2010-12-24 04:00 -------- d-----w- c:\winnt\Profiles\All Users\Application Data\Apple
2010-12-24 02:35 . 2010-12-24 02:44 -------- d-----w- c:\program files\Common Files\Apple
2010-12-20 00:03 . 2010-12-21 06:00 -------- d---a-w- c:\program files\MyFunCardsIE_3w
2010-12-16 04:15 . 2010-12-21 06:05 -------- d-----w- c:\winnt\SxsCaPendDel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2040-02-05 19:28 . 2005-06-02 13:10 9728 ----a-r- c:\winnt\system32\HPW9lmn.dll
2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\winnt\system32\QuickTimeVR.qtx
2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\winnt\system32\QuickTime.qts
2010-10-07 18:23 . 2010-10-07 18:23 91424 ----a-w- c:\winnt\system32\dnssd.dll
2010-10-07 18:23 . 2010-10-07 18:23 75040 ----a-w- c:\winnt\system32\jdns_sd.dll
2010-10-07 18:23 . 2010-10-07 18:23 197920 ----a-w- c:\winnt\system32\dnssdX.dll
2010-10-07 18:23 . 2010-10-07 18:23 107808 ----a-w- c:\winnt\system32\dns-sd.exe
1996-06-25 11:46 . 2007-04-20 14:01 518 -c--a-w- c:\program files\LAYOUT.REG
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-08-02 696320]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoAutoUpdate"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^WINNT^Profiles^All Users^Start Menu^Programs^Startup^Microsoft Office(1).lnk]
path=c:\winnt\Profiles\All Users\Start Menu\Programs\Startup\Microsoft Office(1).lnk
backup=c:\winnt\pss\Microsoft Office(1).lnkCommon Startup

[HKLM\~\startupfolder\C:^WINNT^Profiles^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\winnt\Profiles\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^WINNT^Profiles^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk]
path=c:\winnt\Profiles\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk
backup=c:\winnt\pss\Windows Desktop Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2005-10-07 20:13 176128 ----a-r- c:\program files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2007-04-04 01:50 1603152 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]
2007-05-15 01:01 644696 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 12:00 15360 ----a-w- c:\winnt\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-08-13 07:05 122939 ----a-w- c:\winnt\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW6]
2010-04-16 16:25 818288 ----a-w- c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2006-07-14 23:04 77824 ----a-w- c:\winnt\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2006-07-14 23:08 118784 ----a-w- c:\winnt\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2006-07-14 23:07 94208 ----a-w- c:\winnt\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2006-08-02 06:38 802816 ----a-w- c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-12-13 23:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
2004-08-06 08:50 139320 ----a-w- c:\program files\Network Associates\Common Framework\UpdaterUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-04 06:06 1667584 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service]
2003-10-07 14:48 147514 ----a-w- c:\program files\Common Files\Network Associates\TalkBack\tbmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2007-02-04 18:02 79400 ----a-w- c:\program files\ScanSoft\OmniPageSE4\OpWareSE4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTIM.exe]
2009-01-31 03:30 210248 ----a-w- c:\program files\WebEx\Productivity Tools\PTIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ptmsgfrm.exe]
2009-01-31 03:30 42312 ----a-w- c:\program files\WebEx\Productivity Tools\ptmsgfrm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
2004-09-23 01:00 94208 ----a-w- c:\program files\Network Associates\VirusScan\shstat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2006-03-24 23:30 282624 ----a-w- c:\winnt\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 15:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-12-30 06:43 2424560 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2004-01-07 07:01 110592 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-09-14 02:07 328568 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VPN_MTU]
2006-04-20 13:34 218160 ----a-w- c:\program files\Cisco Systems\VPN Client\SetMTU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WrtMon.exe]
2006-09-20 14:35 20480 ----a-w- c:\winnt\system32\spool\drivers\w32x86\3\WrtMon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP OpenView\\Discovery Agent\\bin32\\discagnt.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8087:TCP"= 8087:TCP:hny

R1 NaiAvTdi1;NaiAvTdi1;c:\winnt\system32\drivers\mvstdi5x.sys [8/24/2005 7:16 AM 58048]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [1/5/2010 7:56 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 67656]
R2 Array_Utility_Service8.2.0.8;Array Utility Service 8,2,0,8;c:\program files\Array Networks\Common\8,2,0,8\arr_isrv.exe [11/21/2007 4:09 PM 303164]
R2 ArraySSL_VPN_Service8.2.0.8;Array SSL VPN Service 8,2,0,8;c:\program files\Array Networks\Array SSL VPN\8,2,0,8\arr_srvs.exe [11/21/2007 4:11 PM 188476]
R2 BlackICE;BlackICE;c:\program files\ISS\RSDP\blackd.exe [11/28/2010 11:59 AM 847872]
R2 DRUAgent;DRUAgent;c:\program files\DRU\bin\DRUService.exe [8/1/2007 10:55 AM 139264]
R2 prgnDiscAgent;HP OpenView Discovery Agent;c:\program files\HP OpenView\Discovery Agent\bin32\discagnt.exe [9/27/2007 10:03 PM 1048576]
R2 Remote Command Server;Remote Command Server;c:\winnt\system32\rcmdsvc.exe [3/19/2007 8:25 AM 41472]
R4 black;black;c:\winnt\system32\drivers\blackdrv.sys [3/8/2007 8:08 AM 229367]
S0 Lbd;Lbd;c:\winnt\system32\DRIVERS\Lbd.sys --> c:\winnt\system32\DRIVERS\Lbd.sys [?]
S3 ATP;ArrayNetworks SSL VPN Miniport Driver;c:\winnt\system32\drivers\atpdrvr.sys [11/21/2007 4:11 PM 16896]
S3 OracleORA92CLClientCache;OracleORA92CLClientCache;c:\oracle\ORA92CL\bin\ONRSD.EXE [4/26/2002 6:34 PM 242328]
S3 RapFile;RapFile;c:\winnt\system32\drivers\RapFile.sys [3/8/2007 8:08 AM 36676]
S3 RapNet;RapNet;c:\winnt\system32\drivers\RapNet.sys [3/8/2007 8:08 AM 24344]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 12872]
.
Contents of the 'Scheduled Tasks' folder

2011-01-02 c:\winnt\Tasks\User_Feed_Synchronization-{D8CFDF9C-73C7-4472-AC68-9BB8E221C515}.job
- c:\winnt\system32\msfeedssync.exe [2009-03-08 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://us.mg201.mail.yahoo.com/dc/launch?.partner=sbc&.gx=1&.rand=cgas9hhtqn3u1
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
TCP: {B213F37A-DA61-420E-9828-6024A3A6F761} = 10.26.48.70,10.8.0.7,10.26.252.70
DPF: {37775067-8350-11D4-A7DA-00C04F14FB69} - hxxp://frfntdap022.sbcdo.com/trackdoc/trkpm660ie.cab
DPF: {CCF028C4-4631-11D3-90BD-00A0C9B727E1} - hxxp://frfntdap022/vminet_images/vmi660ie.cab
FF - ProfilePath - c:\winnt\Profiles\mp9259\Application Data\Mozilla\Firefox\Profiles\5h90gysk.default\
FF - prefs.js: browser.startup.homepage - hxxp://gatewaycobraclub.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Personas for Firefox: [email protected]d - c:\program files\Mozilla Firefox\extensions\[email protected]
FF - Ext: CoolPreviews : {CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B} - %profile%\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-02 18:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2011-01-02 18:38:18
ComboFix-quarantined-files.txt 2011-01-03 00:38
ComboFix2.txt 2011-01-02 23:12

Pre-Run: 7,749,246,976 bytes free
Post-Run: 7,724,621,824 bytes free

- - End Of File - - B5AC7D2EC9ABFADA62D46BA9A7217D76
January 2nd, 2011, 09:02 PM
Broni
Good :)

How is computer doing?

Download OTL to your Desktop.
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Under the Custom Scan box paste this in:
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Show 40 post(s) from this thread on one page