Solved Can't run anti-virus or maleware programs

kingblc · 2009/10/01

[Resolved] Can't run anti-virus or maleware programs

So I cannot run any of my reg cleaners or spybots, lavasoft, eusing. I even tried to run the the DDS listed in the FAQ on this page and nothing. They all open for a few seconds then shut down. I am also getting a google redirect.

broni · 2009/10/01

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE. If Combofix asks you to install Recovery Console, please allow it.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackTHis log.
Do NOT attempt to fix anything!

NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator

kingblc · 2009/10/02

ComboFix 09-10-01.05 - home 10/02/2009 18:58.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1918.1203 [GMT -4:00]
Running from: c:\users\home\Desktop\Programs\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-2840938211-4120053331-2104195085-1000
c:\windows\msa.exe
c:\windows\system32\drivers\vvuusprxnwelxown.sys

Infected copy of c:\windows\system32\cngaudit.dll was found and disinfected
Restored copy from - c:\windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_msqpdxserv.sys
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}
-------\Service_msqpdxserv.sys

((((((((((((((((((((((((( Files Created from 2009-09-02 to 2009-10-02 )))))))))))))))))))))))))))))))
.

2009-10-02 23:08 . 2009-10-02 23:22 -------- d-----w- c:\users\home\AppData\Local\temp
2009-10-02 23:08 . 2009-10-02 23:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-09-30 01:22 . 2009-10-02 22:44 0 ----a-r- c:\windows\win32k.sys
2009-09-16 17:02 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-09-15 13:49 . 2009-08-14 17:07 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-09-15 13:49 . 2009-08-14 16:29 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-09-15 13:49 . 2009-08-14 14:16 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-09-15 13:49 . 2009-08-14 14:16 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-09-15 13:49 . 2009-08-14 14:16 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-09-15 13:49 . 2009-08-14 14:16 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-09-15 13:49 . 2009-08-14 14:16 10240 ----a-w- c:\windows\system32\finger.exe
2009-09-15 13:49 . 2009-08-14 14:16 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-09-15 13:49 . 2009-08-14 14:16 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-09-15 13:49 . 2009-08-14 16:29 17920 ----a-w- c:\windows\system32\netevent.dll
2009-09-15 13:48 . 2009-07-11 19:32 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-09-15 13:48 . 2009-07-11 19:32 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-09-15 13:48 . 2009-07-11 19:29 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-09-15 13:48 . 2009-07-11 19:32 513024 ----a-w- c:\windows\system32\wlansvc.dll
2009-09-15 13:48 . 2009-06-10 12:11 2868224 ----a-w- c:\windows\system32\mf.dll
2009-09-15 13:44 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-15 13:44 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-15 00:47 . 2009-09-15 00:47 -------- d-----w- c:\users\home\AppData\Local\SupportSoft
2009-09-15 00:47 . 2009-09-15 00:47 -------- d-----w- c:\program files\support.com
2009-09-15 00:46 . 2009-09-15 00:46 -------- d-----w- c:\program files\Common Files\SupportSoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-02 22:51 . 2009-01-05 02:41 -------- d-----w- c:\program files\Lavasoft
2009-10-02 22:51 . 2008-11-04 00:58 -------- d-----w- c:\programdata\Lavasoft
2009-10-02 22:40 . 2009-01-28 18:55 -------- d-----w- c:\program files\McAfee
2009-10-02 13:23 . 2009-01-14 01:29 -------- d-----w- c:\program files\Eusing Free Registry Cleaner
2009-10-01 22:58 . 2009-01-13 23:37 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-01 22:58 . 2008-10-19 00:15 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-01 22:57 . 2008-10-18 18:49 -------- d-----w- c:\programdata\BVRP Software
2009-10-01 21:53 . 2009-01-14 02:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-30 02:52 . 2009-04-16 02:09 -------- d-----w- c:\users\home\AppData\Roaming\Move Networks
2009-09-16 17:26 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-16 16:34 . 2009-01-05 19:08 -------- d-----w- c:\programdata\Microsoft Help
2009-09-10 18:54 . 2009-01-14 02:05 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 18:53 . 2009-01-14 02:05 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-29 00:16 . 2009-08-29 00:16 -------- d-----w- c:\program files\Raven
2009-08-08 20:33 . 2009-08-08 20:33 -------- d-----w- c:\program files\iPhoneBrowser
2009-07-21 21:52 . 2009-07-29 12:24 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 12:24 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 12:24 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 12:24 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 14:35 . 2009-08-12 15:55 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-16 16:32 . 2009-01-28 18:56 130424 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2009-07-14 13:00 . 2009-08-12 15:55 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 12:59 . 2009-08-12 15:55 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 12:58 . 2009-08-12 15:55 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 10:59 . 2009-08-12 15:55 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-08 17:44 . 2009-01-28 18:56 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-07-08 17:44 . 2009-01-28 18:56 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-07-08 17:44 . 2009-01-28 18:56 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-07-08 17:44 . 2009-01-28 18:56 214024 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-07-08 17:43 . 2009-01-28 18:56 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update "= "c:\users\home\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-04-01 133104]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2009-07-10 645328]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2008-06-20 13535776]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2008-06-20 92704]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{81E0FC98-AA35-44C8-9B7C-32E00B7860B2} "= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{8F9567F0-D82B-44FB-92A8-DF2CFEE52DC3} "= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{3F5ECDE0-15C6-4052-A13D-8AAF7EDFD5A9} "= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{E1F2FB28-836E-4F52-BD90-061FAA30755B} "= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{EC881E28-8BB7-4198-A9CC-1C4D8F0C58C5} "= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{B0CC1B2E-B220-45BC-9318-5B6A6C7D3DC9} "= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{4EF37C46-A99F-47A0-AAFE-47C0457A44B6} "= UDP:c:\program files\AIM6\aim6.exe:AIM
"{3B0C5327-3DF3-4D87-ABDF-E380734873C2} "= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{D7F4C710-5CFB-4971-9E67-FA468F95C55B}c:\\program files\\microsoft lifecam\\lifecam.exe "= UDP:c:\program files\microsoft lifecam\lifecam.exe:LifeCam.exe
"UDP Query User{3168CF81-80D5-4745-8C1F-A6FD90AE532B}c:\\program files\\microsoft lifecam\\lifecam.exe "= TCP:c:\program files\microsoft lifecam\lifecam.exe:LifeCam.exe
"TCP Query User{89C6F268-546E-45D3-B47B-FD0979BFAB14}c:\\program files\\aim6\\aim6.exe "= UDP:c:\program files\aim6\aim6.exe:AIM
"UDP Query User{54F5C781-49DD-4911-A83A-BE0E7B5979F5}c:\\program files\\aim6\\aim6.exe "= TCP:c:\program files\aim6\aim6.exe:AIM
"TCP Query User{65DC4884-BB6E-42E6-9DB1-00A1FB4DFDF1}d:\\program files\\aim6\\aim6.exe "= UDP:d:\program files\aim6\aim6.exe:AIM
"UDP Query User{89C28952-C686-421A-BEC1-A4A4DA3AC33C}d:\\program files\\aim6\\aim6.exe "= TCP:d:\program files\aim6\aim6.exe:AIM
"TCP Query User{91AF6AF8-6DB0-480C-9F86-B92EF450CEFE}c:\\program files\\utorrent\\utorrent.exe "= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{7114D028-3915-44A1-B004-1F4298C71756}c:\\program files\\utorrent\\utorrent.exe "= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"{0A6E2E91-CD1E-4478-B7B3-AEA55BD1DBFB} "= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{CD98D329-9C38-4470-BC00-4094A051747F} "= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{128E1FC1-5C7E-4A82-BD36-131CF39EB8BF} "= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C9E522BB-9080-492A-9667-FDA2F3D8B390} "= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{2B682840-3930-4683-9BBF-38FFE802E2F5} "= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{224ACBDE-A361-4F77-99A2-CC0D03D43D0E} "= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{8500286A-A66A-4BA4-8890-0386C97BDB52} "= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ED56E6F4-A50E-445C-846B-01F957F5E531} "= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{138DDC0C-52AC-4BCC-9C27-D04B70490428} "= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{1DE59870-6D03-4B55-9F72-0C7398827407} "= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{BD604909-EE49-4979-8754-754060B275B5} "= UDP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
"{EF586E74-6183-44B4-8E7F-4FFAB83B8328} "= TCP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
"{550484A9-7303-4D9F-8631-E8817A51B95D} "= UDP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin
"{E7D5401B-4B19-4520-8FE6-1FD1C367E42B} "= TCP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall "= 0 (0x0)

R0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
R0 tpcdrdrv;tpcdrdrv;c:\windows\system32\DRIVERS\tpcdrdrv.sys [x]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216]
S3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\DRIVERS\VX6000Xp.sys [2007-04-10 2385896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-10-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3419377411-1286056701-3143598164-1000Core.job
- c:\users\home\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-01 00:57]

2009-10-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3419377411-1286056701-3143598164-1000UA.job
- c:\users\home\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-01 00:57]

2009-03-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-30 01:26]

2009-01-29 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-30 01:26]

2009-03-18 c:\windows\Tasks\Norton Security Scan for home.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 00:20]

2009-10-02 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2009-01-14 14:20]

2009-01-14 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2009-01-14 14:20]
.
.
------- Supplementary Scan -------
.
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\home\AppData\Roaming\Mozilla\Firefox\Profiles\lq6lpj5p.default\
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\home\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\users\home\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\home\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

AddRemove-Eusing Free Registry Cleaner - c:\progra~1\EUSING~1\UNWISE.EXE

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-02 19:22
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(2640)
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\program files\WinSCP\DragExt.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\rundll32.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\Common Files\microsoft shared\VS7Debug\mdm.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\windows\System32\WUDFHost.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\Common Files\McAfee\MNA\McNASvc.exe
.
**************************************************************************
.
Completion time: 2009-10-02 19:24 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-02 23:24
ComboFix2.txt 2009-02-03 18:57

Pre-Run: 206,440,271,872 bytes free
Post-Run: 206,256,517,120 bytes free

254 --- E O F --- 2009-10-02 13:32

kingblc · 2009/10/02

ComboFix 09-10-01.05 - home 10/02/2009 18:58.2.2 - NTFSx86
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6001.1.1252.1.1033.18.1918.1203 [GMT -4:00]
Running from: c:\users\home\Desktop\Programs\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-2840938211-4120053331-2104195085-1000
c:\windows\msa.exe
c:\windows\system32\drivers\vvuusprxnwelxown.sys

Infected copy of c:\windows\system32\cngaudit.dll was found and disinfected
Restored copy from - c:\windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_msqpdxserv.sys
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}
-------\Service_msqpdxserv.sys

((((((((((((((((((((((((( Files Created from 2009-09-02 to 2009-10-02 )))))))))))))))))))))))))))))))
.

2009-10-02 23:08 . 2009-10-02 23:22 -------- d-----w- c:\users\home\AppData\Local\temp
2009-10-02 23:08 . 2009-10-02 23:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-09-30 01:22 . 2009-10-02 22:44 0 ----a-r- c:\windows\win32k.sys
2009-09-16 17:02 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-09-15 13:49 . 2009-08-14 17:07 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-09-15 13:49 . 2009-08-14 16:29 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-09-15 13:49 . 2009-08-14 14:16 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-09-15 13:49 . 2009-08-14 14:16 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-09-15 13:49 . 2009-08-14 14:16 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-09-15 13:49 . 2009-08-14 14:16 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-09-15 13:49 . 2009-08-14 14:16 10240 ----a-w- c:\windows\system32\finger.exe
2009-09-15 13:49 . 2009-08-14 14:16 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-09-15 13:49 . 2009-08-14 14:16 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-09-15 13:49 . 2009-08-14 16:29 17920 ----a-w- c:\windows\system32\netevent.dll
2009-09-15 13:48 . 2009-07-11 19:32 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-09-15 13:48 . 2009-07-11 19:32 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-09-15 13:48 . 2009-07-11 19:29 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-09-15 13:48 . 2009-07-11 19:32 513024 ----a-w- c:\windows\system32\wlansvc.dll
2009-09-15 13:48 . 2009-06-10 12:11 2868224 ----a-w- c:\windows\system32\mf.dll
2009-09-15 13:44 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-15 13:44 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-15 00:47 . 2009-09-15 00:47 -------- d-----w- c:\users\home\AppData\Local\SupportSoft
2009-09-15 00:47 . 2009-09-15 00:47 -------- d-----w- c:\program files\support.com
2009-09-15 00:46 . 2009-09-15 00:46 -------- d-----w- c:\program files\Common Files\SupportSoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-02 22:51 . 2009-01-05 02:41 -------- d-----w- c:\program files\Lavasoft
2009-10-02 22:51 . 2008-11-04 00:58 -------- d-----w- c:\programdata\Lavasoft
2009-10-02 22:40 . 2009-01-28 18:55 -------- d-----w- c:\program files\McAfee
2009-10-02 13:23 . 2009-01-14 01:29 -------- d-----w- c:\program files\Eusing Free Registry Cleaner
2009-10-01 22:58 . 2009-01-13 23:37 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-01 22:58 . 2008-10-19 00:15 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-01 22:57 . 2008-10-18 18:49 -------- d-----w- c:\programdata\BVRP Software
2009-10-01 21:53 . 2009-01-14 02:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-30 02:52 . 2009-04-16 02:09 -------- d-----w- c:\users\home\AppData\Roaming\Move Networks
2009-09-16 17:26 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-16 16:34 . 2009-01-05 19:08 -------- d-----w- c:\programdata\Microsoft Help
2009-09-10 18:54 . 2009-01-14 02:05 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 18:53 . 2009-01-14 02:05 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-29 00:16 . 2009-08-29 00:16 -------- d-----w- c:\program files\Raven
2009-08-08 20:33 . 2009-08-08 20:33 -------- d-----w- c:\program files\iPhoneBrowser
2009-07-21 21:52 . 2009-07-29 12:24 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 12:24 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 12:24 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 12:24 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 14:35 . 2009-08-12 15:55 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-16 16:32 . 2009-01-28 18:56 130424 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2009-07-14 13:00 . 2009-08-12 15:55 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 12:59 . 2009-08-12 15:55 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 12:58 . 2009-08-12 15:55 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 10:59 . 2009-08-12 15:55 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-08 17:44 . 2009-01-28 18:56 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-07-08 17:44 . 2009-01-28 18:56 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-07-08 17:44 . 2009-01-28 18:56 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-07-08 17:44 . 2009-01-28 18:56 214024 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-07-08 17:43 . 2009-01-28 18:56 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update "= "c:\users\home\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-04-01 133104]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2009-07-10 645328]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2008-06-20 13535776]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2008-06-20 92704]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{81E0FC98-AA35-44C8-9B7C-32E00B7860B2} "= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{8F9567F0-D82B-44FB-92A8-DF2CFEE52DC3} "= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{3F5ECDE0-15C6-4052-A13D-8AAF7EDFD5A9} "= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{E1F2FB28-836E-4F52-BD90-061FAA30755B} "= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{EC881E28-8BB7-4198-A9CC-1C4D8F0C58C5} "= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{B0CC1B2E-B220-45BC-9318-5B6A6C7D3DC9} "= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{4EF37C46-A99F-47A0-AAFE-47C0457A44B6} "= UDP:c:\program files\AIM6\aim6.exe:AIM
"{3B0C5327-3DF3-4D87-ABDF-E380734873C2} "= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{D7F4C710-5CFB-4971-9E67-FA468F95C55B}c:\\program files\\microsoft lifecam\\lifecam.exe "= UDP:c:\program files\microsoft lifecam\lifecam.exe:LifeCam.exe
"UDP Query User{3168CF81-80D5-4745-8C1F-A6FD90AE532B}c:\\program files\\microsoft lifecam\\lifecam.exe "= TCP:c:\program files\microsoft lifecam\lifecam.exe:LifeCam.exe
"TCP Query User{89C6F268-546E-45D3-B47B-FD0979BFAB14}c:\\program files\\aim6\\aim6.exe "= UDP:c:\program files\aim6\aim6.exe:AIM
"UDP Query User{54F5C781-49DD-4911-A83A-BE0E7B5979F5}c:\\program files\\aim6\\aim6.exe "= TCP:c:\program files\aim6\aim6.exe:AIM
"TCP Query User{65DC4884-BB6E-42E6-9DB1-00A1FB4DFDF1}d:\\program files\\aim6\\aim6.exe "= UDP:d:\program files\aim6\aim6.exe:AIM
"UDP Query User{89C28952-C686-421A-BEC1-A4A4DA3AC33C}d:\\program files\\aim6\\aim6.exe "= TCP:d:\program files\aim6\aim6.exe:AIM
"TCP Query User{91AF6AF8-6DB0-480C-9F86-B92EF450CEFE}c:\\program files\\utorrent\\utorrent.exe "= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{7114D028-3915-44A1-B004-1F4298C71756}c:\\program files\\utorrent\\utorrent.exe "= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"{0A6E2E91-CD1E-4478-B7B3-AEA55BD1DBFB} "= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{CD98D329-9C38-4470-BC00-4094A051747F} "= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{128E1FC1-5C7E-4A82-BD36-131CF39EB8BF} "= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C9E522BB-9080-492A-9667-FDA2F3D8B390} "= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{2B682840-3930-4683-9BBF-38FFE802E2F5} "= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{224ACBDE-A361-4F77-99A2-CC0D03D43D0E} "= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{8500286A-A66A-4BA4-8890-0386C97BDB52} "= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ED56E6F4-A50E-445C-846B-01F957F5E531} "= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{138DDC0C-52AC-4BCC-9C27-D04B70490428} "= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{1DE59870-6D03-4B55-9F72-0C7398827407} "= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{BD604909-EE49-4979-8754-754060B275B5} "= UDP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
"{EF586E74-6183-44B4-8E7F-4FFAB83B8328} "= TCP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
"{550484A9-7303-4D9F-8631-E8817A51B95D} "= UDP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin
"{E7D5401B-4B19-4520-8FE6-1FD1C367E42B} "= TCP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall "= 0 (0x0)

R0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
R0 tpcdrdrv;tpcdrdrv;c:\windows\system32\DRIVERS\tpcdrdrv.sys [x]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216]
S3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\DRIVERS\VX6000Xp.sys [2007-04-10 2385896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-10-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3419377411-1286056701-3143598164-1000Core.job
- c:\users\home\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-01 00:57]

2009-10-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3419377411-1286056701-3143598164-1000UA.job
- c:\users\home\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-01 00:57]

2009-03-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-30 01:26]

2009-01-29 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-30 01:26]

2009-03-18 c:\windows\Tasks\Norton Security Scan for home.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 00:20]

2009-10-02 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2009-01-14 14:20]

2009-01-14 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2009-01-14 14:20]
.
.
------- Supplementary Scan -------
.
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\home\AppData\Roaming\Mozilla\Firefox\Profiles\lq6lpj5p.default\
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\home\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\users\home\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\home\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

AddRemove-Eusing Free Registry Cleaner - c:\progra~1\EUSING~1\UNWISE.EXE

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-02 19:22
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(2640)
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\program files\WinSCP\DragExt.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\rundll32.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\Common Files\microsoft shared\VS7Debug\mdm.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\windows\System32\WUDFHost.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\Common Files\McAfee\MNA\McNASvc.exe
.
**************************************************************************
.
Completion time: 2009-10-02 19:24 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-02 23:24
ComboFix2.txt 2009-02-03 18:57

Pre-Run: 206,440,271,872 bytes free
Post-Run: 206,256,517,120 bytes free

254 --- E O F --- 2009-10-02 13:32

kingblc · 2009/10/02

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:23:31 PM, on 1/31/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\vVX6000.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\System32\mobsync.exe
C:\PROGRA~1\McAfee\MSC\mcregist.exe
C:\Users\home\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\home.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [VX6000] C:\Windows\vVX6000.exe
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe "
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe "
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Intel Corp./ICP vortex GmbH - (no file)
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

--
End of file - 7710 bytes

broni · 2009/10/02

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\win32k.sys
c:\windows\Tasks\Norton Security Scan for home.job
c:\windows\Tasks\RegCure Program Check.job
c:\windows\Tasks\RegCure.job


Folder::
c:\program files\Norton Security Scan
c:\program files\RegCure


Driver::

Registry::

RegLockDel::
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

kingblc · 2009/10/05

ComboFix 09-10-01.05 - home 10/05/2009 20:41.3.2 - NTFSx86
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6001.1.1252.1.1033.18.1918.1242 [GMT -4:00]
Running from: c:\users\home\Desktop\Programs\Downloads\ComboFix.exe
Command switches used :: c:\users\home\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active

FILE ::
"c:\windows\Tasks\Norton Security Scan for home.job "
"c:\windows\Tasks\RegCure Program Check.job "
"c:\windows\Tasks\RegCure.job "
"c:\windows\win32k.sys "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Norton Security Scan
c:\program files\Norton Security Scan\BilBDRes.dll
c:\program files\Norton Security Scan\ccL70U.dll
c:\program files\Norton Security Scan\ccScanw.dll
c:\program files\Norton Security Scan\ccVrTrst.dll
c:\program files\Norton Security Scan\dec_abi.dll
c:\program files\Norton Security Scan\DefUtDCD.dll
c:\program files\Norton Security Scan\ecmldr32.dll
c:\program files\Norton Security Scan\help.htm
c:\program files\Norton Security Scan\Microsoft.VC80.CRT.manifest
c:\program files\Norton Security Scan\msl.dll
c:\program files\Norton Security Scan\msvcp80.dll
c:\program files\Norton Security Scan\msvcr80.dll
c:\program files\Norton Security Scan\Nss.exe
c:\program files\Norton Security Scan\patch25d.dll
c:\program files\Norton Security Scan\SAUpdt.dll
c:\program files\Norton Security Scan\ScanCore.dll
c:\program files\Norton Security Scan\ScanRes.dll
c:\program files\Norton Security Scan\SKURes.dll
c:\program files\Norton Security Scan\SymHTML.dll
c:\program files\RegCure
c:\program files\RegCure\0_days.htm
c:\program files\RegCure\1_days.htm
c:\program files\RegCure\15_days.htm
c:\program files\RegCure\2_days.htm
c:\program files\RegCure\30_days.htm
c:\program files\RegCure\5_days.htm
c:\program files\RegCure\Animated-Bar.gif
c:\program files\RegCure\AutoUpdate.dll
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42.bak
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42.reg
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\$RR8NOKZ.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\America Online 9.0.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\AnyDVD.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\AOL 9.0.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\Brian and pets.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\CloneDVD2.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\Community Based Educational Specialist Department.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\CV Brian Clinton 12-17-07.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\Jobs.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\MySpaceIM.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\thank you letter conn college.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\thank you letter.lnk
c:\program files\RegCure\Backup\RegCureBak_January_13_09_23_03_42\USB20FD (J).lnk
c:\program files\RegCure\Backup\RegCureBak_January_24_09_21_13_54.bak
c:\program files\RegCure\Backup\RegCureBak_January_24_09_21_13_54.reg
c:\program files\RegCure\Backup\RegCureBak_January_24_09_21_13_54\AnyDVD.lnk
c:\program files\RegCure\Backup\RegCureBak_January_24_09_21_13_54\CloneDVD2.lnk
c:\program files\RegCure\Backup\RegCureBak_October_01_09_19_00_53.reg
c:\program files\RegCure\Backup\RegCureBak_September_30_09_23_27_56.reg
c:\program files\RegCure\buttonfill.jpg
c:\program files\RegCure\buttonfill_expire.jpg
c:\program files\RegCure\buttonfill_mo.jpg
c:\program files\RegCure\buttonfill_mo_expire.jpg
c:\program files\RegCure\config.xml
c:\program files\RegCure\contentwrapper.gif
c:\program files\RegCure\expire.css
c:\program files\RegCure\footerbar.gif
c:\program files\RegCure\help.chm
c:\program files\RegCure\info_bubble.jpg
c:\program files\RegCure\Logs\Regcure-01-10-09-19-01-02.zip
c:\program files\RegCure\Logs\Regcure-13-01-09-23-03-45.zip
c:\program files\RegCure\Logs\Regcure-24-01-09-21-13-58.zip
c:\program files\RegCure\Logs\Regcure-30-09-09-23-28-02.zip
c:\program files\RegCure\Logs\SystemInfo.zip
c:\program files\RegCure\LogSettings.xml
c:\program files\RegCure\main.css
c:\program files\RegCure\process-animation.gif
c:\program files\RegCure\RegCure.exe
c:\program files\RegCure\settings.xml
c:\program files\RegCure\subtitlebar.gif
c:\program files\RegCure\tile_titlebar.jpg
c:\program files\RegCure\Tip1.html
c:\program files\RegCure\Tip10.html
c:\program files\RegCure\Tip11.html
c:\program files\RegCure\Tip12.html
c:\program files\RegCure\Tip13.html
c:\program files\RegCure\Tip14.html
c:\program files\RegCure\Tip15.html
c:\program files\RegCure\Tip2.html
c:\program files\RegCure\Tip3.html
c:\program files\RegCure\Tip4.html
c:\program files\RegCure\Tip5.html
c:\program files\RegCure\Tip6.html
c:\program files\RegCure\Tip7.html
c:\program files\RegCure\Tip8.html
c:\program files\RegCure\Tip9.html
c:\program files\RegCure\uninst.exe
c:\program files\RegCure\whitelist.dat
c:\program files\RegCure\zlibwapi.dll
c:\windows\Tasks\Norton Security Scan for home.job
c:\windows\Tasks\RegCure Program Check.job
c:\windows\Tasks\RegCure.job
c:\windows\win32k.sys

.
((((((((((((((((((((((((( Files Created from 2009-09-06 to 2009-10-06 )))))))))))))))))))))))))))))))
.

2009-10-06 00:49 . 2009-10-06 00:49 -------- d-----w- c:\users\home\AppData\Local\temp
2009-10-06 00:49 . 2009-10-06 00:49 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-10-06 00:49 . 2009-10-06 00:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-05 19:27 . 2009-10-01 14:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-09-16 17:02 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-09-15 13:49 . 2009-08-14 17:07 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-09-15 13:49 . 2009-08-14 16:29 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-09-15 13:49 . 2009-08-14 14:16 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-09-15 13:49 . 2009-08-14 14:16 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-09-15 13:49 . 2009-08-14 14:16 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-09-15 13:49 . 2009-08-14 14:16 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-09-15 13:49 . 2009-08-14 14:16 10240 ----a-w- c:\windows\system32\finger.exe
2009-09-15 13:49 . 2009-08-14 14:16 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-09-15 13:49 . 2009-08-14 14:16 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-09-15 13:49 . 2009-08-14 16:29 17920 ----a-w- c:\windows\system32\netevent.dll
2009-09-15 13:48 . 2009-07-11 19:32 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-09-15 13:48 . 2009-07-11 19:32 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-09-15 13:48 . 2009-07-11 19:29 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-09-15 13:48 . 2009-07-11 19:32 513024 ----a-w- c:\windows\system32\wlansvc.dll
2009-09-15 13:48 . 2009-06-10 12:11 2868224 ----a-w- c:\windows\system32\mf.dll
2009-09-15 13:44 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-15 13:44 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-15 00:47 . 2009-09-15 00:47 -------- d-----w- c:\users\home\AppData\Local\SupportSoft
2009-09-15 00:47 . 2009-09-15 00:47 -------- d-----w- c:\program files\support.com
2009-09-15 00:46 . 2009-09-15 00:46 -------- d-----w- c:\program files\Common Files\SupportSoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-06 00:22 . 2009-01-28 18:55 -------- d-----w- c:\program files\McAfee
2009-10-02 22:51 . 2009-01-05 02:41 -------- d-----w- c:\program files\Lavasoft
2009-10-02 22:51 . 2008-11-04 00:58 -------- d-----w- c:\programdata\Lavasoft
2009-10-02 13:23 . 2009-01-14 01:29 -------- d-----w- c:\program files\Eusing Free Registry Cleaner
2009-10-01 22:58 . 2009-01-13 23:37 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-01 22:58 . 2008-10-19 00:15 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-01 22:57 . 2008-10-18 18:49 -------- d-----w- c:\programdata\BVRP Software
2009-10-01 21:53 . 2009-01-14 02:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-30 02:52 . 2009-04-16 02:09 -------- d-----w- c:\users\home\AppData\Roaming\Move Networks
2009-09-16 17:26 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-16 16:34 . 2009-01-05 19:08 -------- d-----w- c:\programdata\Microsoft Help
2009-09-10 18:54 . 2009-01-14 02:05 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 18:53 . 2009-01-14 02:05 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-29 00:16 . 2009-08-29 00:16 -------- d-----w- c:\program files\Raven
2009-08-08 20:33 . 2009-08-08 20:33 -------- d-----w- c:\program files\iPhoneBrowser
2009-07-21 21:52 . 2009-07-29 12:24 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 12:24 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 12:24 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 12:24 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-17 14:35 . 2009-08-12 15:55 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-16 16:32 . 2009-01-28 18:56 130424 ----a-w- c:\windows\system32\drivers\Mpfp.sys
2009-07-14 13:00 . 2009-08-12 15:55 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 12:59 . 2009-08-12 15:55 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 12:58 . 2009-08-12 15:55 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 10:59 . 2009-08-12 15:55 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-08 17:44 . 2009-01-28 18:56 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-07-08 17:44 . 2009-01-28 18:56 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-07-08 17:44 . 2009-01-28 18:56 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-07-08 17:44 . 2009-01-28 18:56 214024 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-07-08 17:43 . 2009-01-28 18:56 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-10-02_23.22.23 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-02-05 00:27 . 2009-10-02 22:55 51680 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-02-05 00:27 . 2009-10-05 19:19 51680 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-10-05 19:19 53690 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-02-04 23:44 . 2009-10-05 19:19 10338 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3419377411-1286056701-3143598164-1000_UserData.bin
- 2006-11-02 13:02 . 2009-10-02 23:22 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2006-11-02 13:02 . 2009-10-06 00:40 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2006-11-02 13:02 . 2009-10-06 00:40 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2006-11-02 13:02 . 2009-10-02 23:22 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2006-11-02 13:02 . 2009-10-02 23:22 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2006-11-02 13:02 . 2009-10-06 00:40 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-26 18:21 . 2009-10-06 00:16 291124 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2009-06-16 14:14 . 2009-10-05 19:26 123853437 c:\windows\winsxs\ManifestCache\6.0.6002.18005_001c11ba_blobs.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update "= "c:\users\home\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-04-01 133104]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2009-07-10 645328]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2008-06-20 13535776]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2008-06-20 92704]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{81E0FC98-AA35-44C8-9B7C-32E00B7860B2} "= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{8F9567F0-D82B-44FB-92A8-DF2CFEE52DC3} "= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe
"{3F5ECDE0-15C6-4052-A13D-8AAF7EDFD5A9} "= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{E1F2FB28-836E-4F52-BD90-061FAA30755B} "= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe
"{EC881E28-8BB7-4198-A9CC-1C4D8F0C58C5} "= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{B0CC1B2E-B220-45BC-9318-5B6A6C7D3DC9} "= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{4EF37C46-A99F-47A0-AAFE-47C0457A44B6} "= UDP:c:\program files\AIM6\aim6.exe:AIM
"{3B0C5327-3DF3-4D87-ABDF-E380734873C2} "= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{D7F4C710-5CFB-4971-9E67-FA468F95C55B}c:\\program files\\microsoft lifecam\\lifecam.exe "= UDP:c:\program files\microsoft lifecam\lifecam.exe:LifeCam.exe
"UDP Query User{3168CF81-80D5-4745-8C1F-A6FD90AE532B}c:\\program files\\microsoft lifecam\\lifecam.exe "= TCP:c:\program files\microsoft lifecam\lifecam.exe:LifeCam.exe
"TCP Query User{89C6F268-546E-45D3-B47B-FD0979BFAB14}c:\\program files\\aim6\\aim6.exe "= UDP:c:\program files\aim6\aim6.exe:AIM
"UDP Query User{54F5C781-49DD-4911-A83A-BE0E7B5979F5}c:\\program files\\aim6\\aim6.exe "= TCP:c:\program files\aim6\aim6.exe:AIM
"TCP Query User{65DC4884-BB6E-42E6-9DB1-00A1FB4DFDF1}d:\\program files\\aim6\\aim6.exe "= UDP:d:\program files\aim6\aim6.exe:AIM
"UDP Query User{89C28952-C686-421A-BEC1-A4A4DA3AC33C}d:\\program files\\aim6\\aim6.exe "= TCP:d:\program files\aim6\aim6.exe:AIM
"TCP Query User{91AF6AF8-6DB0-480C-9F86-B92EF450CEFE}c:\\program files\\utorrent\\utorrent.exe "= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{7114D028-3915-44A1-B004-1F4298C71756}c:\\program files\\utorrent\\utorrent.exe "= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"{0A6E2E91-CD1E-4478-B7B3-AEA55BD1DBFB} "= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{CD98D329-9C38-4470-BC00-4094A051747F} "= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{128E1FC1-5C7E-4A82-BD36-131CF39EB8BF} "= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{C9E522BB-9080-492A-9667-FDA2F3D8B390} "= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{2B682840-3930-4683-9BBF-38FFE802E2F5} "= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{224ACBDE-A361-4F77-99A2-CC0D03D43D0E} "= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{8500286A-A66A-4BA4-8890-0386C97BDB52} "= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ED56E6F4-A50E-445C-846B-01F957F5E531} "= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{138DDC0C-52AC-4BCC-9C27-D04B70490428} "= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{1DE59870-6D03-4B55-9F72-0C7398827407} "= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{BD604909-EE49-4979-8754-754060B275B5} "= UDP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
"{EF586E74-6183-44B4-8E7F-4FFAB83B8328} "= TCP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
"{550484A9-7303-4D9F-8631-E8817A51B95D} "= UDP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin
"{E7D5401B-4B19-4520-8FE6-1FD1C367E42B} "= TCP:c:\users\home\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall "= 0 (0x0)

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [1/30/2009 3:15 PM 210216]
R3 VX6000;Microsoft LifeCam VX-6000;c:\windows\System32\drivers\VX6000Xp.sys [4/10/2007 5:46 PM 2385896]
S2 0132401254770752mcinstcleanup;McAfee Application Installer Cleanup (0132401254770752);c:\windows\TEMP\013240~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\windows\TEMP\013240~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; "c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-10-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3419377411-1286056701-3143598164-1000Core.job
- c:\users\home\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-01 00:57]

2009-10-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3419377411-1286056701-3143598164-1000UA.job
- c:\users\home\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-01 00:57]

2009-03-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-30 01:26]

2009-01-29 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-30 01:26]
.
.
------- Supplementary Scan -------
.
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\home\AppData\Roaming\Mozilla\Firefox\Profiles\lq6lpj5p.default\
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\home\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\users\home\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\home\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

AddRemove-RegCure - c:\program files\RegCure\uninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-05 20:49
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\users\home\AppData\Local\Temp\catchme.dll 53248 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
Completion time: 2009-10-06 20:50
ComboFix-quarantined-files.txt 2009-10-06 00:50
ComboFix2.txt 2009-10-02 23:24
ComboFix3.txt 2009-02-03 18:57

Pre-Run: 204,810,682,368 bytes free
Post-Run: 204,775,051,264 bytes free

329 --- E O F --- 2009-10-05 19:27

kingblc · 2009/10/05

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:23:31 PM, on 1/31/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\vVX6000.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\System32\mobsync.exe
C:\PROGRA~1\McAfee\MSC\mcregist.exe
C:\Users\home\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\home.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [VX6000] C:\Windows\vVX6000.exe
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe "
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe "
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Intel Corp./ICP vortex GmbH - (no file)
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

--
End of file - 7710 bytes

broni · 2009/10/05

Very good

Uninstall Combofix:
Go Start > Run
Type in:
combofix /u
Note the space between the "combofix" and the "/u "
Restart computer.

=================================================================

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3.
Post fresh HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

kingblc · 2009/10/06

super antispyware
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/06/2009 at 11:13 PM

Application Version : 4.29.1002

Core Rules Database Version : 4150
Trace Rules Database Version: 2079

Scan type : Complete Scan
Total Scan Time : 01:55:19

Memory items scanned : 306
Memory threats detected : 0
Registry items scanned : 7857
Registry threats detected : 0
File items scanned : 222816
File threats detected : 4

Trojan.Unknown Origin
C:\USERS\HOME\APPDATA\LOCAL\VIRTUALSTORE\PROGRAM FILES\NETPROJECT\OT.ICO
C:\USERS\HOME\APPDATA\LOCAL\VIRTUALSTORE\PROGRAM FILES\NETPROJECT\TS.ICO
C:\WINDOWS.OLD\DOCUMENTS AND SETTINGS\HOME\APPDATA\LOCAL\VIRTUALSTORE\PROGRAM FILES\NETPROJECT\OT.ICO
C:\WINDOWS.OLD\DOCUMENTS AND SETTINGS\HOME\APPDATA\LOCAL\VIRTUALSTORE\PROGRAM FILES\NETPROJECT\TS.ICO

kingblc · 2009/10/07

Malwarebytes' Anti-Malware 1.41
Database version: 2917
Windows 6.0.6001 Service Pack 1

10/7/2009 8:37:29 PM
mbam-log-2009-10-07 (20-37-29).txt

Scan type: Full Scan (C:\|)
Objects scanned: 286637
Time elapsed: 2 hour(s), 7 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Users\home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\totalvid (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
(No malicious items detected)

kingblc · 2009/10/07

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:23:31 PM, on 1/31/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\vVX6000.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\System32\mobsync.exe
C:\PROGRA~1\McAfee\MSC\mcregist.exe
C:\Users\home\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\home.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [VX6000] C:\Windows\vVX6000.exe
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe "
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe "
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Intel Corp./ICP vortex GmbH - (no file)
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

--
End of file - 7710 bytes

broni · 2009/10/07

See, if you can run DDS now...

kingblc · 2009/10/07

sorry i am a spazz

DDS (Ver_09-09-29.01) - NTFSx86
Run by home at 22:26:25.01 on Wed 10/07/2009
Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_11
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6001.1.1252.1.1033.18.1918.1150 [GMT -4:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Windows\system32\rundll32.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe
C:\Users\home\Desktop\Programs\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\home\Desktop\Programs\Downloads\dds(2).scr

============== Pseudo HJT Report ===============

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - Java(tm) Plug-In SSV Helper
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {aa58ed58-01dd-4d91-8333-cf10577473f7} - Google Toolbar Helper
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: {dbc80044-a445-435b-bc74-9c25c1c588a9} - Java(tm) Plug-In 2 SSV Helper
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} -
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
uRun: [Google Update] "c:\users\home\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe "
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\home\appdata\roaming\mozilla\firefox\profiles\lq6lpj5p.default\
FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
FF - plugin: c:\users\home\appdata\local\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\users\home\appdata\roaming\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\home\appdata\roaming\mozilla\plugins\npgoogletalk.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-9-15 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-9-15 74480]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-1-30 210216]
R3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\drivers\VX6000Xp.sys [2007-4-10 2385896]
S2 0163081254952310mcinstcleanup;McAfee Application Installer Cleanup (0163081254952310);c:\windows\temp\016308~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\windows\temp\016308~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; "c:\program files\lavasoft\ad-aware\aawservice.exe" --> c:\program files\lavasoft\ad-aware\AAWService.exe [?]
S2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; [x]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-9-15 7408]

=============== Created Last 30 ================

2009-10-06 20:58 <DIR> --d----- c:\programdata\SUPERAntiSpyware.com
2009-10-06 20:58 <DIR> --d----- c:\progra~2\SUPERAntiSpyware.com
2009-10-06 20:57 <DIR> --d----- c:\users\home\appdata\roaming\SUPERAntiSpyware.com
2009-10-06 20:57 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-10-06 20:57 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-10-06 20:51 <DIR> --ds---- C:\ComboFix
2009-10-05 20:50 <DIR> --dsh--- C:\$RECYCLE.BIN
2009-10-05 15:27 195,440 -------- c:\windows\system32\MpSigStub.exe
2009-09-16 13:02 2,048 a------- c:\windows\system32\tzres.dll
2009-09-15 09:49 897,608 a------- c:\windows\system32\drivers\tcpip.sys
2009-09-15 09:49 104,960 a------- c:\windows\system32\netiohlp.dll
2009-09-15 09:49 27,136 a------- c:\windows\system32\NETSTAT.EXE
2009-09-15 09:49 19,968 a------- c:\windows\system32\ARP.EXE
2009-09-15 09:49 9,728 a------- c:\windows\system32\TCPSVCS.EXE
2009-09-15 09:49 10,240 a------- c:\windows\system32\finger.exe
2009-09-15 09:49 8,704 a------- c:\windows\system32\HOSTNAME.EXE
2009-09-15 09:49 17,920 a------- c:\windows\system32\ROUTE.EXE
2009-09-15 09:49 11,264 a------- c:\windows\system32\MRINFO.EXE
2009-09-15 09:49 17,920 a------- c:\windows\system32\netevent.dll
2009-09-15 09:48 2,501,921 a------- c:\windows\system32\wlan.tmf
2009-09-15 09:48 302,592 a------- c:\windows\system32\wlansec.dll
2009-09-15 09:48 293,376 a------- c:\windows\system32\wlanmsm.dll
2009-09-15 09:48 127,488 a------- c:\windows\system32\L2SecHC.dll
2009-09-15 09:48 513,024 a------- c:\windows\system32\wlansvc.dll
2009-09-15 09:48 2,868,224 a------- c:\windows\system32\mf.dll
2009-09-15 09:44 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-09-15 09:44 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-14 20:47 862 a------- C:\net_save.dna
2009-09-14 20:47 <DIR> --d----- c:\program files\support.com
2009-09-14 20:46 <DIR> --d----- c:\program files\common files\SupportSoft

==================== Find3M ====================

2009-09-10 14:54 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 14:53 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-08-28 08:39 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2009-08-28 08:38 2,153,984 a------- c:\windows\apppatch\AcGenral.dll
2009-08-28 08:38 541,696 a------- c:\windows\apppatch\AcLayers.dll
2009-08-28 08:38 459,776 a------- c:\windows\apppatch\AcSpecfc.dll
2009-07-21 17:52 915,456 a------- c:\windows\system32\wininet.dll
2009-07-21 17:47 109,056 a------- c:\windows\system32\iesysprep.dll
2009-07-21 17:47 71,680 a------- c:\windows\system32\iesetup.dll
2009-07-21 16:13 133,632 a------- c:\windows\system32\ieUnatt.exe
2009-07-17 10:35 71,680 a------- c:\windows\system32\atl.dll
2009-07-14 09:00 313,344 a------- c:\windows\system32\wmpdxm.dll
2009-07-14 08:59 4,096 a------- c:\windows\system32\dxmasf.dll
2009-07-14 08:58 7,680 a------- c:\windows\system32\spwmp.dll
2009-07-14 06:59 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-07-12 22:06 143,360 a------- c:\windows\inf\infstrng.dat
2009-07-12 22:06 86,016 a------- c:\windows\inf\infstor.dat
2009-07-12 22:06 51,200 a------- c:\windows\inf\infpub.dat
2009-04-07 15:17 56 a---h--- c:\programdata\ezsidmv.dat
2009-04-07 15:17 56 a---h--- c:\progra~2\ezsidmv.dat
2008-06-26 09:57 174 a--sh--- c:\program files\desktop.ini
2008-06-26 09:48 665,600 a------- c:\windows\inf\drvindex.dat
2008-02-23 13:45 52,968 a------- c:\users\home\appdata\roaming\GDIPFONTCACHEV1.DAT
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2009-06-17 19:37 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2009-06-17 19:37 32,768 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-06-17 19:37 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat
2009-06-14 23:20 16,384 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2009-06-14 23:20 32,768 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-06-14 23:20 16,384 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat
2009-06-14 23:20 245,760 a--sh--- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-06-14 23:19 245,760 a--sh--- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 22:27:05.91 ===============

broni · 2009/10/07

I need 2nd part of it.

kingblc · 2009/10/07

this?

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-09-29.01)

Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 2/4/2008 9:33:38 PM
System Uptime: 10/7/2009 5:52:20 PM (6 hours ago)

Motherboard: ELITEGROUP | | MCP61PM-AM
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ | Socket AM2 | 2200/201mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 288 GiB total, 191.124 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 1.102 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP878: 9/19/2009 11:47:15 PM - Windows Update
RP880: 9/20/2009 4:48:24 PM - Scheduled Checkpoint
RP882: 9/21/2009 9:21:49 AM - Windows Update
RP884: 9/21/2009 9:39:41 AM - Windows Update
RP886: 9/22/2009 10:54:41 AM - Windows Update
RP888: 9/22/2009 11:58:53 PM - Windows Update
RP890: 9/23/2009 10:59:48 PM - Windows Update
RP892: 9/24/2009 11:07:36 AM - Scheduled Checkpoint
RP894: 9/25/2009 9:22:03 AM - Windows Update
RP896: 9/25/2009 11:59:05 PM - Windows Update
RP898: 9/26/2009 6:13:44 PM - Scheduled Checkpoint
RP900: 9/27/2009 8:59:26 AM - Windows Update
RP902: 9/28/2009 12:00:20 AM - Scheduled Checkpoint
RP904: 9/28/2009 3:00:24 AM - Windows Update
RP906: 9/28/2009 2:50:36 PM - Windows Update
RP908: 9/28/2009 11:23:54 PM - Windows Update
RP910: 9/29/2009 11:44:31 AM - Scheduled Checkpoint
RP912: 9/30/2009 6:28:55 PM - Scheduled Checkpoint
RP914: 10/1/2009 12:55:22 PM - Windows Update
RP916: 10/1/2009 6:25:19 PM - Windows Update
RP918: 10/1/2009 6:55:23 PM - Removed Motorola Phone Tools
RP920: 10/2/2009 9:27:30 AM - Windows Update
RP922: 10/5/2009 3:21:10 PM - Windows Update
RP924: 10/5/2009 3:27:30 PM - Windows Update
RP926: 10/6/2009 8:19:47 PM - Scheduled Checkpoint
RP928: 10/6/2009 8:57:26 PM - Installed SUPERAntiSpyware Free Edition
RP930: 10/7/2009 9:09:12 PM - Scheduled Checkpoint

==== Installed Programs ======================

µTorrent
Acrobat.com
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Reader 9.1.3
Adobe Shockwave Player 11
AIM 6
Apple Mobile Device Support
Apple Software Update
Avanquest update
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon MP Navigator EX 1.0
Canon MP210 series
Canon MP210 series User Registration
Canon My Printer
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities Easy-PhotoPrint EX
Canon Utilities PhotoStitch
Canon Utilities Solution Menu
Canon Utilities ZoomBrowser EX
CCleaner (remove only)
CloneDVD2
Comcast High-Speed Internet Install Wizard
Google Talk Plugin
HijackThis 2.0.2
iPhoneBrowser
IrfanView (remove only)
iTunes
K-Lite Codec Pack 4.3.4 (Standard)
Magic M4A to MP3 Converter 3.1
Malwarebytes' Anti-Malware
McAfee SecurityCenter
Microsoft LifeCam
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Move Media Player
Mozilla Firefox (3.5.3)
MSVCRT
MSXML 4.0 SP2 (KB954430)
Norton Security Scan (Symantec Corporation)
NVIDIA Drivers
PIXMA Extended Survey Program
QuickTime
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB960003)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB959997)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB956358)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Outlook 2007 (KB946983)
Soft Data Fax Modem with SmartCP
Soldier of Fortune Gold
SUPERAntiSpyware Free Edition
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB969907)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Office 2007 (KB934391)
Update for Outlook 2007 Junk Email Filter (kb973514)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Windows Live Essentials
Windows Media Player Firefox Plugin
WinRAR archiver
WinSCP 4.1.2 beta

==== Event Viewer Messages From Past Week ========

9/30/2009 9:45:48 AM, Error: Service Control Manager [7034] - The McAfee Application Installer Cleanup (0003501254275121) service terminated unexpectedly. It has done this 1 time(s).
9/30/2009 9:45:24 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the iPod Service service to connect.
9/30/2009 9:45:24 AM, Error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/30/2009 9:45:24 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service iPod Service with arguments " " in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
9/30/2009 9:43:52 AM, Error: Service Control Manager [7000] - The PIXMA Extended Survey Program service failed to start due to the following error: The system cannot find the path specified.
9/30/2009 9:43:52 AM, Error: Service Control Manager [7000] - The Nero BackItUp Scheduler 4.0 service failed to start due to the following error: The system cannot find the path specified.
9/30/2009 9:43:52 AM, Error: Service Control Manager [7000] - The MSCamSvc service failed to start due to the following error: The system cannot find the path specified.
9/30/2009 9:43:52 AM, Error: Service Control Manager [7000] - The Lavasoft Ad-Aware Service service failed to start due to the following error: Access is denied.
9/30/2009 9:42:59 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {8BC3F05E-D86B-11D0-A075-00C04FB68820} to the user home-PC\home SID (S-1-5-21-3419377411-1286056701-3143598164-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
9/30/2009 11:45:13 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the KtmRm service.
9/30/2009 11:45:13 PM, Error: Service Control Manager [7000] - The KtmRm for Distributed Transaction Coordinator service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/30/2009 11:44:43 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ehstart service.
9/30/2009 11:42:16 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: tpcdrdrv
9/30/2009 11:41:45 PM, Error: EventLog [6008] - The previous system shutdown at 11:34:56 PM on 9/30/2009 was unexpected.
9/30/2009 11:29:12 PM, Error: Service Control Manager [7030] - The ThreatFire service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
10/7/2009 5:45:08 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.0.101 for the Network Card with network address 001921DCE1F1 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
10/6/2009 9:18:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McNASvc with arguments " " in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A}
10/6/2009 9:16:20 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC ElbyCDIO Lbd mfehidk MPFP NetBIOS netbt nsiproxy PSched RasAcd rdbss SASDIFSV SASKUTIL Smb spldr Tcpip tdx tpcdrdrv Wanarpv6
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:16:20 PM, Error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/6/2009 9:15:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
10/6/2009 9:15:20 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MDM with arguments " " in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
10/6/2009 9:15:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
10/6/2009 9:15:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
10/6/2009 9:15:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
10/6/2009 9:15:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
10/6/2009 9:15:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
10/2/2009 9:32:28 AM, Error: Service Control Manager [7034] - The McAfee Scanner service terminated unexpectedly. It has done this 1 time(s).
10/2/2009 6:57:13 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the PEVSystemStart service to connect.
10/2/2009 6:57:12 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
10/2/2009 6:56:23 PM, Error: Service Control Manager [7034] - The Machine Debug Manager service terminated unexpectedly. It has done this 1 time(s).
10/2/2009 6:55:11 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd tpcdrdrv
10/2/2009 6:55:11 PM, Error: Service Control Manager [7000] - The Lavasoft Ad-Aware Service service failed to start due to the following error: The system cannot find the path specified.
10/2/2009 6:51:41 PM, Error: Service Control Manager [7000] - The Lbd service failed to start due to the following error: The system cannot find the file specified.
10/2/2009 10:17:24 AM, Error: Service Control Manager [7024] - The Quality Windows Audio Video Experience service terminated with service-specific error 3 (0x3).
10/1/2009 12:51:55 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SBSD Security Center Service service to connect.
10/1/2009 12:51:55 PM, Error: Service Control Manager [7000] - The SBSD Security Center Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/1/2009 12:50:50 PM, Error: EventLog [6008] - The previous system shutdown at 12:24:44 PM on 10/1/2009 was unexpected.
10/1/2009 1:03:18 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80073712: Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework 3.5 Family Update (KB951847) x86.
10/1/2009 1:01:45 PM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package KB948609 (Update) into Install Requested(Install Requested) state

==== End Of File ===========================

broni · 2009/10/07

Very good

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3. Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

kingblc · 2009/10/10

to be clear, you want me to do this again?

broni · 2009/10/10

No, my bad. Sorry for that. Let me check your HJT log...

broni · 2009/10/10

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

Open JavaRa.exe again and select Search For Updates.

Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

==================================================================

Disable Windows Defender, as it'll interfere with cleaning process:
- Open Windows Defender by clicking the Start, clicking All Programs, and then clicking Windows Defender.
- Click Tools
then...

++ Windows XP:
- Click General Settings
- Scroll down to Real Time Protection Options
- Uncheck Turn on Real Time Protection
- After you uncheck this, click on the Save button
- Close Windows Defender

++ Windows Vista:
- Click Options
- Under Administrator options, clear the Use Windows Defender check box, and then click Save.

Enable Windows Defender, when all cleaning is done.

===============================================================

Print this post out, since you won't have an access to it, at some point.

1. Open HijackThis.

2. Close all windows, except for HijackThis.

3. Put checkmarks next to the following HijackThis entries:

- R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
- R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
- O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
- O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
- O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
- O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
- O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

4. You should also checkmark following entries (these are unnecessary startups; no actual programs will be removed):

- O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

5. Click on Fix checked button.

6. Restart computer.

7. Post new HijackThis log.

Log in or Sign up

Solved Can't run anti-virus or maleware programs

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Can't run anti-virus or maleware programs

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

kingblc Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Useful Searches