Boards.ie uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Click here to find out more x
Post Reply  
 
 
Thread Tools Search this Thread
27-10-2009, 11:35   #1
me1724
Registered User
 
Join Date: Feb 2008
Posts: 139
Big problem with my laptop

My laptop seems to be infected with a lot of viruses. Thanks aidan_walsh for the sticky it helped to get rid of some of my problems like security tool.
I cannot run any programs in normal mode I had to run the superspyware and malwarebytes in safe mode. When in normal mode if i click to run any program it wont run so basically I cant do anything except in safe mode.
I have the file saved form the first time i ran malwarebytes if anyone needs me to post this, i think i found 179 problems.

I would really appreciate any help as I have been let go recently and need my laptop instead of going over to the neighbours every half an hour...
me1724 is offline  
Advertisement
27-10-2009, 11:57   #2
me1724
Registered User
 
Join Date: Feb 2008
Posts: 139
Also when I run superantispyware for around 27 minutes it goes through "ZoneMap\Domains" keys in registry, for exemple in "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains".
They are filled with hundreds of strange domain names that I never entered.
me1724 is offline  
27-10-2009, 12:22   #3
ActorSeeksJob
Registered User
 
Join Date: Feb 2007
Posts: 1,963
hi

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
  1. If you are using Firefox, make sure that your download settings are as follows:
    • Tools->Options->Main tab
    • Set to "Always ask me where to Save the files".
  2. During the download, rename Combofix to Combo-Fix as follows:





  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    -----------------------------------------------------------
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      -----------------------------------------------------------
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    -----------------------------------------------------------
  7. Double click on combo-Fix.exe & follow the prompts.
  8. When finished, it will produce a report for you.
  9. Please post the "C:\Combo-Fix.txt" for further review.
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**
ActorSeeksJob is offline  
27-10-2009, 14:37   #4
me1724
Registered User
 
Join Date: Feb 2008
Posts: 139
I ran Combo-Fix on my laptop but it has been stuck at Stage_32 for over an hour what should i do??
It said at the start that it should only take 10 mins
me1724 is offline  
27-10-2009, 15:02   #5
ActorSeeksJob
Registered User
 
Join Date: Feb 2007
Posts: 1,963
rename combofix to svchost.com and run it again
ActorSeeksJob is offline  
Advertisement
27-10-2009, 15:52   #6
me1724
Registered User
 
Join Date: Feb 2008
Posts: 139
Do i have to rename it during the download?? i cant just rename it where i have it saved on the desktop??
me1724 is offline  
27-10-2009, 22:09   #7
ActorSeeksJob
Registered User
 
Join Date: Feb 2007
Posts: 1,963
no rename it after you downloaded it if you cant rename it during the download
ActorSeeksJob is offline  
28-10-2009, 12:16   #8
me1724
Registered User
 
Join Date: Feb 2008
Posts: 139
Hi Actorseeksjob, I tried running the file with it called svchost.com but it didnt work for me so i tried running the orginal file again and it worked.

When i ran the program yesterday i got a warning saying that rootkit activity was found on the computer , but i didnt get that warning when i ran it this morning.

here is the log file from combofix,

ComboFix 09-10-26.03 - User 28/10/2009 11:07.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.510.90 [GMT 0:00]
Running from: c:\documents and settings\User\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\User\Application Data\inst.exe
c:\documents and settings\User\Desktop\Security Tool.lnk
c:\documents and settings\User\Start Menu\Programs\Security Tool.lnk
c:\program files\IEToolbar
c:\recycler\S-1-5-21-0243936033-3052116371-381863308-1811
c:\recycler\S-1-5-21-0243936033-3052116371-381863308-1858
c:\recycler\S-1-5-21-5589307635-2953006836-694035694-5046
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\system32\dumphive.exe
c:\windows\system32\lsp.dll
c:\windows\system32\mscert.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-28 )))))))))))))))))))))))))))))))
.
2009-10-27 14:12 . 2009-10-27 15:19 -------- d-----w- C:\Combo-Fix
2009-10-27 12:44 . 2009-10-27 12:44 -------- d-----w- c:\program files\CCleaner
2009-10-23 15:01 . 2009-10-23 15:01 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes
2009-10-23 15:01 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-23 15:01 . 2009-10-23 15:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-23 15:01 . 2009-10-23 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-23 15:01 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-23 14:45 . 2009-10-23 14:45 -------- d-----w- c:\program files\ERUNT
2009-10-23 14:30 . 2009-10-23 14:30 -------- d-----w- c:\program files\Safer Networking
2009-10-22 12:10 . 2009-10-27 10:21 34709 ----a-w- c:\windows\system32\uses32.dat
2009-10-21 19:56 . 2009-10-21 20:00 19711 ----a-w- C:\nhbsovo.exe
2009-10-21 19:56 . 2009-10-21 20:00 191687 ----a-w- C:\wtcqrqjr.exe
2009-10-21 19:56 . 2009-10-21 20:00 10752 ----a-w- C:\asefdwit.exe
2009-10-21 19:56 . 2009-10-21 20:00 93184 ----a-w- C:\fospdj.exe
2009-10-21 19:44 . 2009-10-22 11:05 -------- d-----w- c:\program files\aqgsfn
2009-10-21 19:39 . 2009-10-21 19:39 93184 ----a-w- C:\buxuhto.exe
2009-10-21 19:39 . 2009-10-21 19:39 19711 ----a-w- C:\dtacmawh.exe
2009-10-21 19:39 . 2009-10-21 19:39 7680 ----a-w- C:\jyacth.exe
2009-10-21 19:39 . 2009-10-21 19:39 191687 ----a-w- C:\dsiqvib.exe
2009-10-21 17:06 . 2009-10-21 17:06 -------- d-----w- c:\temp\DVD_DISC_1
2009-10-21 15:46 . 2009-10-21 15:46 -------- d-----w- c:\temp\DVD_DISC
2009-10-21 14:15 . 2009-10-21 14:15 -------- d-----w- c:\program files\Digiarty
2009-09-29 14:37 . 2009-10-02 13:00 3532 ----a-w- C:\drmHeader.bin
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-27 14:08 . 2009-01-02 21:19 -------- d-----w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com
2009-10-27 14:06 . 2009-01-02 21:19 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-27 13:49 . 2009-07-10 21:29 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-27 13:49 . 2009-07-10 21:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-24 14:02 . 2007-11-14 21:25 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-20 15:48 . 2009-05-09 10:23 -------- d-----w- c:\program files\Xilisoft
2009-10-20 12:40 . 2007-03-22 21:14 -------- d-----w- c:\documents and settings\User\Application Data\uTorrent
2009-10-01 17:06 . 2005-09-08 23:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-25 11:08 . 2005-11-25 20:22 -------- d-----w- c:\program files\Dl_cats
2009-09-22 13:58 . 2005-09-14 17:27 72600 ----a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-21 22:54 . 2009-09-19 20:09 -------- d-----w- c:\program files\Telltale Games
2009-09-19 20:25 . 2009-09-19 20:25 -------- d--h--r- c:\documents and settings\User\Application Data\SecuROM
2009-09-18 13:22 . 2009-07-13 12:58 -------- d-----w- c:\documents and settings\User\Application Data\FVZilla
2009-09-18 12:24 . 2005-09-09 00:01 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-18 12:06 . 2005-09-08 23:57 -------- d--ha-w- c:\documents and settings\All Users\Application Data\GTek
2009-09-11 14:18 . 2004-08-10 11:51 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 01:06 . 2006-07-19 16:23 -------- d-----w- c:\documents and settings\User\Application Data\Snapfish
2009-09-09 23:08 . 2008-11-22 12:02 -------- d-----w- c:\program files\Full Tilt Poker
2009-09-04 21:03 . 2004-08-10 11:51 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 16:44 . 2009-09-19 20:24 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2009-09-04 16:44 . 2009-09-19 20:24 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2009-09-04 16:44 . 2009-09-19 20:24 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2009-09-04 16:29 . 2009-09-19 20:24 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2009-09-04 16:29 . 2009-09-19 20:24 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2009-09-04 16:29 . 2009-09-19 20:24 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2009-09-04 16:29 . 2009-09-19 20:24 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2009-09-04 16:29 . 2009-09-19 20:24 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2009-08-31 11:28 . 2007-11-27 22:08 -------- d-----w- c:\documents and settings\User\Application Data\dvdcss
2009-08-29 07:36 . 2004-08-10 11:51 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-10 11:51 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2004-08-10 11:50 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:00 . 2004-08-10 11:51 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-17 21:37 . 2008-09-27 20:58 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-17 21:37 . 2008-09-27 20:58 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-17 21:37 . 2008-09-27 20:58 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-06 19:24 . 2004-08-10 12:02 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 19:24 . 2004-08-10 12:02 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 19:24 . 2005-05-26 03:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 19:24 . 2004-08-10 12:02 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 19:24 . 2004-08-10 12:02 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 19:24 . 2004-08-10 11:50 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 19:23 . 2004-08-10 12:02 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 19:23 . 2004-08-10 12:02 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2004-08-10 11:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 19:44 . 2004-08-10 11:51 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2004-08-03 21:59 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 1961984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Dell Photo AIO Printer 942"="c:\program files\Dell Photo AIO Printer 942\dlbubmgr.exe" [2005-02-03 294912]
"DellMCM"="c:\program files\Dell Photo AIO Printer 942\memcard.exe" [2004-07-27 262144]
"DLBUCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBUtime.dll" [2004-11-09 69632]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-17 2025752]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-06 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-07-27 221184]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-9-8 24576]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 15:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-17 21:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\kbdnet.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SpyHunter Security Suite"=c:\program files\Enigma Software Group\SpyHunter\SpyHunter3.exe
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]
appsecdll REG_SZ c:\windows\system32\mscert.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\utorrent\\utorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [27/09/2008 20:58 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [27/09/2008 20:58 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [27/09/2008 20:57 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [27/09/2008 20:57 297752]
S3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\drivers\usb2vcom.sys [28/01/2007 19:39 28928]
S3 vitra;vitra;c:\windows\system32\drivers\vitra.sys --> c:\windows\system32\drivers\vitra.sys [?]
--- Other Services/Drivers In Memory ---
*Deregistered* - mbr
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5b5193e0-4c98-11de-9ff0-0013ce1b0dbb}]
\Shell\AutoRun\command - RECYCLER\autorun.exe
\Shell\open\command - RECYCLER\autorun.exe
.
Contents of the 'Scheduled Tasks' folder
2009-08-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.co.uk/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = hxxp://www.eircom.net/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\fiivdlrd.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - yahoo.co.uk/
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\fiivdlrd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-NWEReboot - (no file)
HKLM-Run-c:\program files\Free Video Zilla\FVZilla.exe - (no file)

**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-28 11:38
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBUCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...

c:\windows\system32\Gootkit.dll 16906 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(968)
c:\program files\Intel\Wireless\Bin\LgNotify.dll
c:\windows\system32\Gootkit.dll
c:\windows\system32\WININET.dll
- - - - - - - > 'lsass.exe'(1024)
c:\windows\system32\wininet.dll
- - - - - - - > 'explorer.exe'(8216)
c:\windows\system32\WININET.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\ieframe.dll
c:\program files\Bonjour\mdnsNSP.dll
c:\windows\system32\PortableDeviceApi.dll
- - - - - - - > 'csrss.exe'(944)
c:\windows\system32\wininet.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\program files\Digiarty\WinX DVD Author 5.5\NMSAccessU.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\Intel\Wireless\Bin\1XConfig.exe
c:\program files\Dell Photo AIO Printer 942\dlbubmon.exe
c:\program files\iPod\bin\iPodService.exe
c:\combo-fix333c\CF30824.exe
c:\program files\Apoint\Apntex.exe
c:\combo-fix333c\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-28 11:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-28 11:51
Pre-Run: 10,030,522,368 bytes free
Post-Run: 10,021,752,832 bytes free
- - End Of File - - 2B696C30C311CE1F04D4BDAF10DCB2E1
me1724 is offline  
28-10-2009, 12:23   #9
reospeed
Registered User
 
Join Date: Jun 2008
Posts: 7
It sounds like you machine is in bits.

You need someone to take it from you and spend some time cleaning it.

Where are you based...??? If you not to fare from I'll do it for you.
reospeed is offline  
Advertisement
28-10-2009, 12:27   #10
ActorSeeksJob
Registered User
 
Join Date: Feb 2007
Posts: 1,963
Or I could just fix it up for free and do a better job



1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Quote:

File::
c:\windows\system32\uses32.dat
C:\nhbsovo.exe
C:\wtcqrqjr.exe
C:\asefdwit.exe
C:\fospdj.exe
C:\buxuhto.exe
C:\dtacmawh.exe
C:\jyacth.exe
C:\dsiqvib.exe
c:\windows\system32\drivers\vitra.sys

Folder::
c:\program files\aqgsfn

Driver::
vitra

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5b5193e0-4c98-11de-9ff0-0013ce1b0dbb}]

Rootkit::
c:\windows\system32\Gootkit.dll
KillAll::

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
ActorSeeksJob is offline  
28-10-2009, 12:33   #11
reospeed
Registered User
 
Join Date: Jun 2008
Posts: 7
I was offering my help for free.....

You're assume that this person knows what they are doing.

If they did they wouldn't be looking for our help.

Good luck
reospeed is offline  
28-10-2009, 13:04   #12
me1724
Registered User
 
Join Date: Feb 2008
Posts: 139
I know a bit about computers but wouldnt say expert , unless looking up google and doing what it says is counted as being an expert...

reospeed im located mostly in carlow a bit in dublin...

Actorseekssjob will i be able to fix all the problems myself??
me1724 is offline  
28-10-2009, 13:45   #13
ActorSeeksJob
Registered User
 
Join Date: Feb 2007
Posts: 1,963
follow my instructions and you will
ActorSeeksJob is offline  
28-10-2009, 17:37   #14
me1724
Registered User
 
Join Date: Feb 2008
Posts: 139
Ok, dragged in the notepad file into combofix and got the following log,

ComboFix 09-10-26.03 - XXXXX 28/10/2009 17:18.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.510.92 [GMT 0:00]
Running from: c:\documents and settings\XXXXX\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\XXXXX\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FILE ::
"C:\asefdwit.exe"
"C:\buxuhto.exe"
"C:\dsiqvib.exe"
"C:\dtacmawh.exe"
"C:\fospdj.exe"
"C:\jyacth.exe"
"C:\nhbsovo.exe"
"c:\windows\system32\drivers\vitra.sys"
"c:\windows\system32\uses32.dat"
"C:\wtcqrqjr.exe"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\asefdwit.exe
C:\buxuhto.exe
C:\dsiqvib.exe
C:\dtacmawh.exe
C:\fospdj.exe
C:\jyacth.exe
C:\nhbsovo.exe
c:\program files\aqgsfn
c:\windows\system32\uses32.dat
C:\wtcqrqjr.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_VITRA
-------\Service_vitra

((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-28 )))))))))))))))))))))))))))))))
.
2009-10-27 14:12 . 2009-10-27 15:19 -------- d-----w- C:\Combo-Fix
2009-10-27 12:44 . 2009-10-27 12:44 -------- d-----w- c:\program files\CCleaner
2009-10-23 15:01 . 2009-10-23 15:01 -------- d-----w- c:\documents and settings\XXXXX\Application Data\Malwarebytes
2009-10-23 15:01 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-23 15:01 . 2009-10-23 15:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-23 15:01 . 2009-10-23 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-23 15:01 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-23 14:45 . 2009-10-23 14:45 -------- d-----w- c:\program files\ERUNT
2009-10-23 14:30 . 2009-10-23 14:30 -------- d-----w- c:\program files\Safer Networking
2009-10-21 17:06 . 2009-10-21 17:06 -------- d-----w- c:\temp\DVD_DISC_1
2009-10-21 15:46 . 2009-10-21 15:46 -------- d-----w- c:\temp\DVD_DISC
2009-10-21 14:15 . 2009-10-21 14:15 -------- d-----w- c:\program files\Digiarty
2009-09-29 14:37 . 2009-10-02 13:00 3532 ----a-w- C:\drmHeader.bin
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-27 14:08 . 2009-01-02 21:19 -------- d-----w- c:\documents and settings\XXXXX\Application Data\SUPERAntiSpyware.com
2009-10-27 14:06 . 2009-01-02 21:19 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-27 13:49 . 2009-07-10 21:29 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-27 13:49 . 2009-07-10 21:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-24 14:02 . 2007-11-14 21:25 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-20 15:48 . 2009-05-09 10:23 -------- d-----w- c:\program files\Xilisoft
2009-10-20 12:40 . 2007-03-22 21:14 -------- d-----w- c:\documents and settings\XXXXX\Application Data\uTorrent
2009-10-01 17:06 . 2005-09-08 23:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-25 11:08 . 2005-11-25 20:22 -------- d-----w- c:\program files\Dl_cats
2009-09-22 13:58 . 2005-09-14 17:27 72600 ----a-w- c:\documents and settings\XXXXX\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-21 22:54 . 2009-09-19 20:09 -------- d-----w- c:\program files\Telltale Games
2009-09-19 20:25 . 2009-09-19 20:25 -------- d--h--r- c:\documents and settings\XXXXX\Application Data\SecuROM
2009-09-18 13:22 . 2009-07-13 12:58 -------- d-----w- c:\documents and settings\XXXXX\Application Data\FVZilla
2009-09-18 12:24 . 2005-09-09 00:01 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-18 12:06 . 2005-09-08 23:57 -------- d--ha-w- c:\documents and settings\All Users\Application Data\GTek
2009-09-11 14:18 . 2004-08-10 11:51 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 01:06 . 2006-07-19 16:23 -------- d-----w- c:\documents and settings\XXXXX\Application Data\Snapfish
2009-09-09 23:08 . 2008-11-22 12:02 -------- d-----w- c:\program files\Full Tilt Poker
2009-09-04 21:03 . 2004-08-10 11:51 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 16:44 . 2009-09-19 20:24 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2009-09-04 16:44 . 2009-09-19 20:24 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2009-09-04 16:44 . 2009-09-19 20:24 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2009-09-04 16:29 . 2009-09-19 20:24 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2009-09-04 16:29 . 2009-09-19 20:24 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2009-09-04 16:29 . 2009-09-19 20:24 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2009-09-04 16:29 . 2009-09-19 20:24 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2009-09-04 16:29 . 2009-09-19 20:24 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2009-08-31 11:28 . 2007-11-27 22:08 -------- d-----w- c:\documents and settings\XXXXX\Application Data\dvdcss
2009-08-29 07:36 . 2004-08-10 11:51 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-10 11:51 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2004-08-10 11:50 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:00 . 2004-08-10 11:51 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-17 21:37 . 2008-09-27 20:58 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-17 21:37 . 2008-09-27 20:58 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-17 21:37 . 2008-09-27 20:58 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-06 19:24 . 2004-08-10 12:02 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 19:24 . 2004-08-10 12:02 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 19:24 . 2005-05-26 03:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 19:24 . 2004-08-10 12:02 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 19:24 . 2004-08-10 12:02 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-06 19:24 . 2004-08-10 11:50 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 19:23 . 2004-08-10 12:02 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 19:23 . 2004-08-10 12:02 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2004-08-10 11:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 19:44 . 2004-08-10 11:51 2189184 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2004-08-03 21:59 2066048 ------w- c:\windows\system32\ntkrnlpa.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 1961984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Dell Photo AIO Printer 942"="c:\program files\Dell Photo AIO Printer 942\dlbubmgr.exe" [2005-02-03 294912]
"DellMCM"="c:\program files\Dell Photo AIO Printer 942\memcard.exe" [2004-07-27 262144]
"DLBUCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBUtime.dll" [2004-11-09 69632]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-17 2025752]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-06 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-07-27 221184]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-9-8 24576]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 15:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-17 21:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\kbdnet.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SpyHunter Security Suite"=c:\program files\Enigma Software Group\SpyHunter\SpyHunter3.exe
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]
appsecdll REG_SZ c:\windows\system32\mscert.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\utorrent\\utorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [27/09/2008 20:58 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [27/09/2008 20:58 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [27/09/2008 20:57 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [27/09/2008 20:57 297752]
S3 usb2vcom;USB to Serial Bridge Controller;c:\windows\system32\drivers\usb2vcom.sys [28/01/2007 19:39 28928]
--- Other Services/Drivers In Memory ---
*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder
2009-08-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.co.uk/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = hxxp://www.eircom.net/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\XXXXX\Application Data\Mozilla\Firefox\Profiles\fiivdlrd.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - yahoo.co.uk/
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\XXXXX\Application Data\Mozilla\Firefox\Profiles\fiivdlrd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -
Notify-Gootkit - Gootkit.dll

**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-28 17:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBUCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3224836751-3540766781-3520883336-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-3224836751-3540766781-3520883336-1006\Software\SecuROM\License information*]
"datasecu"=hex:14,8a,2d,e4,3e,76,b7,bb,1d,5a,50,ac,7c,8d,34,91,10,b9,9a,6e,a9,
ac,10,20,77,95,7d,39,72,a7,f6,1d,79,93,76,ac,a4,d2,5d,bd,6b,3b,7c,fa,81,11,\
"rkeysecu"=hex:c8,93,fc,d5,be,96,86,c3,92,7f,d9,dd,47,99,26,62
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(972)
c:\program files\Intel\Wireless\Bin\LgNotify.dll
- - - - - - - > 'explorer.exe'(464)
c:\windows\system32\WININET.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\ieframe.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\program files\Digiarty\WinX DVD Author 5.5\NMSAccessU.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\Intel\Wireless\Bin\1XConfig.exe
c:\combo-fix4686c\CF12370.exe
c:\program files\Dell Photo AIO Printer 942\dlbubmon.exe
c:\program files\Apoint\Apntex.exe
c:\program files\iPod\bin\iPodService.exe
c:\combo-fix4686c\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-28 17:40 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-28 17:40
ComboFix2.txt 2009-10-28 11:52
Pre-Run: 10,032,214,016 bytes free
Post-Run: 9,858,793,472 bytes free
- - End Of File - - CD84BA9B95F8A5B0D51EB3461E47BB58
me1724 is offline  
28-10-2009, 17:56   #15
ActorSeeksJob
Registered User
 
Join Date: Feb 2007
Posts: 1,963
hi

Download TFC to your desktop
  • Open the file and close any other windows.
  • It will close all programs itself when run, make sure to let it run uninterrupted.
  • Click the Start button to begin the process. The program should not take long to finish its job
  • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean




Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.
  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  5. Click on My Computer under Scan.
  6. Once the scan is complete, it will display the results. Click on View Scan Report.
  7. You will see a list of infected items there. Click on Save Report As....
  8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
ActorSeeksJob is offline  
Post Reply

Quick Reply
Message:
Remove Text Formatting
Bold
Italic
Underline

Insert Image
Wrap [QUOTE] tags around selected text
 
Decrease Size
Increase Size
Please sign up or log in to join the discussion

Thread Tools Search this Thread
Search this Thread:

Advanced Search



Share Tweet