weird startup - infection ???

Printable View

January 21st, 2010, 12:48 PM
Chercat

weird startup - infection ???

I had powered off the power strip to my computer last night which I never do / Today when I started the computer , instead of bringing me directly to Windows, something started running - I think it was ckdisk - it looked like DOS files and said something like Volume is dirty and started doing scans. I don't know if this was the Windows Recovery Console which I do have installed . Anyway , it recovered an oprhan file 74556 and deleted cm-9-p.dat and changed two other entries - I ddi not get to copy them all but one was an avg file .
Maybe I should have just shut off the computer but I didn't.

Anyway , I did scans of SAS , Malwarebytes , etc.- came up clean .
When I ran an AVG virus scan , found no viruses but these files came up LOCKED and so could not be scanned which seems suspicious ( could not copy and paste so wrote them down ) :
hiberfil.sys
pagefile.sys
C Windows \sys32\config
"" """" \DEFAULT
"" "" """ \SAM
"" " "" """ \SECURITY
"" """ """ \SOFTWARE
""" """" """" \SYSTEM

Here is my Malwarebytes log:

Malwarebytes' Anti-Malware 1.44
Database version: 3608
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/21/2010 11:05:51 AM
mbam-log-2010-01-21 (11-05-51).txt

Scan type: Full Scan (C:\|)
Objects scanned: 172559
Time elapsed: 29 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

SAS log :

RAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/21/2010 at 09:50 AM

Application Version : 4.32.1000

Core Rules Database Version : 4501
Trace Rules Database Version: 2314

Scan type : Custom Scan
Total Scan Time : 01:31:37

Memory items scanned : 372
Memory threats detected : 0
Registry items scanned : 3995
Registry threats detected : 0
File items scanned : 66070
File threats detected : 37

Adware.Tracking Cookie
C:\Documents and Settings\peaple\Cookies\[email protected][3].txt
C:\Documents and Settings\peaple\Cookies\[email protected][2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@pointroll[2].txt
C:\Documents and Settings\peaple\Cookies\peaple@realmedia[2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][2].txt
C:\Documents and Settings\peaple\Cookies\peaple@insightexpressai[2].txt
C:\Documents and Settings\peaple\Cookies\peaple@serving-sys[1].txt
C:\Documents and Settings\peaple\Cookies\peaple@revsci[1].txt
C:\Documents and Settings\peaple\Cookies\peaple@tribalfusion[1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@collective-media[1].txt
C:\Documents and Settings\peaple\Cookies\peaple@questionmarket[2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][3].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][2].txt
C:\Documents and Settings\peaple\Cookies\peaple@tacoda[1].txt
C:\Documents and Settings\peaple\Cookies\peaple@media6degrees[2].txt
C:\Documents and Settings\peaple\Cookies\peaple@interclick[1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][2].txt
C:\Documents and Settings\peaple\Cookies\peaple@specificmedia[1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][2].txt
C:\Documents and Settings\peaple\Cookies\peaple@2o7[2].txt
C:\Documents and Settings\peaple\Cookies\peaple@adinterax[1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@specificclick[2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@247realmedia[2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@interclick[2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@tribalfusion[2].txt ( all tracking cookes were deleted on reboot )

Hijackthis log : Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:35:03 AM, on 1/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=6070615
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1229636061953
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Filter hijack: text/html - {1526d1fb-f62f-455e-817e-1ba8756638f0} - (no file)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

--
End of file - 4601 bytes

Computer seems to be running fine but I don't trust it now : (

Anyone see anything suspicious and why would these files be locked and is there a way to UNLOCK them ?

Thanks for looking and for your help .
January 21st, 2010, 01:20 PM
Broni

Quote:

When I ran an AVG virus scan , found no viruses but these files came up LOCKED and so could not be scanned which seems suspicious ( could not copy and paste so wrote them down ) :
hiberfil.sys
pagefile.sys
C Windows \sys32\config

It's all normal. Those are safe Windows files and they're not being scanned, because they're in use.

I don't see any security issues here, so you may want to repost your issue at Windows section.

This would be important to post:

Quote:

I think it was chkdisk - it looked like DOS files and said something like Volume is dirty
January 21st, 2010, 01:24 PM
Chercat

thanks, Broni

Thanks, Broni .
I'll post it in the Windows section and see if anyone has any advice .
Good to know that nothing seems amiss regarding security anyway - I appreciate your taking a look . Thanks again !
January 21st, 2010, 01:28 PM
Broni

You're welcome :)
There is a simple procedure to fix "dirty volume" issue.
January 21st, 2010, 03:00 PM
Chercat

fake trojan-40 reg changes

Hi Broni ,
Well, I have REALLY been badly attacked , prob, precipitated by that weird scan .
After browsing awhile, I had gone to microsoft.com a few times for info.
Then I got something coming up pretending to be AVG doing a scan - said I had all kids of viruses and then got a message that my AVG was infected . AVG then said I was being attacked and asked if I wanted to close down .
I cannot get online now - I just keep getting a message that AVG is infected and that fake AV keeps scanning .

I am at the library computer bow - I don;t know what to do and am afraid to make things worse without advice . I was able to start in safe mode and am running SAS and Malwarebytes right now . Malwarebytes detected 3 trojans and is still running - SAS detected 40 (yikes)! reg changes and several trojans so far .

I hve the modem in standy and am not sure if I can get online in safe mode . I plan on letting SAS quarantine /delete everything and I know it will ask for a reboot to clean - should I do that in safe mode ?

I am afraid AVG is infected - should I dl another AV program ?

Thanks for looking .
January 21st, 2010, 03:04 PM
Broni

It's not the best idea to run both scans at the same time. Pause one of them.
When scans are done, post their logs and we'll go from there.
January 21st, 2010, 03:07 PM
Chercat

ok,thanks - I am not sure if I cn do that though since I am at the library now and not sure if I can get online again from home .
SHould I be able to go online in safe mode to post the logs ?
January 21st, 2010, 03:16 PM
Broni

You can use Safe Mode with Networking.
January 21st, 2010, 03:18 PM
Chercat

thanks

Ok,thanks , Broni -I 'll go home and try that and will post the logs as soon as I can get back online,either from home in safe mode or here at the library.
January 21st, 2010, 03:21 PM
Broni

No problem :)
January 21st, 2010, 09:26 PM
Chercat

logs for Broni

Broni,
Here are the scans I was able to complete while in safe mode -
I had been unable to log onto the internet until now - had to call Comcast and they spent about 40 mins. reconfiguring my settings, IP address, etc. Looks like the hackers had done something with the proxy settings , but ( hopefully) Comcast was able to fix that as I am finally online -

SAS
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/21/2010 at 03:03 PM

Application Version : 4.32.1000

Core Rules Database Version : 4501
Trace Rules Database Version: 2314

Scan type : Complete Scan
Total Scan Time : 01:32:58

Memory items scanned : 220
Memory threats detected : 0
Registry items scanned : 4018
Registry threats detected : 40
File items scanned : 66602
File threats detected : 22

Trojan.Agent/Gen-FakeSpy[Broad]
[udegswgu] C:\DOCUMENTS AND SETTINGS\PEAPLE\LOCAL SETTINGS\APPLICATION DATA\BVRHBT\SCXWSYSGUARD.EXE
C:\DOCUMENTS AND SETTINGS\PEAPLE\LOCAL SETTINGS\APPLICATION DATA\BVRHBT\SCXWSYSGUARD.EXE
[udegswgu] C:\DOCUMENTS AND SETTINGS\PEAPLE\LOCAL SETTINGS\APPLICATION DATA\BVRHBT\SCXWSYSGUARD.EXE
C:\WINDOWS\Prefetch\SCXWSYSGUARD.EXE-0FF6534E.pf

Adware.Tracking Cookie
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@serving-sys[2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@revsci[2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@247realmedia[1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\peaple@tacoda[1].txt
C:\Documents and Settings\peaple\Cookies\peaple@interclick[2].txt
C:\Documents and Settings\peaple\Cookies\[email protected][1].txt
C:\Documents and Settings\peaple\Cookies\[email protected][2].txt
C:\Documents and Settings\peaple\Cookies\peaple@specificmedia[1].txt
C:\Documents and Settings\peaple\Cookies\peaple@2o7[2].txt
C:\Documents and Settings\peaple\Cookies\peaple@adinterax[1].txt
C:\Documents and Settings\peaple\Cookies\peaple@specificclick[2].txt
C:\Documents and Settings\peaple\Cookies\peaple@tribalfusion[1].txt

Rogue.Agent/Gen
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#knkd
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#aazalirt
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#skaaanret
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#jungertab
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#zibaglertz
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#iddqdops
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#ronitfst
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#tobmygers
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#jikglond
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#tobykke
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#klopnidret
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#jiklagka
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#salrtybek
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#seeukluba
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#jrjakdsd
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#krkdkdkee
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#dkewiizkjdks
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#dkekkrkska
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#rkaskssd
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#kuruhccdsdd
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#krujmmwlrra
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#kkwknrbsggeg
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#ktknamwerr
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#iqmcnoeqz
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#ienotas
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#krkmahejdk
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#otpeppggq
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#krtawefg
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#oranerkka
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#kitiiwhaas
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#otowjdseww
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#otnnbektre
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#oropbbsee
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#irprokwks
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#ooorjaas
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#id
HKU\S-1-5-21-2279054146-2715818341-675255133-1006\SOFTWARE\AVSCAN#ready

Trojan.Dropper/Gen-C
C:\DOCUMENTS AND SETTINGS\PEAPLE\LOCAL SETTINGS\TEMP\E.EXE

then after cleaning and reboot :

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/21/2010 at 05:12 PM

Application Version : 4.32.1000

Core Rules Database Version : 4501
Trace Rules Database Version: 2314

Scan type : Complete Scan
Total Scan Time : 00:50:36

Memory items scanned : 203
Memory threats detected : 0
Registry items scanned : 4015
Registry threats detected : 0
File items scanned : 66606
File threats detected : 0

Malwarebytes log scanned next :
Scan type: Full Scan (C:\|)
Objects scanned: 172559
Time elapsed: 29 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hijackthis log :

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=6070615
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1229636061953
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Filter hijack: text/html - {1526d1fb-f62f-455e-817e-1ba8756638f0} - (no file)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

--
End of file - 4689 bytes

Thanks for all the help !
January 21st, 2010, 09:57 PM
Broni
The upper part of HJT log is cut off, so next time, make sure, you post a whole piece.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Please, never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE 1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
- Double click on combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
January 21st, 2010, 11:10 PM
Chercat

ComboFix

Thanks, Broni

I dl'd ComboFix to the desktop - I already have Windows Recovery console installed so if it asks, can I say No , I don't want it ?

How do I disable the AVG temporarily ?

Unfortunately , I have to go to work now ( graveyard worker :() , so I won't be able to run the combofix til sometime tomw. after I wake up

I'll get back to you ASAP and I really appreciate all your help . This forum is a godsend .
January 21st, 2010, 11:15 PM
Broni

Hey, no problem :)
If you have recovery console installed, Combo will know.
As for AVG, instructions are at "Click on this link" in my manual above.
January 21st, 2010, 11:21 PM
Chercat

thanks

Ok, thanks again , Broni .

Just read how to disable AVG 9 in your link and will do that tomw and run combo fixc and post back ,

Have a nice night .
January 21st, 2010, 11:29 PM
Broni

You too :)
January 22nd, 2010, 06:43 PM
Chercat

combo fix and hijack this new logs

Broni,

Here is my log from ComobFix:

ComboFix 10-01-21.08 - peaple 01/22/2010 17:23:58.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.613 [GMT -5:00]
Running from: c:\documents and settings\peaple\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Shared

.
((((((((((((((((((((((((( Files Created from 2009-12-22 to 2010-01-22 )))))))))))))))))))))))))))))))
.

2010-01-21 17:50 . 2010-01-21 21:19 -------- d-----w- c:\documents and settings\peaple\Local Settings\Application Data\bvrhbt
2010-01-21 13:10 . 2010-01-21 13:10 -------- d-----w- C:\found.000

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-21 13:14 . 2009-03-18 14:38 117760 ----a-w- c:\documents and settings\peaple\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-13 14:24 . 2008-10-02 16:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-13 14:24 . 2008-11-08 23:49 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-10 23:17 . 2009-12-19 20:13 52224 ----a-w- c:\documents and settings\peaple\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-07 21:07 . 2008-10-02 16:16 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2008-10-02 16:16 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 14:45 . 2009-11-22 22:13 3966744 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2009-12-30 22:34 . 2008-10-02 15:31 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-11-21 15:51 . 2004-08-10 16:50 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-17 20:29 . 2009-11-17 20:29 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-11-17 20:29 . 2009-11-17 20:29 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-11-17 20:29 . 2009-11-17 20:29 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-11-17 20:29 . 2009-11-17 20:29 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-10-29 07:45 . 2004-08-10 16:51 916480 ----a-w- c:\windows\system32\wininet.dll
2007-07-19 18:45 . 2007-06-28 00:21 7514 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-24 282624]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-12-31 2033432]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-11-05 13:18 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-17 20:29 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-08-29 01:57 395776 ----a-w- c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 09:20 122940 ----a-w- c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-10-05 07:12 94208 ----a-w- c:\program files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2006-07-21 20:50 86016 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2006-07-06 11:15 151552 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 20:50 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-01-07 21:07 1394000 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-12-30 22:34 2002160 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/17/2009 3:29 PM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/17/2009 3:29 PM 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [9/3/2008 1:07 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/3/2008 1:07 PM 74480]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [11/17/2009 3:28 PM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [11/17/2009 3:28 PM 285392]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/3/2008 1:07 PM 7408]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.comcast.net/
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-mcmscsvc
SafeBoot-MCODS
MSConfigStartUp-Corel Photo Downloader - c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
MSConfigStartUp-IS CfgWiz - c:\program files\Norton Internet Security\cfgwiz.exe
MSConfigStartUp-SSC_UserPrompt - c:\program files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
MSConfigStartUp-URLLSTCK - c:\program files\Norton Internet Security\UrlLstCk.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-22 17:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(1076)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-01-22 17:30:29
ComboFix-quarantined-files.txt 2010-01-22 22:30
ComboFix2.txt 2009-07-26 22:45

Pre-Run: 120,931,807,232 bytes free
Post-Run: 121,869,549,568 bytes free

- - End Of File - - BCB81A6C79F422C5349B2472B4DCA694

And here is the new hijackthislog:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:35:26 PM, on 1/22/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\stsystra.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=6070615
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1229636061953
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

--
End of file - 4354 bytes

Thanks for all the help!
January 22nd, 2010, 07:11 PM
Broni
Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Restart computer.

==============================================================

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
- Mail databases
6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt before clicking on the Save button. Then post it here.
January 22nd, 2010, 10:06 PM
Chercat

Kapersky scan

Wow - that took three hours ! I had to install the version of Java they asked for also .

Friday, January 22, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, January 23, 2010 00:31:09
Records in database: 3360162
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\

Scan statistics:
Objects scanned: 67743
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 01:33:01

File name / Threat / Threats count
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP103\A0035153.exe Infected: Trojan.Win32.FraudPack.akhq 1

Selected area has been scanned.
January 22nd, 2010, 10:37 PM
Broni

Your computer is clean https://discussions.virtualdr.com/

1. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.
January 22nd, 2010, 10:46 PM
Chercat

thanks, Broni

Thanks so much for hanging in there with me , Broni - I really appreciate all your help !

So, by turning off system restore and creating a new restore point, does that mean I can never restore my computer to factory settings , if needed ?
I would hate to ever have to start from square 1 ,but my daighter-in-law recently had to do that and she said she did it through the original system restore date somehow .

Also , when I check what processes are running there are a lot more than usual entries for AVG - and multiples . For ex,there are two avgcsrvx.exe items running , etc. Is the AVG corrupted from whatever the hackers did with all the reg .changes they made to control the AVG program ?

Thanks again for sharing all your knowledge and all your patience with the computer illiterates. : )
January 22nd, 2010, 10:53 PM
Broni

You're very welcome :)

Quote:

So, by turning off system restore and creating a new restore point, does that mean I can never restore my computer to factory settings , if needed ?

No.
You return computer to factory settings either by using recovery CD, or recovery partition.
System restore has nothing to do with it. System Restore deals only with system (Windows files).
Some infection will be still present in restore point, as you can see from Kaspersky scan:

Quote:

File name / Threat / Threats count
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP103\A0035153.exe Infected: Trojan.Win32.FraudPack.akhq 1

By turning system restore off and on, we remove all old restore points and we create fresh, clean restore point, so if you ever have to use system restore, you can be sure, no infected files are hanging out there.

Quote:

Also , when I check what processes are running there are a lot more than usual entries for AVG - and multiples .

This is normal.
January 22nd, 2010, 10:56 PM
Chercat

thanks for the info

Thanks , Broni, for all that information - that was really helpful and puts my mind more at ease .
Thanks again for saving my computer - I do really appreciate all your hard work . You're the best :)
January 22nd, 2010, 10:58 PM
Broni

Happy surfing :)