[RESOLVED] Internet Connection is Dialing Itself

Printable View

Show 40 post(s) from this thread on one page

June 20th, 2011, 08:20 PM
davidgsmith

[RESOLVED] Internet Connection is Dialing Itself

Hi Guys,& Gals,
Dell PC P4 2.8mhz 1 Ghz RAM.
Windows XP Pro SP3 with all updates.
Microsoft Security Essentials
Free version of Malware Bytes that I run regularly.

I use a Cricket wireless broadband modem that I plug into my USB port.
I have 'Tools-Options-Connections' set in IE8 to dial up whenever I open it up. Or I can click on my Cricket icon and click on 'CONNECT' which will also open up IE8.

In the last two weeks or so, I come home from work and turn my PC on. Then after about 3-5 minutes it seems, that my internet connection dials itself up.
Sometimes it shows the log-in dialogue box and sometimes it doesn't. If it does it just says it is dialing the number, and then I'm connected.

Where do I look to find out what is causing this. I am having no other problems with this computer, it is running just fine, and my browsing seems normal.
I did run Malware Bytes and it found nothing, and MSSEC has not found anything either.

That's all the relevant info I can think of.
How can I make this quit happening?

I humbly await any reply.
Thanks as always,
Dave
June 21st, 2011, 12:47 AM
Broni
Please, complete all steps listed here: http://discussions.virtualdr.com/sho...d.php?t=167915

Please, observe following rules:
- Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
- If you're stuck, or you're not sure about certain step, always ask before doing anything else.
- Please refrain from running tools or applying updates other than those I suggest.
- Never run more than one scan at a time.
- Keep updating me regarding your computer behavior, good, or bad.
- The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
- If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
- I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
June 21st, 2011, 07:27 PM
davidgsmith

I've read about these things here so many times and I never thought it would happen to me.
I'll get started this evening.

...Just started... looking over directions... after downloading DDS you say to disable any script blocking protection (if present) How do I know if I have that and how do I disable it?

I'll start on the first couple steps in the meantime.

Thanks
Dave
June 21st, 2011, 08:06 PM
Broni

Quote:

How do I know if I have that and how do I disable it?

Do you have Spybot, or Windows Defender running?
June 21st, 2011, 10:17 PM
davidgsmith

Thanks Broni,
No, I do not.

Dave
June 21st, 2011, 10:19 PM
Broni

Then go ahead.
June 21st, 2011, 10:23 PM
davidgsmith

OK Broni,
Here are the Malware and GMER results.
Both are very short, especially since GMER took almost a whole baseball game to run LOL...
It's late... can I continue this tomorrow?
I hope you say yes...

If I have to start over, I will
Dave

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6914

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

6/21/2011 8:11:12 PM
mbam-log-2011-06-21 (20-11-12).txt

Scan type: Quick scan
Objects scanned: 174032
Time elapsed: 8 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-06-21 22:07:43
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800EB-00DJF0 rev.77.07W77
Running: 46pdk4yp.exe; Driver: C:\DOCUME~1\Dave\LOCALS~1\Temp\pgliapoc.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

That's it for now,
Dave
June 21st, 2011, 10:24 PM
Broni

Go to bed :)
No rush....
June 21st, 2011, 10:27 PM
davidgsmith

Thanks for being there....
Goodnight
June 21st, 2011, 10:29 PM
Broni

Nite :)
June 22nd, 2011, 05:09 PM
davidgsmith

Hey Broni,
When I ran aswMBR.exe It asked me if I wanted to download the Avast Free Antivirus Definitions.... I said no.... If I needed to , I'll do this over.

Here is aswMBR.exe

aswMBR version 0.9.7.675 Copyright(c) 2011 AVAST Software
Run date: 2011-06-22 16:17:48
-----------------------------
16:17:48.640 OS Version: Windows 5.1.2600 Service Pack 3
16:17:48.640 Number of processors: 1 586 0x304
16:17:48.640 ComputerName: COMPUTER1 UserName: Dave
16:17:49.125 Initialize success
16:18:46.250 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
16:18:46.250 Disk 0 Vendor: WDC_WD800EB-00DJF0 77.07W77 Size: 76319MB BusType: 3
16:18:48.265 Disk 0 MBR read successfully
16:18:48.265 Disk 0 MBR scan
16:18:48.265 Disk 0 Windows XP default MBR code
16:18:50.265 Disk 0 scanning sectors +156280320
16:18:50.281 Disk 0 scanning C:\WINDOWS\system32\drivers
16:18:56.609 Service scanning
16:18:57.640 Disk 0 trace - called modules:
16:18:57.656 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
16:18:57.656 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86388ab8]
16:18:57.656 3 CLASSPNP.SYS[f74d7fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86369b00]
16:18:57.656 Scan finished successfully
16:19:21.093 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Dave\Desktop\MBR.dat"
16:19:21.093 The log file has been saved successfully to "C:\Documents and Settings\Dave\Desktop\aswMBR.txt"

Here is DDS.txt

.
DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Dave at 16:19:45 on 2011-06-22
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.576 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Outdated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\System32\svchost.exe -k eapsvcs
svchost.exe
C:\WINDOWS\System32\svchost.exe -k dot3svc
C:\WINDOWS\inf\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\stickies\stickies.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.thehungersite.com/clickToGive/home.faces?siteId=1
uInternet Connection Wizard,ShellNext = iexplore
mWinlogon: Shell=inf/Explorer.exe
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\stickies.lnk - c:\program files\stickies\stickies.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1278271014765
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} - hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\dave\application data\mozilla\firefox\profiles\045ulcui.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.thehungersite.com/clickToGive/home.faces?siteId=1
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\dave\local settings\application data\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: [email protected] - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: User Agent Switcher: {e968fc70-8f95-4ab9-9e79-304de2a71ee1} - %profile%\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsld1276cf2;MpKsld1276cf2;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{798f9b65-3dd2-4bce-abc0-2b21a84c66db}\MpKsld1276cf2.sys [2011-6-22 28752]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-6 67656]
R3 ATMFBUS;A600 USB Composite Device Driver;c:\windows\system32\drivers\ATMFBUS.sys [2010-7-4 47360]
R3 ATMFCVsp;A600 Cricket CM Port;c:\windows\system32\drivers\ATMFCVsp.sys [2010-7-4 153600]
R3 ATMFMdm;A600 Cricket EVDO Modem;c:\windows\system32\drivers\ATMFMdm.sys [2010-7-4 153472]
R3 ATMFNET;A600 Cricket EVDO Network Adapter;c:\windows\system32\drivers\ATMFNET.sys [2010-7-4 103424]
R3 ATMFNVsp;A600 Cricket NMEA Port Serial Port;c:\windows\system32\drivers\ATMFNVsp.sys [2010-7-4 153600]
R3 ATMFVsp;A600 Cricket Diagnostics Port;c:\windows\system32\drivers\ATMFVsp.sys [2010-7-4 153472]
S1 MpKsl5e374436;MpKsl5e374436;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{fced001e-29b4-4eeb-96ca-fcc0a4c6d691}\mpksl5e374436.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{fced001e-29b4-4eeb-96ca-fcc0a4c6d691}\MpKsl5e374436.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 ATMFFLT;A600 USB Modem Installation CD;c:\windows\system32\drivers\ATMFFLT.sys [2010-7-4 13312]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2011-06-22 21:13:44 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{798f9b65-3dd2-4bce-abc0-2b21a84c66db}\MpKsld1276cf2.sys
2011-06-22 03:11:51 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{798f9b65-3dd2-4bce-abc0-2b21a84c66db}\mpengine.dll
2011-06-15 21:39:51 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2011-06-01 14:19:06 -------- d-----w- c:\program files\locate32-3.1.10.08220
2011-06-01 14:11:21 -------- d-----w- c:\documents and settings\dave\application data\FastStone
2011-06-01 14:10:40 -------- d-----w- c:\program files\FastStone Image Viewer
2011-06-01 14:01:40 -------- d-----w- c:\documents and settings\dave\application data\Locate32
2011-05-24 13:55:21 3982240 ----a-w- c:\windows\system32\Flash10d.ocx
2011-05-24 13:55:20 -------- d-----w- c:\program files\StreamTransport
.
==================== Find3M ====================
.
2011-05-29 14:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 14:11:20 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-29 03:36:20 18944 ----a-w- c:\windows\system32\version.dll
2011-04-29 03:36:19 110080 ----a-w- c:\windows\system32\imm32.dll
2011-04-25 16:11:12 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11:11 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11:11 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01:22 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2011-04-11 22:59:35 952 --sha-w- c:\windows\system32\KGyGaAvL.sys
2011-04-11 22:59:35 56 --sh--r- c:\windows\system32\A6945B2C66.sys
2011-04-02 10:41:22 86016 ----a-w- c:\windows\system32\frapsvid.dll
.
============= FINISH: 16:20:38.04 ===============

I'll put Attach.txt in another post.
Dave
June 22nd, 2011, 05:13 PM
davidgsmith

Here is Attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-12.02)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 7/4/2010 1:59:41 AM
System Uptime: 6/22/2011 4:13:01 PM (0 hours ago)
.
Motherboard: Dell Computer Corp. | | 0F4491
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/533mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 9.63 GiB free.
D: is FIXED (NTFS) - 37 GiB total, 30.593 GiB free.
E: is CDROM ()
F: is CDROM (CDFS)
G: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: PCI Simple Communications Controller
Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200F14F1&REV_00\4&1C660DD6&0&08F0
Manufacturer:
Name: PCI Simple Communications Controller
PNP Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200F14F1&REV_00\4&1C660DD6&0&08F0
Service:
.
==== System Restore Points ===================
.
RP196: 5/23/2011 7:51:14 PM - System Checkpoint
RP197: 5/24/2011 9:31:15 PM - System Checkpoint
RP198: 5/26/2011 10:40:56 AM - System Checkpoint
RP199: 5/27/2011 3:41:57 AM - Software Distribution Service 3.0
RP200: 5/28/2011 9:27:27 AM - System Checkpoint
RP201: 5/29/2011 2:12:28 PM - System Checkpoint
RP202: 5/30/2011 2:51:00 PM - System Checkpoint
RP203: 5/31/2011 3:15:44 PM - System Checkpoint
RP204: 6/1/2011 8:43:01 PM - System Checkpoint
RP205: 6/2/2011 9:36:12 PM - System Checkpoint
RP206: 6/4/2011 8:39:54 AM - System Checkpoint
RP207: 6/5/2011 3:08:48 PM - System Checkpoint
RP208: 6/6/2011 4:45:30 PM - System Checkpoint
RP209: 6/7/2011 4:47:12 PM - System Checkpoint
RP210: 6/8/2011 6:13:53 PM - System Checkpoint
RP211: 6/9/2011 6:21:11 PM - System Checkpoint
RP212: 6/10/2011 10:04:59 AM - Software Distribution Service 3.0
RP213: 6/11/2011 4:46:23 PM - Software Distribution Service 3.0
RP214: 6/12/2011 7:27:07 PM - System Checkpoint
RP215: 6/13/2011 4:26:03 PM - Software Distribution Service 3.0
RP216: 6/14/2011 7:09:02 PM - Microsoft Antimalware Checkpoint
RP217: 6/14/2011 8:39:49 PM - Software Distribution Service 3.0
RP218: 6/15/2011 5:13:50 PM - Software Distribution Service 3.0
RP219: 6/15/2011 9:54:38 PM - Software Distribution Service 3.0
RP220: 6/17/2011 7:13:45 AM - System Checkpoint
RP221: 6/18/2011 3:28:08 PM - Software Distribution Service 3.0
RP222: 6/19/2011 4:57:33 AM - Software Distribution Service 3.0
RP223: 6/20/2011 4:22:25 PM - Software Distribution Service 3.0
RP224: 6/21/2011 5:14:48 PM - Software Distribution Service 3.0
.
==== Installed Programs ======================
.
100% Free Chess 7.30
100% Free Spades 5.46
3D Frog Frenzy
3D Ultra Pinball : The Lost Continent
688(I) Hunter-Killer
Adobe Acrobat 5.0
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.0.1)
Alarm 2.0.4
Arachnophilia version 4.0
Auslogics Disk Defrag
AVS Update Manager 1.0
AVS Video Converter 7
Beach Tranquility Screen Saver
Castle Poker Special Edition
Catechumen
CCleaner
Championship Gin All-Stars 7.40
CmdHere Powertoy For Windows XP
Coby Media Manager
Compatibility Pack for the 2007 Office system
Cricket Broadband 1.0
Cricket EVDO Modem
Dell ResourceCD
DivX Setup
FastStone Image Viewer 4.5
FileZilla Client 3.5.0
FreeCommander 2009.02a
GameRanger
Google Chrome
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB981793)
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
IrfanView (remove only)
Jack Nicklaus 6: Golden Bear Challenge
Java Auto Updater
Java(TM) 6 Update 22
MahJongg Master 3
Malwarebytes' Anti-Malware version 1.51.0.1200
MechWarrior Vengeance
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft English TTS Engine
Microsoft Midtown Madness 2
Microsoft Office Access database engine 2007 (English)
Microsoft Office FrontPage 2003
Microsoft Office Professional Edition 2003
Microsoft Plus! Game Pack: Cards and Puzzles
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft Streets & Trips 2010
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Virtual PC 2007 SP1
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable Package
Mozilla Firefox (3.6.13)
MSXML 6.0 Parser (KB927977)
Nero - Burning Rom (Web installer)
NexusFile (5.2.4.5245)
OGA Notifier 2.0.0048.0
OpenAL
OpenOffice.org 3.2
Paint Shop Pro 7
Pivot Stickfigure Animator
PowerDVD
Puzzle And Word Games
Riddle of the Sphinx(tm)
RPGXP
SAPI Wrapper
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Sierra On-Line Games (Remove only)
Sierra Utilities
SIW version 2010.07.14
SoundMAX
Stickies 7.0b
StreamTransport version: 1.0.2.2171
SUPERAntiSpyware Free Edition
TTS Wrapper
Tweak UI
U.S. Video Poker Special Edition
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
VDMSound 2.0.4
Virtual Pool Hall
WebFldrs XP
Western Video Poker
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Yahtzee
.
==== Event Viewer Messages From Past Week ========
.
6/21/2011 8:20:03 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
6/16/2011 6:45:37 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.105.1967.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6903.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
.
==== End Of File ===========================

I have to go to a meeting at 5:45pm eastern... be back around 7:00pm
Thanks again for doing this.
Dave
June 22nd, 2011, 08:01 PM
Broni

I still need GMER log.
June 22nd, 2011, 08:37 PM
davidgsmith

I posted it above with Malwarebytes... it was kind of short, but here it is again.

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-06-21 22:07:43
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800EB-00DJF0 rev.77.07W77
Running: 46pdk4yp.exe; Driver: C:\DOCUME~1\Dave\LOCALS~1\Temp\pgliapoc.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

I was suprised that this was all I got, since GMER ran for over 2 hours.
June 22nd, 2011, 09:09 PM
Broni
Sorry about that :)

Please download Rootkit Unhooker from one of the following links and save it to your desktop.
- Link 1 (.exe file)
  Link 2 (zipped file)
  Link 3 (.rar file)
In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can download, install and use the free 7-zip utility.
- Double-click on RKUnhookerLE.exe to start the program.
  Vista/Windows 7 users right-click and select Run As Administrator.
- Click the Report tab, then click Scan.
- Check Drivers, Stealth, and uncheck the rest.
- Click OK.
- Wait until it's finished and then go to File > Save Report.
- Save the report to your Desktop.
- Copy and paste the contents of the report into your next reply.
-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

====================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista or Windows 7 right-click on it and choose Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
- Do not reboot until instructed.
- If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Show 40 post(s) from this thread on one page