[Inactive] Malware/Virus problem

Printable View

September 1st, 2010, 01:09 PM
starweb

[Inactive] Malware/Virus problem

My daughter's PC is infected. yes, I know the real problem is the loose nut behind the keyboard but, I need to move on from that. It seemed to be almost fixed but cannot access the internet. I have been using just about all my resources. They keep finding stuf and I fix it but, then I still can't get the internet. somethig has got to be redirecting it and I can't figure it out. The PC is running WinXP Svc. Pck 3 with current updates. AVG 9.0 free. I've used Super AntiSpyware Remover and Spybot SD from my Ultimate Boot CD. Hijack this, SmitFraud Fix, Rogue Remover, Malware Bytes, CCleaner.

any ideas?
September 1st, 2010, 01:40 PM
starweb

Ok, So

Looking at your instructions.
installed MalwareBytes from my jump drive.
cannot update because i can't get out to the internet.
ran it anyhow
here is the log:

Malwarebytes' Anti-Malware 1.28
Database version: 1134
Windows 5.1.2600 Service Pack 3

8/31/2010 10:21:25 PM
mbam-log-2010-08-31 (22-21-25).txt

Scan type: Quick Scan
Objects scanned: 43561
Time elapsed: 3 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
September 1st, 2010, 03:06 PM
Train

Will it now update in Safe Mode?
September 1st, 2010, 04:07 PM
Broni
Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

===========================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
September 1st, 2010, 04:34 PM
starweb

Quote:

Originally Posted by Train

Will it now update in Safe Mode?

Nope
September 1st, 2010, 04:35 PM
starweb

GMER scan in progress
September 1st, 2010, 08:00 PM
starweb

GMER scan is complete
here is the log file:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-01 16:59:09
Windows 5.1.2600 Service Pack 3
Running: b6sljwtr.exe; Driver: C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\pxtdypow.sys

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\DRIVERS\ati2mtag.sys section is writeable [0xB9027000, 0x198FE0, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
September 1st, 2010, 08:05 PM
starweb

Here is the MBR file

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000001fc

Kernel Drivers (total 120):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D0000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xBA0B8000 MountMgr.sys
0xB9F49000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F23000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0C8000 VolSnap.sys
0xB9F0B000 atapi.sys
0xBA0D8000 disk.sys
0xBA0E8000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xB9EEB000 fltmgr.sys
0xB9ED9000 sr.sys
0xB9EC2000 KSecDD.sys
0xB9E35000 Ntfs.sys
0xB9E08000 NDIS.sys
0xB9DEE000 Mup.sys
0xBA2B8000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xB9026000 \SystemRoot\System32\DRIVERS\ati2mtag.sys
0xB9012000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xBA3E8000 \SystemRoot\System32\DRIVERS\usbohci.sys
0xB8FEE000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xBA3F0000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xBA2C8000 \SystemRoot\System32\Drivers\Imapi.SYS
0xBA2D8000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xBA2E8000 \SystemRoot\System32\DRIVERS\redbook.sys
0xB8FCB000 \SystemRoot\System32\DRIVERS\ks.sys
0xBA570000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xB8FA3000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xBA2F8000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xBA3F8000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xBA400000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xB8F8F000 \SystemRoot\System32\DRIVERS\parport.sys
0xBA308000 \SystemRoot\System32\DRIVERS\serial.sys
0xBA578000 \SystemRoot\System32\DRIVERS\serenum.sys
0xB8F75000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0xB8F36000 \SystemRoot\System32\DRIVERS\HSFHWBS2.sys
0xB8E44000 \SystemRoot\System32\DRIVERS\HSF_DPV.sys
0xB8D92000 \SystemRoot\System32\DRIVERS\HSF_CNXT.sys
0xBA408000 \SystemRoot\System32\Drivers\Modem.SYS
0xBA699000 \SystemRoot\System32\DRIVERS\audstub.sys
0xBA318000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xBA580000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xB8D7B000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xB9535000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xB9525000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xBA410000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xB8D6A000 \SystemRoot\System32\DRIVERS\psched.sys
0xB9515000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xBA420000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xBA428000 \SystemRoot\System32\DRIVERS\raspti.sys
0xB8D3A000 \SystemRoot\System32\DRIVERS\rdpdr.sys
0xB9505000 \SystemRoot\System32\DRIVERS\termdd.sys
0xBA5CC000 \SystemRoot\System32\DRIVERS\swenum.sys
0xB8CB4000 \SystemRoot\System32\DRIVERS\update.sys
0xBA59C000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xB94E5000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xB94B5000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xBA5D0000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xB0736000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xB0712000 \SystemRoot\system32\drivers\portcls.sys
0xB94A5000 \SystemRoot\system32\drivers\drmk.sys
0xBA5DC000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA748000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5DE000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA458000 \SystemRoot\System32\drivers\vga.sys
0xBA5E0000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5E2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA460000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA468000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA544000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xB06DF000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xB0686000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xB066D000 \SystemRoot\System32\Drivers\avgtdix.sys
0xB0645000 \SystemRoot\System32\DRIVERS\netbt.sys
0xB0623000 \SystemRoot\System32\drivers\afd.sys
0xBA108000 \SystemRoot\System32\DRIVERS\netbios.sys
0xB05F8000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xB0560000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xBA128000 \SystemRoot\System32\Drivers\Fips.SYS
0xB053A000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xBA138000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xBA470000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xBA478000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xB04E9000 \SystemRoot\System32\Drivers\avgldx86.sys
0xBA198000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB04D1000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xBA602000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB9D95000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA4A8000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA7BC000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\ati2dvag.dll
0xBF061000 \SystemRoot\System32\ati2cqag.dll
0xBF0E9000 \SystemRoot\System32\atikvmag.dll
0xBF14F000 \SystemRoot\System32\atiok3x2.dll
0xBF18F000 \SystemRoot\System32\ati3duag.dll
0xBF4E6000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xAE0A9000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xADDFC000 \SystemRoot\system32\drivers\wdmaud.sys
0xADFF9000 \SystemRoot\system32\drivers\sysaudio.sys
0xADAFF000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xBA616000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xAD906000 \SystemRoot\System32\Drivers\HTTP.sys
0xADA13000 \SystemRoot\System32\DRIVERS\mdmxsdk.sys
0xAD797000 \SystemRoot\System32\DRIVERS\srv.sys
0xACF4D000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xACF0B000 \??\C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\pxtdypow.sys
0xACEE0000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 39):
0 System Idle Process
4 System
568 C:\WINDOWS\system32\smss.exe
632 csrss.exe
664 C:\WINDOWS\system32\winlogon.exe
708 C:\WINDOWS\system32\services.exe
720 C:\WINDOWS\system32\lsass.exe
880 C:\WINDOWS\system32\ati2evxx.exe
896 C:\WINDOWS\system32\svchost.exe
992 svchost.exe
1088 C:\WINDOWS\system32\svchost.exe
1144 svchost.exe
1232 svchost.exe
1256 C:\WINDOWS\system32\ati2evxx.exe
1508 C:\WINDOWS\system32\spoolsv.exe
1904 C:\WINDOWS\explorer.exe
1988 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
2028 C:\WINDOWS\RTHDCPL.EXE
168 C:\Program Files\iTunes\iTunesHelper.exe
196 C:\Program Files\Java\jre6\bin\jusched.exe
228 C:\PROGRA~1\AVG\AVG8\avgtray.exe
240 svchost.exe
260 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
280 C:\Program Files\MySpace\IM\MySpaceIM.exe
300 C:\WINDOWS\system32\ctfmon.exe
384 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
448 C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
488 C:\Program Files\Bonjour\mDNSResponder.exe
616 C:\Program Files\Java\jre6\bin\jqs.exe
1604 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
1956 C:\WINDOWS\system32\svchost.exe
2056 C:\Program Files\AVG\AVG8\avgrsx.exe
2088 C:\PROGRA~1\AVG\AVG8\avgnsx.exe
2284 C:\PROGRA~1\AVG\AVG8\avgemc.exe
2500 C:\Program Files\AVG\AVG8\avgcsrvx.exe
2996 C:\Program Files\iPod\bin\iPodService.exe
3284 alg.exe
2072 PresentationFontCache.exe
1788 C:\Documents and Settings\Stephanie1\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: ST3802110A, Rev: 3.AAE

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!
September 1st, 2010, 08:44 PM
starweb

Here is the ComboFix.txt

ComboFix 10-09-01.02 - Stephanie1 09/01/2010 17:31:51.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1917.1308 [GMT -7:00]
Running from: c:\documents and settings\Stephanie1\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((( Files Created from 2010-08-02 to 2010-09-02 )))))))))))))))))))))))))))))))
.

2010-09-01 05:16 . 2008-09-10 07:04 38528 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-01 05:16 . 2008-09-10 07:03 17200 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-01 05:16 . 2010-09-01 05:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-01 04:40 . 2010-09-01 05:09 -------- d-----w- c:\program files\Yahoo!
2010-08-31 03:37 . 2010-09-01 04:19 -------- d-----w- c:\documents and settings\Stephanie1\Local Settings\Application Data\xbboecrxc
2010-08-20 01:03 . 2010-08-20 01:03 664 ----a-w- c:\windows\system32\d3d9caps.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-02 00:14 . 2010-06-24 06:04 143176 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-09-02 00:12 . 2009-10-11 03:00 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-09-01 05:56 . 2009-05-25 04:39 -------- d-----w- c:\program files\RogueRemover FREE
2010-09-01 05:04 . 2008-06-02 23:44 -------- d-----w- c:\program files\Google
2010-09-01 05:04 . 2008-03-18 03:43 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-01 05:03 . 2008-03-18 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-09-01 05:02 . 2009-06-29 05:33 -------- d-----w- c:\program files\Pando Networks
2010-08-28 04:09 . 2008-03-18 04:48 -------- d-----w- c:\program files\World of Warcraft
2010-07-31 03:22 . 2010-07-31 03:22 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-07-31 03:22 . 2010-07-31 03:22 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-07-31 03:22 . 2010-07-31 03:22 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-07-31 03:22 . 2010-07-31 03:22 49152 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-07-31 03:22 . 2010-07-31 03:22 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-07-31 03:22 . 2010-07-31 03:22 308808 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-07-31 03:22 . 2010-07-31 03:22 40960 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-07-31 03:22 . 2010-07-31 03:22 341600 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-07-31 03:22 . 2010-07-31 03:22 14848 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-07-31 03:22 . 2009-07-27 03:45 -------- d-----w- c:\program files\Common Files\Real
2010-07-31 03:21 . 2008-03-18 04:47 -------- d-----w- c:\program files\Real
2010-07-31 03:20 . 2008-03-18 03:38 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-07-31 03:20 . 2008-03-18 03:38 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-07-30 20:05 . 2008-07-02 04:40 -------- d-----w- c:\program files\Warcraft III
2010-06-30 12:31 . 2001-08-23 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2001-08-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2001-08-23 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2001-08-23 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2001-08-23 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2008-03-17 04:21 744448 ----a-w- c:\windows\PCHEALTH\HELPCTR\Binaries\helpsvc.exe
2010-06-14 07:41 . 2001-08-23 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2009-12-01 6373376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14854144]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-02 289576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-07 136600]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-09 2048352]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-07-31 202256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2009-12-01 6373376]

c:\documents and settings\Stephanie1\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2009-11-14 0]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-10-11 03:04 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Documents and Settings\\Stephanie1\\Local Settings\\Apps\\2.0\\VWZMZ2A5.XQO\\B7QBA04K.CEN\\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\\CurseClient.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [10/10/2009 8:01 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [10/10/2009 8:01 PM 108552]
S4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [10/10/2009 8:00 PM 908056]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [10/10/2009 8:00 PM 297752]
.
Contents of the 'Scheduled Tasks' folder

2010-09-02 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1757981266-1563985344-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 10:02]

2010-08-28 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1757981266-1563985344-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 10:02]

2010-09-02 c:\windows\Tasks\USBCoinstallerTaskUserS-1-5-21-1757981266-1563985344-725345543-1003.job
- c:\windows\system32\USBCohyp.exe [2009-06-30 22:40]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:6522
.
- - - - ORPHANS REMOVED - - - -

SharedTaskScheduler-{A7C79C98-3091-42EA-9C45-4E356F244A90} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-01 17:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(676)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-09-01 17:38:02
ComboFix-quarantined-files.txt 2010-09-02 00:37

Pre-Run: 37,124,583,424 bytes free
Post-Run: 37,169,389,568 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 151A801A5B970B0EAFFFC6CFBCC7D432
September 1st, 2010, 09:05 PM
starweb

ok, so, after all that. not sure what fixed it. decided to remove Curse Client for WOW and now it works.
September 1st, 2010, 09:20 PM
Broni
Good :)

1. Please open Notepad
- Click Start , then Run
- Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

Folder:: c:\documents and settings\Stephanie1\Local Settings\Application Data\xbboecrxc DDS:: uInternet Settings,ProxyOverride = <local> uInternet Settings,ProxyServer = http=127.0.0.1:6522

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

https://discussions.virtualdr.com/im.../2016/03/2.gif

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
- Combofix.txt
September 1st, 2010, 10:22 PM
starweb

ok, but, I was unable to disable AVG.
September 1st, 2010, 10:26 PM
Broni

If you did, what you could to disable it, go ahead with my script.
September 1st, 2010, 11:22 PM
starweb

Ok, here's the latest

ComboFix 10-09-01.02 - Stephanie1 09/01/2010 20:12:26.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1917.1296 [GMT -7:00]
Running from: c:\documents and settings\Stephanie1\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Stephanie1\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Stephanie1\Local Settings\Application Data\xbboecrxc

.
((((((((((((((((((((((((( Files Created from 2010-08-02 to 2010-09-02 )))))))))))))))))))))))))))))))
.

2010-09-01 04:40 . 2010-09-01 05:09 -------- d-----w- c:\program files\Yahoo!
2010-08-20 01:03 . 2010-08-20 01:03 664 ----a-w- c:\windows\system32\d3d9caps.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-02 03:08 . 2009-10-11 03:00 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2010-09-02 02:20 . 2008-03-18 04:48 -------- d-----w- c:\program files\World of Warcraft
2010-09-02 00:48 . 2010-06-24 06:04 143176 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-09-02 00:46 . 2009-05-25 04:39 -------- d-----w- c:\program files\RogueRemover FREE
2010-09-01 05:04 . 2008-06-02 23:44 -------- d-----w- c:\program files\Google
2010-09-01 05:04 . 2008-03-18 03:43 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-01 05:03 . 2008-03-18 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-09-01 05:02 . 2009-06-29 05:33 -------- d-----w- c:\program files\Pando Networks
2010-07-31 03:22 . 2010-07-31 03:22 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-07-31 03:22 . 2010-07-31 03:22 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-07-31 03:22 . 2010-07-31 03:22 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-07-31 03:22 . 2010-07-31 03:22 49152 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-07-31 03:22 . 2010-07-31 03:22 45056 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-07-31 03:22 . 2010-07-31 03:22 308808 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-07-31 03:22 . 2010-07-31 03:22 40960 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
2010-07-31 03:22 . 2010-07-31 03:22 341600 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-07-31 03:22 . 2010-07-31 03:22 14848 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-07-31 03:22 . 2009-07-27 03:45 -------- d-----w- c:\program files\Common Files\Real
2010-07-31 03:21 . 2008-03-18 04:47 -------- d-----w- c:\program files\Real
2010-07-31 03:20 . 2008-03-18 03:38 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-07-31 03:20 . 2008-03-18 03:38 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-07-30 20:05 . 2008-07-02 04:40 -------- d-----w- c:\program files\Warcraft III
2010-06-30 12:31 . 2001-08-23 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2001-08-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2001-08-23 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2001-08-23 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2001-08-23 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2008-03-17 04:21 744448 ----a-w- c:\windows\PCHEALTH\HELPCTR\Binaries\helpsvc.exe
2010-06-14 07:41 . 2001-08-23 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-09-02_00.35.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-02 00:54 . 2010-09-02 00:54 16384 c:\windows\Temp\Perflib_Perfdata_f0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2009-12-01 6373376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 14854144]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-02 289576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-07 136600]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-09 2048352]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-07-31 202256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2009-12-01 6373376]

c:\documents and settings\Stephanie1\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2009-11-14 0]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-10-11 03:04 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Documents and Settings\\Stephanie1\\Local Settings\\Apps\\2.0\\VWZMZ2A5.XQO\\B7QBA04K.CEN\\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\\CurseClient.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [10/10/2009 8:01 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [10/10/2009 8:01 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [10/10/2009 8:00 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [10/10/2009 8:00 PM 297752]
.
Contents of the 'Scheduled Tasks' folder

2010-09-02 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1757981266-1563985344-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 10:02]

2010-08-28 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1757981266-1563985344-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 10:02]

2010-09-02 c:\windows\Tasks\USBCoinstallerTaskUserS-1-5-21-1757981266-1563985344-725345543-1003.job
- c:\windows\system32\USBCohyp.exe [2009-06-30 22:40]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-01 20:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(660)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2672)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-09-01 20:19:12
ComboFix-quarantined-files.txt 2010-09-02 03:19
ComboFix2.txt 2010-09-02 00:38

Pre-Run: 37,128,720,384 bytes free
Post-Run: 37,156,782,080 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 699CE46C556994EA923A93586A2DD5A6
September 2nd, 2010, 12:57 AM
Broni
How is computer doing?

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
March 25th, 2011, 11:14 PM
starweb

ok well I am back again

it's 6 months later and we are experiencing the same problems again. So, I will start with MalwareBytes and go from there.
March 25th, 2011, 11:39 PM
Broni

Please, start new topic and this time make sure, you don't leave in the middle of cleaning process.
If it'll happen again, you may not be able to receive any more help in malware forum.
I'm closing this topic.