Solved Help !! [Incorrect file associations] Keep Coming Back

[Resolved] Help !! [Incorrect file associations] Keep Coming Back

Registry Data Items Infected:
HKEY_CLASSES_ROOT\scrfile\shell\open\command\ (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ( "%1" /S) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1 ") -> Quarantined and deleted successfully.

This is part of the log from Malwarebytes.I have only copied the infected part.The rest shows up clean.I have no idea what this infection is even though I Googled it or why after it's supposedly fixed,it keeps reappearing.I take pride in keeping my computer in top notch form so it's disconcerting to constantly see this.Would someone please tell me what this is and why it reappears ? Thank you.This is my first post so I'm not sure if I did everything properly.I do have the Attachment and The DDS saved to my desktop but I hesitate to post it because it has sensitive information.Please advise on anything else you need.Be Well And Stay Healthy.

 

Welcome to WindowsBBS Rich

Please post the DDS.txt file for review.

 

Is this what you need ? Thank You for your help.

DDS (Ver_09-01-19.01) - NTFSx86
Run by Richard at 6:40:45.82 on Sun 01/25/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1459 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated)
FW: McAfee Personal Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\VSO\ConvertX\3\convertxtodvd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Richard Hershman\Desktop\New Folder\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.comcast.net/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.comcast.net/toolbar2.0/search/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
mSearchAssistant = hxxp://www.comcast.net/toolbar2.0/search/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~1\COMCAS~1.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~1\COMCAS~1.DLL
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe
uRun: [FreeRAM XP] "c:\program files\yourware solutions\freeram xp pro\FreeRAM XP Pro.exe" -win
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
uPolicies-explorer: HideClock = 0 (0x0)
mPolicies-explorer: NoResolveTrack = 1 (0x1)
mPolicies-explorer: NoFileAssociate = 0 (0x0)
mPolicies-system: NoDispSettingsPage = 0 (0x0)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: turbotax.com
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://pcpitstop.com/betapit/PCPitStop.CAB
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226173966082
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1226400177687
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1229125051421&h=001543ea4c1ba91ad40115f7d74b77c0/&filename=jinstall-6u11-windows-i586-jc.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5450/mcfscan.cab
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\richar~1\applic~1\mozilla\firefox\profiles\wlf6y74q.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - prefs.js: keyword.URL - hxxp://errorpage.comcast.net/?cat=Web&con=dc&safe=on&q=
FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbsp.dll
FF - plugin: c:\windows\system32\npmirage.dll

============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-10-20 212968]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-11-18 606736]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-11-18 79272]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-11-18 35240]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-11-18 40488]
R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-11-18 206096]
R4 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-11-18 360464]
R4 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-11-18 144704]
S3 DfSdkS;Defragmentation-Service;c:\program files\ashampoo\ashampoo winoptimizer 6\DfSdkS.exe [2008-12-25 410976]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-11-18 34216]
S3 PD91Agent;PD91Agent;c:\program files\raxco\perfectdisk2008\PD91Agent.exe [2008-12-31 693512]
S3 PD91Engine;PD91Engine;c:\program files\raxco\perfectdisk2008\PD91Engine.exe [2008-12-31 910600]

============== File Associations ===============

JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1

=============== Created Last 30 ================

2009-01-23 03:02 <DIR> --d----- c:\program files\Siber Systems
2009-01-22 23:17 <DIR> --d----- c:\program files\bobyte
2009-01-22 16:28 <DIR> --d----- c:\windows\system32\vmm32
2009-01-21 04:27 1,386,496 a------- c:\windows\system32\MSVBVM60.DLL
2009-01-21 04:27 <DIR> --d----- c:\docume~1\richar~1\applic~1\Seven Zip
2009-01-20 05:35 29 a------- c:\windows\CDMKR32.INI
2009-01-20 01:14 1,024 -------- c:\windows\system32\NTIJCMK5.dll
2009-01-20 01:06 1,024 -------- c:\windows\system32\NTIBUN4.dll
2009-01-20 00:55 13,952 -------- c:\windows\system32\drivers\UBHelper.sys
2009-01-20 00:55 <DIR> --d----- c:\program files\common files\NewTech Infosystems
2009-01-20 00:55 1,024 -------- c:\windows\system32\NTIMPEG2.dll
2009-01-20 00:55 1,024 -------- c:\windows\system32\NTIMP3.dll
2009-01-20 00:55 1,024 -------- c:\windows\system32\NTIFCD3.dll
2009-01-20 00:55 1,024 -------- c:\windows\system32\NTICDMK7.dll
2009-01-20 00:55 6,144 -------- c:\windows\system32\drivers\NTIDrvr.sys
2009-01-19 16:47 <DIR> --d----- c:\docume~1\richar~1\applic~1\SuperEasy
2009-01-18 08:41 102,664 -------- c:\windows\system32\drivers\tmcomm.sys
2009-01-17 14:46 <DIR> --d----- c:\documents and settings\richard hershman\G-Force
2009-01-15 17:37 <DIR> --d----- c:\docume~1\richar~1\applic~1\mIRC
2009-01-12 05:02 <DIR> --d----- c:\program files\SoundSpectrum
2009-01-08 04:17 <DIR> --d----- c:\windows\RER Video Joiner
2009-01-06 05:24 <DIR> --d----- c:\docume~1\richar~1\applic~1\Thinstall
2009-01-02 09:05 <DIR> --d----- c:\program files\common files\xing shared
2008-12-31 14:07 421,888 -------- c:\windows\system32\ac3filter.acm
2008-12-31 13:12 230,664 -------- c:\windows\system32\PDBoot.exe
2008-12-29 15:11 <DIR> --dsh--- c:\documents and settings\richard hershman\PrivacIE
2008-12-29 14:47 0 ---sh--- c:\windows\SBEDD6BD3.tmp
2008-12-29 14:44 78,336 -------- c:\windows\system32\ieencode.dll
2008-12-29 14:44 78,336 -------- c:\windows\system32\dllcache\ieencode.dll
2008-12-28 23:19 37,376 -------- c:\windows\system32\dwmapi.dll
2008-12-28 09:16 4,691,208 a------- c:\windows\screengenie.scr
2008-12-27 16:37 17,200 -------- c:\windows\system32\drivers\mbam.sys
2008-12-27 16:37 38,528 -------- c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-27 16:37 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2008-12-26 07:12 10 a------- c:\windows\Syskernel12.dll
2008-12-26 07:09 385,024 -------- c:\windows\system32\Mp3play.ocx
2008-12-26 07:09 <DIR> --d----- c:\program files\CoolMP3Splitter

==================== Find3M ====================

2008-12-30 18:50 413,696 -------- c:\windows\system32\wrap_oal.dll
2008-12-30 18:50 110,592 -------- c:\windows\system32\OpenAL32.dll
2008-12-27 21:07 196,608 -------- c:\windows\system32\avisynth.dll
2008-12-27 21:06 414,272 -------- c:\windows\system32\DivXc32f.dll
2008-12-27 21:06 414,272 -------- c:\windows\system32\DivXc32.dll
2008-12-27 21:06 33,280 -------- c:\windows\system32\HUFFYUV.DLL
2008-12-22 10:18 33,632 -------- c:\windows\system32\DfSdkBt.exe
2008-12-11 06:57 333,184 -------- c:\windows\system32\drivers\srv.sys
2008-12-07 20:25 360,320 -------- c:\windows\system32\drivers\TCPIP.SYS
2008-12-07 05:44 410,984 -------- c:\windows\system32\deploytk.dll
2008-12-01 00:12 28,112,848 -------- c:\windows\system32\xa189734.exe
2008-12-01 00:12 28,112,848 -------- c:\windows\system32\xa186796.exe
2008-11-29 10:32 28,112,848 -------- c:\windows\system32\xa98781.exe
2008-11-29 10:32 28,112,848 -------- c:\windows\system32\xa93656.exe
2008-11-28 17:32 28,112,848 -------- c:\windows\system32\xa2521125.exe
2008-11-28 17:32 28,112,848 -------- c:\windows\system32\xa2516421.exe
2008-11-24 23:21 935,776 -------- c:\windows\system32\Incinerator.dll
2008-11-21 16:47 3,596,288 -------- c:\windows\system32\qt-dx331.dll
2008-11-21 16:45 196,608 -------- c:\windows\system32\dtu100.dll
2008-11-21 16:45 81,920 -------- c:\windows\system32\dpl100.dll
2008-11-21 16:45 593,920 -------- c:\windows\system32\dpuGUI11.dll
2008-11-20 17:13 78,885 a------- c:\windows\hpfins05.dat
2008-11-18 02:38 4,212 -------- c:\windows\system32\zllictbl.dat
2008-11-15 15:01 74,703 -------- c:\windows\system32\mfc45.dll
2008-11-08 23:00 87,608 a------- c:\docume~1\richar~1\applic~1\inst.exe
2008-11-08 23:00 47,360 a------- c:\docume~1\richar~1\applic~1\pcouffin.sys
2008-11-08 15:16 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-11-08 14:24 21,640 -------- c:\windows\system32\emptyregdb.dat
2008-10-28 17:36 823,296 -------- c:\windows\system32\divx_xx0c.dll
2008-10-28 17:36 823,296 -------- c:\windows\system32\divx_xx07.dll
2008-10-28 17:35 815,104 -------- c:\windows\system32\divx_xx0a.dll
2008-10-28 17:35 802,816 -------- c:\windows\system32\divx_xx11.dll

============= FINISH: 6:41:46.31 ===============

 

Download DAFT and save it to your Desktop.

Double-click the daft.exe icon. Read the disclaimer and click okay.
Click on the Scan button and save a logfile. By default, it will save as daft.txt.
Post the contents of that file with your next post.

 

DAFT Log saved on 2009-01-27 02:03:52
-----------------------------------------------------------------------
.js - JSFile - shell\open\command - NOTEPAD.EXE %1
.reg - regfile - shell\open\command - NOTEPAD.EXE %1
.scr - scrfile - shell\open\command - NOTEPAD.EXE %1
.vbs - VBSFile - shell\open\command - NOTEPAD.EXE %1

I hope I am doing this properly. Have I said thank you lately ?

 

You're doing fine.

Double-click the daft.exe icon.
Click on the Scan button.

Place a checkmark next to the following entries:

.js
.reg
.scr
.vbs



Click the Fix button.
Reboot and rescan to see if they return.

 

Malwarebytes' Anti-Malware 1.33
Database version: 1654
Windows 5.1.2600 Service Pack 2

1/27/2009 2:53:06 AM
mbam-log-2009-01-27 (02-53-06).txt

Scan type: Quick Scan
Objects scanned: 49124
Time elapsed: 3 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Just ran a scan and it came up clean.Will keep you informed as to whether it comes back. Thank you for all your hard work.I do appreciate it.Be Well & Stay Healthy.

Rich

 

Lets hope it stays that way.

I'm going to go ahead and mark this topic resolved, but should you need to, you can post back to it any time within the next 30 days.

 

Thank You very much. That was great and also easy the way you explaine it to me.

RichDiamante

 

You're most welcome.

 

Sorry to bug you noahdfear but it came back.I'll paste the report from Malwarebytes again.

Malwarebytes' Anti-Malware 1.27
Database version: 1127
Windows 5.1.2600 Service Pack 2

1/29/2009 11:14:18 PM
mbam-log-2009-01-29 (23-14-18).txt

Scan type: Quick Scan
Objects scanned: 15308
Time elapsed: 1 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\scrfile\shell\open\command\ (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ( "%1" /S) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1 ") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Mcafee keeps quarantining JS Wonka Trojan also if that helps. Thanks again.

 

Does McAfee give you a filename and path of the detection?

 

Help !! [Incorrect file associations] Keep Coming Back

Yes but I can't copy & paste it.I'll do my best to give you its location. File C:\ Documents and settings\Richard \Local Settings\Application Data\Mozilla\firefox\profiles\wTf6y74q.default\cache\_CACHE_002_

That's about as good as I can do with these old tired eyes.I have gotten this nasty Wonka using IE & Firefox.When Mcafee catches it, I delete the file in quaratine almost immediately. I hope this helps. Did I tell you how much I appreciate your time,effort and expertise ? Well,I sure do.

Rich

 

C:\ Documents and settings\Richard \Local Settings\Application Data\Mozilla\firefox\profiles\wTf6y74q.default\cache

That location is where FireFox stores it's temporary internet files, which means the infection is from a site you're visiting, an ad being served to a site you visit, or something along those lines. I recommend you run ATF Cleaner to clear out all temp files in both IE and FireFox, fix the file associations using DAFT.exe again, then try to figure out where the infection is coming from.

It wouldn't hurt to do an online scan too. Instructions follow for that.

Do an online scan with Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Post the Kaspersky log here.