Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest
Suspected Virus/Malware
-
02-12-2009 9:25am#1
Comments
-
-
-
-
-
-
Advertisement
-
-
you need to tell the guys over at BC that you are being helped already so that their time isn't wasted
Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2- Ensure all Firefox windows are closed.
- To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
- When prompted to run the scan, click Yes.
- GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).
Download ComboFix from one of these locations:
Link 1
Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you don't know how to disable them then just continue on.
- Double click on ComboFix.exe & follow the prompts.
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.0 -
-
Here is my Combofix log:
ComboFix 09-12-02.07 - Chris 03/12/2009 14:06.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.511.106 [GMT 0:00]
Running from: c:\documents and settings\Chris\Desktop\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\John\Favorites\videos.url
c:\program files\Save Tube Video Company\SaveTubeVideoBurn\SaVEtubevideo.dll
c:\program files\Shared
c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\NetMonInstaller.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\recycler\S-1-5-21-329068152-1965331169-682003330-1003
c:\recycler\S-1-5-21-3360843823-2045485262-534579850-1003
c:\recycler\S-1-5-21-679383880-3442143225-1284630234-1003
c:\windows\system32\1683530099.dat
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
\Legacy_EAPHOST_HOTKEY_POLLER
\Legacy_NPF
\Service_EapHost HotKey Poller
\Service_NPF
((((((((((((((((((((((((( Files Created from 2009-11-03 to 2009-12-03 )))))))))))))))))))))))))))))))
.
2009-12-03 15:17 . 2009-12-03 15:17
d-sh--w- c:\documents and settings\Chris\IETldCache
2009-12-03 14:10 . 2009-12-03 14:10
d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-12-03 13:25 . 2009-12-03 13:35
d
w- C:\32788R22FWJFW
2009-12-03 12:53 . 2009-12-03 12:57
dc-h--w- c:\windows\ie8
2009-12-02 13:25 . 2009-12-02 13:25
d
w- c:\program files\Trend Micro
2009-12-02 11:35 . 2009-12-02 11:35 117760 ----a-w- c:\documents and settings\Mary-Ann\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-02 11:34 . 2009-12-02 11:34
d
w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-12-02 11:33 . 2009-12-02 11:33
d
w- c:\program files\SUPERAntiSpyware
2009-12-02 11:33 . 2009-12-02 11:33
d
w- c:\documents and settings\Mary-Ann\Application Data\SUPERAntiSpyware.com
2009-12-02 11:14 . 2009-12-02 11:14
d
w- c:\documents and settings\Mary-Ann\Application Data\Malwarebytes
2009-12-01 18:42 . 2009-12-01 18:42
d
w- c:\documents and settings\Michael\Application Data\Malwarebytes
2009-12-01 14:39 . 2009-12-01 14:39 152576 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-01 14:39 . 2009-12-01 14:39 79488 ----a-w- c:\documents and settings\John\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-01 14:38 . 2009-12-01 14:38
d
w- c:\documents and settings\John\Application Data\NCH Software
2009-12-01 14:31 . 2009-12-01 14:31
d
w- c:\documents and settings\John\Application Data\Malwarebytes
2009-12-01 11:45 . 2009-12-01 11:45
d
w- c:\documents and settings\Chris\Application Data\Malwarebytes
2009-12-01 11:44 . 2009-09-10 14:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-01 11:44 . 2009-12-01 11:44
d
w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-01 11:44 . 2009-09-10 14:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-01 11:44 . 2009-12-01 11:45
d
w- c:\program files\Malwarebytes' Anti-Malware
2009-11-27 09:52 . 2009-11-06 11:45 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-11-27 09:52 . 2009-11-04 09:59 3513624 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-11-27 09:52 . 2009-11-04 09:59 2028312 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
2009-11-25 11:42 . 2009-11-25 11:42
d
w- C:\videodvdmaker
2009-11-25 11:42 . 2009-11-25 11:42
d
w- c:\documents and settings\Chris\Application Data\Video DVD Maker FREE
2009-11-25 11:39 . 2009-11-25 11:40
d
w- c:\program files\Video DVD Maker
2009-11-25 11:30 . 2009-11-25 11:34
d
w- c:\program files\Burn4Free
2009-11-25 11:19 . 2009-11-25 11:51
d
w- c:\program files\CDBurnerXP
2009-11-14 18:20 . 2009-12-02 20:54
d
w- c:\program files\J@CK TV
2009-11-14 18:05 . 2009-11-14 18:05
d
w- c:\windows\J@CK TV
2009-11-14 17:35 . 2009-11-14 17:35
d
w- c:\program files\Save Tube Video Company
2009-11-08 16:02 . 2009-11-08 16:03 17217008 ----a-w- c:\documents and settings\John\Application Data\Real\Update\setup\rp\RealPlayerSPGold.exe
2009-11-08 15:59 . 2009-11-08 15:59 64000 ----a-w- c:\documents and settings\John\Application Data\Real\Update\setup\RUP\inst_config\gcapi_dll.dll
2009-11-08 15:59 . 2009-11-08 15:59 52288 ----a-w- c:\documents and settings\John\Application Data\Real\Update\setup\RUP\inst_config\gtapi.dll
2009-11-08 15:59 . 2009-11-08 15:59 50688 ----a-w- c:\documents and settings\John\Application Data\Real\Update\setup\RUP\inst_config\fftbapi.dll
2009-11-08 15:59 . 2009-11-08 15:59 114688 ----a-w- c:\documents and settings\John\Application Data\Real\Update\setup\RUP\inst_config\compat.dll
2009-11-04 14:29 . 2009-11-04 17:44
d
w- C:\GILLIAN
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-03 15:30 . 2007-05-04 15:41
d
w- c:\documents and settings\All Users\Application Data\Kontiki
2009-12-03 04:14 . 2008-05-09 00:06
d
w- c:\program files\PokerStars
2009-12-02 20:37 . 2009-03-10 17:37 0 ----a-w- c:\documents and settings\Mary-Ann\Local Settings\Application Data\prvlcl.dat
2009-12-02 11:32 . 2007-04-08 14:52
d
w- c:\program files\Common Files\Wise Installation Wizard
2009-12-01 14:41 . 2007-04-06 19:20
d
w- c:\program files\Java
2009-11-30 04:25 . 2007-11-08 22:49
d
w- c:\program files\Celtx
2009-11-28 10:36 . 2007-10-24 10:00
d
w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-11-23 13:23 . 2007-04-06 20:29
d
w- c:\documents and settings\All Users\Application Data\McAfee.com Personal Firewall
2009-11-23 12:49 . 2007-04-06 19:19
d
w- c:\program files\Bazooka Scanner
2009-10-25 10:35 . 2007-04-07 18:42
d
w- c:\documents and settings\Chris\Application Data\Azureus
2009-10-23 11:08 . 2009-09-20 09:18
d
w- c:\program files\Vuze
2009-10-23 10:01 . 2007-04-06 19:19
d
w- c:\program files\Azureus
2009-10-11 04:17 . 2008-11-29 10:19 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-06 10:12 . 2008-02-08 22:12
d
w- c:\documents and settings\All Users\Application Data\NCH Swift Sound
2009-10-06 10:12 . 2008-02-08 22:10
d
w- c:\program files\NCH Swift Sound
2009-10-06 09:58 . 2009-10-06 09:58
d
w- c:\documents and settings\All Users\Application Data\NCH Software
2009-10-06 09:57 . 2009-10-06 09:57
d
w- c:\program files\NCH Software
2009-10-06 09:57 . 2009-10-06 09:57
d
w- c:\documents and settings\Chris\Application Data\NCH Software
2009-10-06 09:57 . 2009-04-03 10:45 2048 ----a-w- c:\windows\system32\Tr_sttool.dat
2009-09-19 21:14 . 2009-09-19 21:13 5519752 ----a-w- c:\documents and settings\Michael\Application Data\TVU Networks\TVU AutoUpgrade\TVUPlayer2.4.7.2.exe
2009-09-14 22:14 . 2009-09-14 22:14 8406648 ----a-w- c:\documents and settings\John\Application Data\Real\Update\setup\gtb_us\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2009-09-14 22:13 . 2009-09-14 22:13 10309448 ----a-w- c:\documents and settings\John\Application Data\Real\Update\setup\chr\ChromeInstaller.exe
2009-09-11 14:18 . 2004-06-15 14:33 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 09:07 . 2009-08-05 18:42 152576 ----a-w- c:\documents and settings\Chris\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-09-04 21:03 . 2004-06-15 14:33 58880 ----a-w- c:\windows\system32\msasn1.dll
2007-07-26 19:52 . 2007-08-21 21:10 66408 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2007-07-26 19:52 . 2007-08-21 21:10 54112 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2007-07-26 19:52 . 2007-08-21 21:10 34688 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2007-07-26 19:52 . 2007-08-21 21:10 46456 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2007-07-26 19:52 . 2007-08-21 21:10 171880 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-12-15 155648]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2006-03-23 1398272]
"SunKistEM"="c:\program files\eMachines Bay Reader\shwiconem.exe" [2004-03-11 135168]
"VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]
"VirusScan Online"="c:\program files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840]
"OASClnt"="c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 53248]
"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe"="c:\progra~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 212992]
"MPFExe"="c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-11-11 1005096]
"MPSExe"="c:\progra~1\mcafee.com\mps\mscifapp.exe" [2006-03-30 296488]
"MSKAGENTEXE"="c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 110592]
"MSKDetectorExe"="c:\progra~1\McAfee\SPAMKI~1\MSKDetct.exe" [2006-11-07 1121280]
"UVS10 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe" [2006-03-06 36864]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2008-01-22 81920]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-10-11 62760]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2007-11-16 91432]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-11-27 2029336]
"PVR Agent"="c:\program files\KWorld Multimedia\PVR Plus\TVR\Scheduled.exe" [2005-04-13 751104]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"CHotkey"="zHotkey.exe" - c:\windows\zHotkey.exe [2003-06-03 496640]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Chris\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872]
AutoStart IR.lnk - c:\program files\WinTV\Ir.exe [2008-10-21 106551]
BigFix.lnk - c:\program files\BigFix\BigFix.exe [2004-6-15 1742384]
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
Device Detector 3.lnk - c:\program files\Olympus\DeviceDetector\DevDtct2.exe [2009-5-1 118784]
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-4-19 64864]
Remote Control.lnk - c:\program files\KWorld Multimedia\PVR-TV 713X Utilities\P3XRCtl.exe [2008-9-11 57344]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 14:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-17 08:16 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Chris^Start Menu^Programs^Startup^J@CK TV.lnk]
path=c:\documents and settings\Chris\Start Menu\Programs\Startup\J@CK TV.lnk
backup=c:\windows\pss\J@CK TV.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Save Tube Video Company\\SaveTubeVideoBurn\\downloader.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [10/08/2008 09:28 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [10/08/2008 09:28 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/11/2009 08:43 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23/11/2009 08:43 74480]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [11/08/2008 09:14 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [10/08/2008 09:28 297752]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [01/04/2009 18:29 54752]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
S3 PhTVTune;Philips WDM TVTuner;c:\windows\system32\drivers\PhTVTune.sys [11/09/2008 20:19 28512]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23/11/2009 08:43 7408]
.
Contents of the 'Scheduled Tasks' folder
2009-07-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2009-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3089717478-2898385862-2090695895-1009Core.job
- c:\documents and settings\Mary\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-27 17:32]
2009-12-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3089717478-2898385862-2090695895-1009UA.job
- c:\documents and settings\Mary\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-27 17:32]
2009-12-03 c:\windows\Tasks\User_Feed_Synchronization-{C3D03F10-885E-421E-B274-E5E3C94C4FA8}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 04:31]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.google.ie/
LSP: c:\windows\system32\mclsp.dll
DPF: {4F1D0C59-5ECC-4028-87F3-482191D2230F} - hxxp://134.226.124.250/activex/AMC.cab
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://148.61.63.218/activex/AMC.cab
DPF: {FE92D9C3-4A69-4EC7-8651-1DC8531D0075} - hxxp://ip-caseville.greatlakescam.com/user/TSBnwCam.CAB
FF - ProfilePath - c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\nmyr175q.default\
FF - prefs.js: browser.search.selectedEngine - GoogleFeed.net
FF - prefs.js: browser.startup.homepage - hxxp://www.google-feed.net/?CID=2&PID=STV
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
HKCU-Run-Octoshape Streaming Services - c:\program files\Octoshape Streaming Services\Chris\OctoshapeClient.exe
HKCU-Run-Messenger (Yahoo!) - c:\program files\Yahoo!\Messenger\YahooMessenger.exe
AddRemove-DVD Label Maker - c:\program files\Acoustica CD Label Maker\cdlabel.exe UNINSTALL
AddRemove-AOL Toolbar - c:\program files\AOL\AOL Toolbar 2.0\uninstall.exe
AddRemove-BaiduBarX - c:\program files\Baidu\Toolbar\BaiduBarX.dll
AddRemove-RealJukebox 1.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
AddRemove-RealPlayer 6.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-03 15:18
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
DLLs Loaded Under Running Processes
- - - - - - - > 'winlogon.exe'(908)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(964)
c:\windows\system32\mclsp.dll
c:\windows\system32\SPORDER.dll
c:\windows\system32\mclsphlr\gdlsphlr.dll
c:\windows\system32\McRtl32.dll
- - - - - - - > 'explorer.exe'(2696)
c:\progra~1\McAfee\SPAMKI~1\mskoeplg.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Other Running Processes
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Ahead\InCD\InCDsrv.exe
c:\windows\system32\Ati2evxx.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Kontiki\KService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\mcafee.com\vso\mcshield.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\progra~1\mcafee.com\agent\mctskshd.exe
c:\progra~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\shared\mghtml.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
c:\progra~1\McAfee.com\PERSON~1\MpfAgent.exe
.
**************************************************************************
.
Completion time: 2009-12-03 15:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-03 15:41
Pre-Run: 8,468,221,952 bytes free
Post-Run: 12,711,075,840 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
- - End Of File - - B8C6B54AE73446783C1D9846F2F9BD21
Thanks for your help0 -
-
Advertisement
-
-
Advertisement