Internet security 2010

View previous topic View next topic Go down

Internet security 2010

Post by jewelcraft on Mon Jan 04, 2010 4:21 pm

Please help, my computer is a mess and im at a loss at what to do. I ran a hijack this log and saved it but it wont let me open it to send it to you HELP

jewelcraft
Novice
Novice

Posts Posts : 28
Joined Joined : 2009-07-04
OS OS : XP
Points Points : 27292
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Internet security 2010

Post by Belahzur on Mon Jan 04, 2010 5:13 pm

Please download the current version of HijackThis from [You must be registered and logged in to see this link.]

  • Double click and run the installer.
  • It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  • After installing, you should get the user agreement, press accept and Hijack This will run.
  • Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Internet security 2010

Post by jewelcraft on Tue Jan 05, 2010 12:52 am

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 9:24:12 AM, on 1/4/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVANQU~1\Fix-It\mxtask.exe
C:\Program Files\iWin Games\iWinTrusted.exe
C:\PROGRA~1\AVANQU~1\Fix-It\mxtask.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\AVANQU~1\Fix-It\mxtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\winupdate86.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\InternetSecurity2010\IS2010.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe bwsb.gio gltbr
O2 - BHO: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files\IObitCom\tbIObi.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files\IObitCom\tbIObi.dll
O4 - HKLM\..\Run: [VirusScannerPro] C:\PROGRA~1\AVANQU~1\Fix-It\MemCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Pqesufehoriqow] rundll32.exe "C:\WINDOWS\osekegubix.dll",Startup
O4 - HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
O4 - HKLM\..\Run: [jcyjqhly] C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\bdbnbr\vidfsysguard.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe
O4 - HKUS\S-1-5-21-403652864-2198031449-4169705298-1010\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Lexi_2')
O4 - HKUS\S-1-5-21-403652864-2198031449-4169705298-1010\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Lexi_2')
O4 - HKUS\S-1-5-21-403652864-2198031449-4169705298-1010\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe (User 'Lexi_2')
O4 - HKUS\S-1-5-21-403652864-2198031449-4169705298-1010\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe (User 'Lexi_2')
O4 - HKUS\S-1-5-21-403652864-2198031449-4169705298-1010\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103470 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; FunWebProducts; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; yie8)" -"http://www8.agame.com/games/shockwave/h/horse_eventing/horse_eventing_girlsgogames_com/horse_eventing_girlsgogames_com.html" (User 'Lexi_2')
O4 - HKUS\S-1-5-18\..\Run: [ygua8e7yhuiesfha876yfauy8fe] C:\WINDOWS\TEMP\h33lvz.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ygua8e7yhuiesfha876yfauy8fe] C:\WINDOWS\TEMP\h33lvz.exe (User 'Default user')
O4 - S-1-5-21-403652864-2198031449-4169705298-1010 Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe (User 'Lexi_2')
O4 - S-1-5-21-403652864-2198031449-4169705298-1010 User Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe (User 'Lexi_2')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Search - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Wanda_2\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Go PlaySushi! - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - C:\Program Files\PlaySushi\PSText.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\winhelper86.dll
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {352797A0-EFD0-4FA6-B229-145120EA4B8A} (Walt Disney Internet Group Hardware Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - [You must be registered and logged in to see this link.]
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - [You must be registered and logged in to see this link.]
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - [You must be registered and logged in to see this link.]
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - [You must be registered and logged in to see this link.]
O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {E6BB2089-163F-466B-812A-748096614DFD} (CAScanner Control) - [You must be registered and logged in to see this link.]
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - (no file)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Fix-It Task Manager - Avanquest North America, Inc. - C:\PROGRA~1\AVANQU~1\Fix-It\mxtask.exe
O23 - Service: Google Update Service (gupdate1ca26895b87caa0) (gupdate1ca26895b87caa0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: iWinTrusted - iWin Inc. - C:\Program Files\iWin Games\iWinTrusted.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Windows Defender (WinDefend) - Unknown owner - C:\Program Files\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 10815 bytes

jewelcraft
Novice
Novice

Posts Posts : 28
Joined Joined : 2009-07-04
OS OS : XP
Points Points : 27292
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Internet security 2010

Post by Belahzur on Tue Jan 05, 2010 12:58 am

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
    F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe bwsb.gio gltbr
    O4 - HKLM\..\Run: [Pqesufehoriqow] rundll32.exe "C:\WINDOWS\osekegubix.dll",Startup
    O4 - HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
    O4 - HKLM\..\Run: [jcyjqhly] C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\bdbnbr\vidfsysguard.exe
    O4 - HKCU\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe
    O4 - HKUS\S-1-5-21-403652864-2198031449-4169705298-1010\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe (User 'Lexi_2')
    O4 - HKUS\S-1-5-21-403652864-2198031449-4169705298-1010\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe (User 'Lexi_2')
    O4 - HKUS\S-1-5-18\..\Run: [ygua8e7yhuiesfha876yfauy8fe] C:\WINDOWS\TEMP\h33lvz.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ygua8e7yhuiesfha876yfauy8fe] C:\WINDOWS\TEMP\h33lvz.exe (User 'Default user')
    O4 - S-1-5-21-403652864-2198031449-4169705298-1010 Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe (User 'Lexi_2')
    O4 - S-1-5-21-403652864-2198031449-4169705298-1010 User Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe (User 'Lexi_2')
    O8 - Extra context menu item: &Search - [You must be registered and logged in to see this link.]
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Wanda_2\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
    O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - (no file)


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Internet security 2010

Post by jewelcraft on Tue Jan 05, 2010 1:10 am

So far it wont let me open it again/, says

jewelcraft
Novice
Novice

Posts Posts : 28
Joined Joined : 2009-07-04
OS OS : XP
Points Points : 27292
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Internet security 2010

Post by jewelcraft on Tue Jan 05, 2010 2:46 am

Can not open hijack this, it says its infected.

jewelcraft
Novice
Novice

Posts Posts : 28
Joined Joined : 2009-07-04
OS OS : XP
Points Points : 27292
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Internet security 2010

Post by jewelcraft on Tue Jan 05, 2010 2:03 pm

Malwarebytes' Anti-Malware 1.41
Database version: 3141
Windows 5.1.2600 Service Pack 3

1/5/2010 9:03:13 AM
mbam-log-2010-01-05 (09-03-13).txt

Scan type: Quick Scan
Objects scanned: 139428
Time elapsed: 7 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 14
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 22
Files Infected: 98

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\WINDOWS\system32\6to4v32.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\6to4 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\6to4 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Lexi_2\Application Data\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lexi_2\Application Data\FunWebProducts\Data (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lexi_2\Application Data\FunWebProducts\Data\Lexi_2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Avatar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\firefox (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\firefox\chrome (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\f3PSSavr.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Lexi_2\Application Data\FunWebProducts\Data\Lexi_2\avatar.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3REGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3AUXSTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3DLGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\0037A05B (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\0037A5EA (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\0037ADE4.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\0037AFC5.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\0037B17E.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\0037B336.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\0037B459.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\firefox\CHROME.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\firefox\INSTALL.RDF (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\firefox\chrome\M3FFXTBR.JAR (Adware.MyWebSearch) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\8_step1.gif (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\ask_logo.gif (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\autoup.gif (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\autoup.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\bkwebfet.jpg (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\bkzwinky.jpg (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\blubtn2d.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\blubtn2r.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\blubtn3d.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\blubtn3r.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\center.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\index.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\logo_ZJ.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\logo_ZR.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\mid_dots.gif (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\mws_logo.gif (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\protect.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebbtnbg.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebbtnn1.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebbtnn2.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebbtny1.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebbtny2.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebclose.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebut.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebut2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebut3.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\rebut3b.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\reb_bg.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\repmidsm.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\shield.png (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\shocked.gif (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\stop.gif (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\systray.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\systrayp.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\tp_grad.gif (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON\warn.gif (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\6to4v32.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

jewelcraft
Novice
Novice

Posts Posts : 28
Joined Joined : 2009-07-04
OS OS : XP
Points Points : 27292
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Internet security 2010

Post by Belahzur on Tue Jan 05, 2010 3:00 pm

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Internet security 2010

Post by jewelcraft on Tue Jan 05, 2010 4:22 pm

ComboFix 10-01-04.01 - Lexi_2 01/05/2010 11:01:05.9.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1982.1564 [GMT -5:00]
Running from: c:\documents and settings\Lexi_2\Desktop\Combo-Fix.exe
AV: Avanquest VirusScanner Pro *On-access scanning enabled* (Updated) {6A383D4C-7657-408f-BD0D-B379B5C7C3BE}
AV: Microsoft Security Essentials *On-access scanning disabled* (Outdated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Jewel\Application Data\alot
c:\documents and settings\Jewel\Application Data\alot\Button_0\Button_0.xml
c:\documents and settings\Jewel\Application Data\alot\Button_0\Button_0.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Button_1\Button_1.xml
c:\documents and settings\Jewel\Application Data\alot\Button_1\Button_1.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Button_2\Button_2.xml
c:\documents and settings\Jewel\Application Data\alot\Button_2\Button_2.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Button_3\Button_3.xml
c:\documents and settings\Jewel\Application Data\alot\Button_3\Button_3.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Button_4\Button_4.xml
c:\documents and settings\Jewel\Application Data\alot\Button_4\Button_4.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Button_5\Button_5.xml
c:\documents and settings\Jewel\Application Data\alot\Button_5\Button_5.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Button_6\Button_6.xml
c:\documents and settings\Jewel\Application Data\alot\Button_6\Button_6.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Button_7\Button_7.xml
c:\documents and settings\Jewel\Application Data\alot\Button_7\Button_7.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Button_8\Button_8.xml
c:\documents and settings\Jewel\Application Data\alot\Button_8\Button_8.xml.backup
c:\documents and settings\Jewel\Application Data\alot\configurator\configurator.xml
c:\documents and settings\Jewel\Application Data\alot\configurator\configurator.xml.backup
c:\documents and settings\Jewel\Application Data\alot\contextMenu\contextMenu.xml
c:\documents and settings\Jewel\Application Data\alot\contextMenu\contextMenu.xml.backup
c:\documents and settings\Jewel\Application Data\alot\postInstallLayout\postInstallLayout.xml
c:\documents and settings\Jewel\Application Data\alot\postInstallLayout\postInstallLayout.xml.backup
c:\documents and settings\Jewel\Application Data\alot\products\products.xml
c:\documents and settings\Jewel\Application Data\alot\products\products.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Resources\BrowserSearch\alot_search_defend.html
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_0\images\alot_logo_button.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_0\images\alot_logo_button.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_1\images\alot_search_button.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_1\images\alot_search_button.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_2\images\default_1030_alot_cel_search.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_2\images\default_1030_alot_cel_search.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_3\images\clear.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_3\images\cloudy.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_3\images\default_1007_alot_weather_widget.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_3\images\default_1007_alot_weather_widget.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_3\images\mcloud.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_3\images\nclear.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_3\images\nmcloud.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_3\images\pcloud.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_3\images\rain.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_4\images\default_1151_alot_cel_celebnews.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_4\images\default_1151_alot_cel_celebnews.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_4\images\default_1151_alot_mrkt_starpulse.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_5\images\default_1153_alot_cel_entcenter.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_5\images\default_1153_alot_cel_entcenter.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_6\images\default_1154_alot_cel_photos.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_6\images\default_1154_alot_cel_photos.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_7\images\default_1156_default_1045_alot_mrkt_readersdigest.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_7\images\default_1156_default_1045_alot_mrkt_readersdigest.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_8\images\default_1157_alot_mrkt_starpulse.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Button_8\images\default_1157_alot_mrkt_starpulse.png
c:\documents and settings\Jewel\Application Data\alot\Resources\contextMenu\images\alot_logo_button.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\contextMenu\images\alot_logo_button.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\domains.dat
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\alot_brand.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\alot_splitter.png
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\spinner.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\widget_bottom.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\widget_btnclose0.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\widget_btnclose1.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\widget_caption.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\widget_error_bg.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\widget_error_close.bmp
c:\documents and settings\Jewel\Application Data\alot\Resources\Shared\images\widget_error_icon.bmp
c:\documents and settings\Jewel\Application Data\alot\TimerManager\TimerManager.xml
c:\documents and settings\Jewel\Application Data\alot\TimerManager\TimerManager.xml.backup
c:\documents and settings\Jewel\Application Data\alot\toolbar.xml
c:\documents and settings\Jewel\Application Data\alot\toolbar.xml.backup
c:\documents and settings\Jewel\Application Data\alot\ToolbarSearch\ToolbarSearch.xml
c:\documents and settings\Jewel\Application Data\alot\ToolbarSearch\ToolbarSearch.xml.backup
c:\documents and settings\Jewel\Application Data\alot\Updater\Updater.xml
c:\documents and settings\Jewel\Application Data\alot\Updater\Updater.xml.backup
c:\documents and settings\Lexi_2\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Security 2010.lnk
c:\documents and settings\Lexi_2\Desktop\Internet Security 2010.lnk
c:\documents and settings\Lexi_2\Start Menu\Internet Security 2010.lnk
c:\documents and settings\Wanda_2\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Security 2010.lnk
c:\documents and settings\Wanda_2\Desktop\Internet Security 2010.lnk
c:\documents and settings\Wanda_2\Local Settings\Application Data\rhgwqw
c:\documents and settings\Wanda_2\Local Settings\Application Data\rhgwqw\twndsysguard.exe
c:\documents and settings\Wanda_2\Start Menu\Internet Security 2010.lnk
C:\LOG.TXT
c:\program files\InternetSecurity2010
c:\program files\InternetSecurity2010\IS2010.exe
c:\program files\PlaySushi\PSTExt.dll
c:\program files\Search Guard Plus
c:\program files\Search Guard Plus\fbsProtection.xml
c:\program files\Search Guard Plus\fbsSearchProvider.xml
c:\program files\Search Guard Plus\FbsSearchProviderIE8.exe
c:\program files\Search Guard Plus\SearchGuardPlus.exe
c:\program files\Search Guard Plus\SearchGuardPlus.ico
c:\program files\Search Guard Plus\uninstalSGP.exe
c:\program files\Search Guard PlusU
c:\program files\Search Guard PlusU\SGPU.ico
c:\program files\Search Guard PlusU\sgpUpdater.exe
c:\program files\Search Guard PlusU\sgpUpdater.xml
c:\program files\Search Guard PlusU\sgpUpdaters.exe
c:\program files\Search Guard PlusU\uninstalSGPU.exe
c:\program files\SGPSA
C:\s
c:\windows\osekegubix.dll
c:\windows\system32\11478.exe
c:\windows\system32\11942.exe
c:\windows\system32\14604.exe
c:\windows\system32\153.exe
c:\windows\system32\15724.exe
c:\windows\system32\16827.exe
c:\windows\system32\18467.exe
c:\windows\system32\19169.exe
c:\windows\system32\23281.exe
c:\windows\system32\24464.exe
c:\windows\system32\26500.exe
c:\windows\system32\26962.exe
c:\windows\system32\28145.exe
c:\windows\system32\29358.exe
c:\windows\system32\2995.exe
c:\windows\system32\32391.exe
c:\windows\system32\3902.exe
c:\windows\system32\41.exe
c:\windows\system32\4827.exe
c:\windows\system32\491.exe
c:\windows\system32\5436.exe
c:\windows\system32\5705.exe
c:\windows\system32\6334.exe
c:\windows\system32\9961.exe
c:\windows\system32\config\systemprofile\Local Settings\Application Data\bdbnbr
c:\windows\system32\config\systemprofile\Local Settings\Application Data\bdbnbr\vidfsysguard.exe
c:\windows\system32\drivers\soqnjgjn.sys
c:\windows\system32\feksybh.dll
c:\windows\system32\kbdsock.dll
c:\windows\system32\mshlps.dll
c:\windows\system32\winhelper86.dll
c:\windows\system32\winlogon86.exe
c:\windows\system32\winsts.sys
c:\windows\system32\winupdate86.exe
c:\windows\temp\0183428e.exe
c:\windows\temp\86357152.exe

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :p
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_WINSTS
-------\Service_winsts
-------\Legacy_soqnjgjn
-------\Service_soqnjgjn


((((((((((((((((((((((((( Files Created from 2009-12-05 to 2010-01-05 )))))))))))))))))))))))))))))))
.

2010-01-05 15:36 . 2010-01-05 15:36 -------- d-----w- C:\32788R22FWJFW.1.tmp
2010-01-05 02:36 . 2010-01-05 03:13 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-01-05 02:36 . 2010-01-05 02:36 -------- d-----w- c:\program files\NOS
2010-01-04 14:23 . 2010-01-04 14:23 -------- d-----w- c:\program files\TrendMicro
2010-01-04 02:55 . 2010-01-04 02:55 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-01-04 02:28 . 2010-01-04 02:28 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Malwarebytes
2010-01-04 02:24 . 2010-01-04 02:24 137216 ----a-w- C:\eujbmv.exe
2010-01-04 02:24 . 2010-01-04 02:24 25088 ----a-w- C:\khkil.exe
2010-01-03 14:15 . 2010-01-05 13:37 120 ----a-w- c:\windows\Jwodiperewehap.dat
2010-01-03 14:15 . 2010-01-05 13:37 0 ----a-w- c:\windows\Ynoqiwepas.bin
2010-01-03 14:14 . 2010-01-03 14:14 -------- d-----w- c:\documents and settings\Wanda_2\Local Settings\Application Data\{6EA9A2DB-49E6-4C82-A74B-F254544B73E0}
2010-01-02 03:32 . 2010-01-02 03:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Princess Isabella
2009-12-20 01:28 . 2009-12-20 01:28 -------- d-----w- c:\windows\system32\wbem\Repository
2009-12-19 18:22 . 2009-12-20 01:31 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\hftqfq
2009-12-12 05:52 . 2009-12-12 05:52 -------- d-----w- c:\documents and settings\Jewel\Application Data\IObit
2009-12-07 20:12 . 2009-12-07 20:12 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\SecondLife
2009-12-07 20:12 . 2009-12-07 20:36 -------- d-----w- c:\documents and settings\Wanda_2\Local Settings\Application Data\SecondLife

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-05 16:09 . 2009-11-15 14:23 -------- d-----w- c:\program files\PlaySushi
2010-01-05 15:22 . 2010-01-05 15:22 388096 ----a-r- c:\documents and settings\Lexi_2\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-04 15:44 . 2004-08-04 03:59 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-01-04 14:23 . 2010-01-04 14:23 388096 ----a-r- c:\documents and settings\Wanda_2\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-02 03:38 . 2008-11-03 02:48 -------- d-----w- c:\program files\iWin.com
2010-01-02 03:31 . 2008-07-26 16:11 -------- d-----w- c:\program files\Yahoo! Games
2010-01-02 02:40 . 2008-07-24 21:31 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-01-01 20:00 . 2008-04-19 04:45 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-12-27 14:02 . 2008-10-01 01:42 1153816 ----a-w- c:\documents and settings\Jewel\Application Data\elefundesktops\autumntree_screensaver\flash.exe
2009-12-27 14:02 . 2008-10-01 01:42 81920 ----a-w- c:\documents and settings\Jewel\Application Data\elefundesktops\autumntree_screensaver\screensavercontoller.dll
2009-12-27 14:02 . 2008-10-01 01:42 1638404 ----a-w- c:\documents and settings\Jewel\Application Data\elefundesktops\autumntree_screensaver\swfplayer.exe
2009-12-27 14:02 . 2008-10-01 01:42 151552 ----a-w- c:\documents and settings\Jewel\Application Data\elefundesktops\autumntree_screensaver\sysinfo.exe
2009-12-27 01:10 . 2009-11-13 17:57 -------- d-----w- c:\program files\SpywareGuard
2009-12-17 21:37 . 2010-01-05 02:34 31936 ----a-w- c:\documents and settings\Wanda_2\Application Data\Mozilla\Firefox\Profiles\ogdutm03.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2009-12-17 21:37 . 2010-01-05 02:34 29344 ----a-w- c:\documents and settings\Wanda_2\Application Data\Mozilla\Firefox\Profiles\ogdutm03.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2009-12-16 02:20 . 2008-10-26 02:36 97 ----a-w- c:\windows\popcinfot.dat
2009-12-11 19:03 . 2008-12-07 22:07 -------- d-----w- c:\documents and settings\Lexi_2\Application Data\SecondLife
2009-12-08 23:20 . 2009-12-01 19:38 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\IMVU
2009-12-01 19:38 . 2009-12-01 19:38 76774 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\Uninstall.exe
2009-12-01 19:38 . 2009-12-01 19:37 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\IMVUClient
2009-12-01 17:28 . 2008-12-07 21:37 -------- d-----w- c:\program files\SecondLife
2009-12-01 02:31 . 2009-12-01 02:31 92192 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\IMVUupdater.exe
2009-12-01 02:31 . 2009-12-01 02:31 22784 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\IMVUQualityAgent.exe
2009-12-01 02:31 . 2009-12-01 02:31 52992 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\IMVUClient.exe
2009-12-01 02:30 . 2009-12-01 02:30 54784 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\nphwndproxy.dll
2009-12-01 02:30 . 2009-12-01 02:30 1188864 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\SceneWindow.dll
2009-12-01 02:30 . 2009-12-01 02:30 17408 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\MemoryHook.dll
2009-12-01 02:29 . 2009-12-01 02:29 301568 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\cal3d.dll
2009-12-01 02:29 . 2009-12-01 02:29 30720 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\CallStack.dll
2009-12-01 02:29 . 2009-12-01 02:29 190976 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\boost_python.dll
2009-12-01 02:29 . 2009-12-01 02:29 258048 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\audiere.dll
2009-11-29 20:24 . 2009-11-29 20:24 -------- d-----w- c:\documents and settings\Lexi_2\Application Data\PopCapv1002
2009-11-29 20:23 . 2008-10-26 02:36 0 ----a-w- c:\windows\popcreg.dat
2009-11-29 20:23 . 2008-10-05 01:03 -------- d-----w- c:\program files\PopCap Games
2009-11-29 14:35 . 2009-11-29 14:35 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap Games
2009-11-28 17:38 . 2009-08-08 02:47 117760 ----a-w- c:\documents and settings\Lexi_2\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-28 15:41 . 2008-09-20 04:01 -------- d-----w- c:\program files\FROG
2009-11-28 15:41 . 2009-11-27 02:39 -------- d-----w- c:\program files\PageRage
2009-11-27 02:38 . 2009-11-27 02:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Tarma Installer
2009-11-23 20:48 . 2009-11-23 20:48 7490192 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\VivoxVoiceManager.exe
2009-11-23 20:48 . 2009-11-23 20:48 345744 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\npvivoxvoiceplugin.dll
2009-11-23 20:48 . 2009-11-23 20:48 184832 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\ssleay32.dll
2009-11-23 20:48 . 2009-11-23 20:48 1006080 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\libeay32.dll
2009-11-14 19:32 . 2009-11-14 19:32 -------- d-----w- c:\documents and settings\Lexi_2\Application Data\Apple Computer
2009-11-14 19:21 . 2009-11-14 19:21 -------- d-----w- c:\program files\IObitCom
2009-11-14 19:21 . 2009-11-14 19:21 -------- d-----w- c:\program files\Conduit
2009-11-14 18:25 . 2009-11-14 01:53 -------- d-----w- c:\documents and settings\Lexi_2\Application Data\IObit
2009-11-14 01:48 . 2008-09-09 01:44 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-14 01:47 . 2009-08-07 18:22 117760 ----a-w- c:\documents and settings\Wanda_2\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-13 17:54 . 2009-11-13 17:54 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\IObit
2009-11-13 17:54 . 2009-11-13 17:54 -------- d-----w- c:\program files\IObit
2009-11-13 17:35 . 2009-11-13 01:23 -------- dc----w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-11-13 17:35 . 2009-11-13 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-11-13 17:35 . 2009-11-13 17:35 -------- d-----w- c:\program files\iWin Games
2009-11-13 17:35 . 2009-11-13 15:44 -------- d-----w- c:\program files\iWin Games(2)
2009-11-13 17:35 . 2008-11-03 02:47 -------- d-----w- c:\documents and settings\All Users\Application Data\iWin Games
2009-11-13 01:23 . 2009-11-13 01:23 -------- d-----w- c:\program files\Agnitum
2009-11-13 01:22 . 2009-11-13 01:22 -------- d-----w- c:\program files\Lavasoft
2009-11-13 01:20 . 2009-11-13 01:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Agnitum
2009-11-12 23:27 . 2009-11-12 23:27 3771296 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\NPSWF32.dll
2009-11-12 23:19 . 2009-11-12 23:19 5005968 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\vivoxsdk.dll
2009-11-12 23:19 . 2009-11-12 23:19 329872 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\libsndfile-1.dll
2009-11-12 23:19 . 2009-11-12 23:19 283280 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\vivoxoal.dll
2009-11-12 23:19 . 2009-11-12 23:19 246416 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\ortp.dll
2009-11-12 23:19 . 2009-11-12 23:19 1034896 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\DbgHelp.dll
2009-11-10 21:23 . 2009-10-29 21:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-10 19:25 . 2009-03-23 15:30 -------- d-----w- c:\program files\Spyware Doctor
2009-11-10 19:13 . 2009-11-10 19:13 -------- d-----w- c:\program files\Common Files\PC Tools
2009-11-10 19:13 . 2009-11-10 19:13 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\PC Tools
2009-11-10 19:13 . 2009-11-10 19:13 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-11-06 13:59 . 2009-11-06 13:59 4720 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2009-11-04 21:49 . 2009-11-14 18:25 635664 ----a-w- c:\documents and settings\Lexi_2\Application Data\IObit\Common\TB_Helper.exe
2009-11-02 20:58 . 2009-11-02 20:58 188928 ----a-w- c:\documents and settings\Lexi_2\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll
2009-10-30 01:18 . 2009-10-30 01:18 118784 ----a-w- c:\windows\Web\Wallpaper\Waterfalls Animated Wallpaper.exe
2009-10-12 19:17 . 2008-11-12 14:49 524 ----a-w- c:\documents and settings\Lexi_2\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{31c7d459-9cc3-44f2-9dca-fc11795309b4}"= "c:\program files\IObitCom\tbIObi.dll" [2009-10-01 2166296]

[HKEY_CLASSES_ROOT\clsid\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]
2009-10-01 22:29 2166296 ----a-w- c:\program files\IObitCom\tbIObi.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{31c7d459-9cc3-44f2-9dca-fc11795309b4}"= "c:\program files\IObitCom\tbIObi.dll" [2009-10-01 2166296]

[HKEY_CLASSES_ROOT\clsid\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{31C7D459-9CC3-44F2-9DCA-FC11795309B4}"= "c:\program files\IObitCom\tbIObi.dll" [2009-10-01 2166296]

[HKEY_CLASSES_ROOT\clsid\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusScannerPro"="c:\progra~1\AVANQU~1\Fix-It\MemCheck.exe" [2008-08-26 173312]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\Wanda_2\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoPopUpsOnBoot"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Jewel^Start Menu^Programs^Startup^IMVU.lnk]
backup=c:\windows\pss\IMVU.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Lexi_2^Start Menu^Programs^Startup^iWin Desktop Alerts.lnk]
path=c:\documents and settings\Lexi_2\Start Menu\Programs\Startup\iWin Desktop Alerts.lnk
backup=c:\windows\pss\iWin Desktop Alerts.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Wanda_2^Start Menu^Programs^Startup^iWin Desktop Alerts.lnk]
path=c:\documents and settings\Wanda_2\Start Menu\Programs\Startup\iWin Desktop Alerts.lnk
backup=c:\windows\pss\iWin Desktop Alerts.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2008-04-07 02:25 69632 ----a-w- c:\windows\ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2009-01-20 01:46 342848 ----a-w- c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2008-02-28 18:18 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EKIJ5000StatusMonitor]
2008-02-15 11:03 1052672 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-10-12 00:01 46368 ----a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2008-11-06 02:59 4347120 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-04-07 02:41 8466432 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-04-07 02:42 81920 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-04-07 02:42 1626112 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-10-12 00:03 29984 ----a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2007-09-17 16:56 124200 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 11:24 286720 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm]
2008-07-28 19:01 160592 ----a-w- c:\program files\Siber Systems\AI RoboForm\robotaskbaricon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-04-07 02:25 16859648 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
2008-10-07 15:23 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 14:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
2008-10-07 15:23 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1208580525\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\iWin Games\\iWinGames.exe"=
"c:\\Program Files\\iWin Games\\WebUpdater.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpsvc.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\iWin Games\\iWinTrusted.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8097:TCP"= 8097:TCP:EarthLink UHP Modem Support

R0 Achernar;Achernar - SCSI Command Filters;c:\windows\system32\drivers\Achernar.sys [7/20/2008 3:33 PM 16855]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [6/23/2009 10:01 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 10:01 AM 74480]
R2 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [9/2/2009 12:30 PM 78104]
R2 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\Printer\Center\KodakSvc.exe [2/28/2008 5:57 PM 18944]
R2 tmpreflt;tmpreflt;c:\progra~1\AVANQU~1\Fix-It\tmpreflt.sys [8/31/2007 1:36 PM 32528]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\windows\system32\drivers\Aldebaran.sys [7/20/2008 3:33 PM 21808]
R3 MailScan;MailScan;c:\progra~1\AVANQU~1\Fix-It\MailScan.sys [8/26/2008 4:14 PM 20496]
S2 gupdate1ca26895b87caa0;Google Update Service (gupdate1ca26895b87caa0);c:\program files\Google\Update\GoogleUpdate.exe [8/26/2009 3:11 PM 133104]
S2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" --> c:\program files\Windows Defender\MsMpEng.exe [?]
S3 JL2005;JL2005A Camera;c:\windows\system32\drivers\toywdm.sys [10/8/2005 5:22 PM 71512]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 10:01 AM 7408]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MAILSCAN

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 09:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 20:11]

2010-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 20:11]

2010-01-03 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 21:36]

2010-01-05 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 21:36]

2010-01-04 c:\windows\Tasks\Norton Security Scan for Wanda_2.job
- c:\program files\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2009-10-29 23:58]

2010-01-04 c:\windows\Tasks\User_Feed_Synchronization-{693C586D-CC8A-4A8C-A683-B2CD2CD201FC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride =
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: {{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - c:\program files\PlaySushi\PSText.dll
DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - [You must be registered and logged in to see this link.]
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Lexi_2\Application Data\Mozilla\Firefox\Profiles\zj3jvf37.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - MyWebSearch
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\Lexi_2\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Sony Online Entertainment\npsoe.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - hȋdden: XULRunner: {6EA9A2DB-49E6-4C82-A74B-F254544B73E0} - c:\documents and settings\Wanda_2\Local Settings\Application Data\{6EA9A2DB-49E6-4C82-A74B-F254544B73E0}
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{6f094b04-2c69-4ff3-ac74-d9716e97e296} - (no file)
WebBrowser-{6F094B04-2C69-4FF3-AC74-D9716E97E296} - (no file)
HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
HKLM-Run-Pqesufehoriqow - c:\windows\osekegubix.dll
AddRemove-Free_Game_Bar Toolbar - c:\progra~1\FREE_G~1\UNWISE.EXE
AddRemove-Doggie Daycare - c:\viva media\Doggie Daycare\uninst.exe
AddRemove-Happy Tails Animal Shelter - c:\viva media\Happy Tails Animal Shelter\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-01-05 11:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,24,a1,c4,fd,1b,8c,63,41,81,ee,ef,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,69,b6,31,0a,9e,6c,6b,45,bc,e9,8d,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{79db2c42-83a4-4118-94ac-3223238d2dcd}\InprocServer32]
@DACL=(02 0000)
@="c:\\windows\\system32\\yujukaku.dll"
"ThreadingModel"="Both"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7cfdd9bd-4c24-450b-af89-1b8206b1292e}\InprocServer32]
@DACL=(02 0000)
@="c:\\windows\\system32\\yujukaku.dll"
"ThreadingModel"="Both"

[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Toolbar\QuickComplete]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(668)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3680)
c:\windows\system32\WININET.dll
c:\progra~1\AVANQU~1\Fix-It\WinHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\AVANQU~1\Fix-It\mxtask.exe
c:\progra~1\AVANQU~1\Fix-It\mxtask.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2010-01-05 11:18:44 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-05 16:18

Pre-Run: 130,124,042,240 bytes free
Post-Run: 130,573,344,768 bytes free

- - End Of File - - 5ACB8359AB65EDDA6503CEE9D400D18A

jewelcraft
Novice
Novice

Posts Posts : 28
Joined Joined : 2009-07-04
OS OS : XP
Points Points : 27292
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Internet security 2010

Post by Belahzur on Tue Jan 05, 2010 4:33 pm

Darn, more malware still hiding.

Please download GooredFix from one of the locations below and save it to your Desktop
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

  • Ensure all Firefox windows are closed.
  • To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
  • When prompted to run the scan, click Yes.
  • GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Internet security 2010

Post by jewelcraft on Tue Jan 05, 2010 11:47 pm

GooredFix by jpshortstuff (02.01.10.1)
Log created at 18:46 on 05/01/2010 (Lexi_2)
Firefox version 3.5.5 (en-US)

========== GooredScan ==========

Removing Orphan:
"m3ffxtbr@mywebsearch.com"="C:\Program Files\MyWebSearch\bar\firefox\" -> Success!
Deleting HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{6EA9A2DB-49E6-4C82-A74B-F254544B73E0} -> Success!
Deleting C:\Documents and Settings\Wanda_2\Local Settings\Application Data\{6EA9A2DB-49E6-4C82-A74B-F254544B73E0} -> Success!

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{635abd67-4fe9-1b23-4f01-e679fa7484c1} [05:21 07/09/2008]
{972ce4c6-7e08-4474-a285-3208198ce6fd} [01:18 13/11/2009]

C:\Documents and Settings\Lexi_2\Application Data\Mozilla\Firefox\Profiles\zj3jvf37.default\extensions\
[You must be registered and logged in to see this link.] [02:38 27/11/2009]
{20a82645-c095-46ed-80e3-08825760534b} [16:37 14/11/2009]
{9565115d-c7d6-46d3-bd63-b67b481a4368} [02:39 27/11/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [12:52 08/08/2009]

-=E.O.F=-

jewelcraft
Novice
Novice

Posts Posts : 28
Joined Joined : 2009-07-04
OS OS : XP
Points Points : 27292
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Internet security 2010

Post by Belahzur on Wed Jan 06, 2010 12:41 am

Hello.

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    File::
    C:\eujbmv.exe
    C:\khkil.exe
    c:\windows\Jwodiperewehap.dat
    c:\windows\Ynoqiwepas.bin

    DDS::
    uInternet Settings,ProxyServer = http=127.0.0.1:5555
    uInternet Settings,ProxyOverride =

    Firefox::
    FF - ProfilePath - c:\documents and settings\Lexi_2\Application Data\Mozilla\Firefox\Profiles\zj3jvf37.default\
    FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
    FF - prefs.js: browser.search.selectedEngine - MyWebSearch
    FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
    FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]

    RegLockDel::
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{79db2c42-83a4-4118-94ac-3223238d2dcd}\InprocServer32]
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7cfdd9bd-4c24-450b-af89-1b8206b1292e}\InprocServer32]

    RegLock::
    [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Toolbar\QuickComplete]
  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Internet security 2010

Post by jewelcraft on Wed Jan 06, 2010 12:47 am

Im sorry, I dont understand what your asking me to do.

jewelcraft
Novice
Novice

Posts Posts : 28
Joined Joined : 2009-07-04
OS OS : XP
Points Points : 27292
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Internet security 2010

Post by Belahzur on Wed Jan 06, 2010 6:09 pm

Copy all what's inside my quote box into a notepad file. Save the file as CFScript.txt, then drop and drop the .txt file onto Combofix.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Internet security 2010

Post by jewelcraft on Thu Jan 07, 2010 3:15 am

ComboFix 10-01-04.01 - Lexi_2 01/06/2010 22:08:32.12.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1982.1381 [GMT -5:00]
Running from: c:\documents and settings\Lexi_2\Desktop\Combo-Fix.exe
AV: Avanquest VirusScanner Pro *On-access scanning enabled* (Updated) {6A383D4C-7657-408f-BD0D-B379B5C7C3BE}
AV: Microsoft Security Essentials *On-access scanning disabled* (Outdated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((( Files Created from 2009-12-07 to 2010-01-07 )))))))))))))))))))))))))))))))
.

2010-01-05 15:36 . 2010-01-05 15:36 -------- d-----w- C:\32788R22FWJFW.1.tmp
2010-01-05 15:22 . 2010-01-05 15:22 388096 ----a-r- c:\documents and settings\Lexi_2\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-05 02:36 . 2010-01-05 03:13 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-01-05 02:36 . 2010-01-05 02:36 -------- d-----w- c:\program files\NOS
2010-01-05 02:34 . 2009-12-17 21:37 31936 ----a-w- c:\documents and settings\Wanda_2\Application Data\Mozilla\Firefox\Profiles\ogdutm03.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-01-05 02:34 . 2009-12-17 21:37 29344 ----a-w- c:\documents and settings\Wanda_2\Application Data\Mozilla\Firefox\Profiles\ogdutm03.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-01-04 14:23 . 2010-01-04 14:23 388096 ----a-r- c:\documents and settings\Wanda_2\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-04 14:23 . 2010-01-04 14:23 -------- d-----w- c:\program files\TrendMicro
2010-01-04 02:55 . 2010-01-04 02:55 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-01-04 02:28 . 2010-01-04 02:28 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Malwarebytes
2010-01-02 03:32 . 2010-01-02 03:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Princess Isabella
2009-12-20 01:28 . 2009-12-20 01:28 -------- d-----w- c:\windows\system32\wbem\Repository
2009-12-19 18:22 . 2009-12-20 01:31 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\hftqfq
2009-12-12 05:52 . 2009-12-12 05:52 -------- d-----w- c:\documents and settings\Jewel\Application Data\IObit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-06 20:00 . 2008-04-19 04:45 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-05 16:09 . 2009-11-15 14:23 -------- d-----w- c:\program files\PlaySushi
2010-01-04 15:44 . 2004-08-04 03:59 96512 ------w- c:\windows\system32\drivers\atapi.sys
2010-01-02 03:38 . 2008-11-03 02:48 -------- d-----w- c:\program files\iWin.com
2010-01-02 03:31 . 2008-07-26 16:11 -------- d-----w- c:\program files\Yahoo! Games
2010-01-02 02:40 . 2008-07-24 21:31 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-27 14:02 . 2008-10-01 01:42 1153816 ----a-w- c:\documents and settings\Jewel\Application Data\elefundesktops\autumntree_screensaver\flash.exe
2009-12-27 14:02 . 2008-10-01 01:42 81920 ----a-w- c:\documents and settings\Jewel\Application Data\elefundesktops\autumntree_screensaver\screensavercontoller.dll
2009-12-27 14:02 . 2008-10-01 01:42 1638404 ----a-w- c:\documents and settings\Jewel\Application Data\elefundesktops\autumntree_screensaver\swfplayer.exe
2009-12-27 14:02 . 2008-10-01 01:42 151552 ----a-w- c:\documents and settings\Jewel\Application Data\elefundesktops\autumntree_screensaver\sysinfo.exe
2009-12-27 01:10 . 2009-11-13 17:57 -------- d-----w- c:\program files\SpywareGuard
2009-12-16 02:20 . 2008-10-26 02:36 97 ----a-w- c:\windows\popcinfot.dat
2009-12-11 19:03 . 2008-12-07 22:07 -------- d-----w- c:\documents and settings\Lexi_2\Application Data\SecondLife
2009-12-08 23:20 . 2009-12-01 19:38 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\IMVU
2009-12-07 20:12 . 2009-12-07 20:12 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\SecondLife
2009-12-01 19:38 . 2009-12-01 19:38 76774 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\Uninstall.exe
2009-12-01 19:38 . 2009-12-01 19:37 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\IMVUClient
2009-12-01 17:28 . 2008-12-07 21:37 -------- d-----w- c:\program files\SecondLife
2009-12-01 02:31 . 2009-12-01 02:31 92192 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\IMVUupdater.exe
2009-12-01 02:31 . 2009-12-01 02:31 22784 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\IMVUQualityAgent.exe
2009-12-01 02:31 . 2009-12-01 02:31 52992 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\IMVUClient.exe
2009-12-01 02:30 . 2009-12-01 02:30 54784 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\nphwndproxy.dll
2009-12-01 02:30 . 2009-12-01 02:30 1188864 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\SceneWindow.dll
2009-12-01 02:30 . 2009-12-01 02:30 17408 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\MemoryHook.dll
2009-12-01 02:29 . 2009-12-01 02:29 301568 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\cal3d.dll
2009-12-01 02:29 . 2009-12-01 02:29 30720 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\CallStack.dll
2009-12-01 02:29 . 2009-12-01 02:29 190976 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\boost_python.dll
2009-12-01 02:29 . 2009-12-01 02:29 258048 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\audiere.dll
2009-11-29 20:24 . 2009-11-29 20:24 -------- d-----w- c:\documents and settings\Lexi_2\Application Data\PopCapv1002
2009-11-29 20:23 . 2008-10-26 02:36 0 ----a-w- c:\windows\popcreg.dat
2009-11-29 20:23 . 2008-10-05 01:03 -------- d-----w- c:\program files\PopCap Games
2009-11-29 14:35 . 2009-11-29 14:35 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap Games
2009-11-28 17:38 . 2009-08-08 02:47 117760 ----a-w- c:\documents and settings\Lexi_2\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-28 15:41 . 2008-09-20 04:01 -------- d-----w- c:\program files\FROG
2009-11-28 15:41 . 2009-11-27 02:39 -------- d-----w- c:\program files\PageRage
2009-11-27 02:38 . 2009-11-27 02:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Tarma Installer
2009-11-23 20:48 . 2009-11-23 20:48 7490192 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\VivoxVoiceManager.exe
2009-11-23 20:48 . 2009-11-23 20:48 345744 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\npvivoxvoiceplugin.dll
2009-11-23 20:48 . 2009-11-23 20:48 184832 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\ssleay32.dll
2009-11-23 20:48 . 2009-11-23 20:48 1006080 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\libeay32.dll
2009-11-14 19:32 . 2009-11-14 19:32 -------- d-----w- c:\documents and settings\Lexi_2\Application Data\Apple Computer
2009-11-14 19:21 . 2009-11-14 19:21 -------- d-----w- c:\program files\IObitCom
2009-11-14 19:21 . 2009-11-14 19:21 -------- d-----w- c:\program files\Conduit
2009-11-14 18:25 . 2009-11-14 01:53 -------- d-----w- c:\documents and settings\Lexi_2\Application Data\IObit
2009-11-14 01:48 . 2008-09-09 01:44 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-14 01:47 . 2009-08-07 18:22 117760 ----a-w- c:\documents and settings\Wanda_2\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-13 17:54 . 2009-11-13 17:54 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\IObit
2009-11-13 17:54 . 2009-11-13 17:54 -------- d-----w- c:\program files\IObit
2009-11-13 17:35 . 2009-11-13 01:23 -------- dc----w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-11-13 17:35 . 2009-11-13 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-11-13 17:35 . 2009-11-13 17:35 -------- d-----w- c:\program files\iWin Games
2009-11-13 17:35 . 2009-11-13 15:44 -------- d-----w- c:\program files\iWin Games(2)
2009-11-13 17:35 . 2008-11-03 02:47 -------- d-----w- c:\documents and settings\All Users\Application Data\iWin Games
2009-11-13 01:23 . 2009-11-13 01:23 -------- d-----w- c:\program files\Agnitum
2009-11-13 01:22 . 2009-11-13 01:22 -------- d-----w- c:\program files\Lavasoft
2009-11-13 01:20 . 2009-11-13 01:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Agnitum
2009-11-12 23:27 . 2009-11-12 23:27 3771296 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\NPSWF32.dll
2009-11-12 23:19 . 2009-11-12 23:19 5005968 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\vivoxsdk.dll
2009-11-12 23:19 . 2009-11-12 23:19 329872 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\libsndfile-1.dll
2009-11-12 23:19 . 2009-11-12 23:19 283280 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\vivoxoal.dll
2009-11-12 23:19 . 2009-11-12 23:19 246416 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\ortp.dll
2009-11-12 23:19 . 2009-11-12 23:19 1034896 ----a-w- c:\documents and settings\Wanda_2\Application Data\IMVUClient\ui\plugins\DbgHelp.dll
2009-11-10 21:23 . 2009-10-29 21:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-10 19:25 . 2009-03-23 15:30 -------- d-----w- c:\program files\Spyware Doctor
2009-11-10 19:13 . 2009-11-10 19:13 -------- d-----w- c:\program files\Common Files\PC Tools
2009-11-10 19:13 . 2009-11-10 19:13 -------- d-----w- c:\documents and settings\Wanda_2\Application Data\PC Tools
2009-11-10 19:13 . 2009-11-10 19:13 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-11-06 13:59 . 2009-11-06 13:59 4720 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2009-11-04 21:49 . 2009-11-14 18:25 635664 ----a-w- c:\documents and settings\Lexi_2\Application Data\IObit\Common\TB_Helper.exe
2009-11-02 20:58 . 2009-11-02 20:58 188928 ----a-w- c:\documents and settings\Lexi_2\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll
2009-10-30 01:18 . 2009-10-30 01:18 118784 ----a-w- c:\windows\Web\Wallpaper\Waterfalls Animated Wallpaper.exe
2009-10-12 19:17 . 2008-11-12 14:49 524 ----a-w- c:\documents and settings\Lexi_2\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-20 19:21 . 2010-01-06 01:03 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-07-20 19:21 . 2010-01-05 14:05 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{31c7d459-9cc3-44f2-9dca-fc11795309b4}"= "c:\program files\IObitCom\tbIObi.dll" [2009-10-01 2166296]

[HKEY_CLASSES_ROOT\clsid\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]
2009-10-01 22:29 2166296 ----a-w- c:\program files\IObitCom\tbIObi.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{31c7d459-9cc3-44f2-9dca-fc11795309b4}"= "c:\program files\IObitCom\tbIObi.dll" [2009-10-01 2166296]

[HKEY_CLASSES_ROOT\clsid\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{31C7D459-9CC3-44F2-9DCA-FC11795309B4}"= "c:\program files\IObitCom\tbIObi.dll" [2009-10-01 2166296]

[HKEY_CLASSES_ROOT\clsid\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirusScannerPro"="c:\progra~1\AVANQU~1\Fix-It\MemCheck.exe" [2008-08-26 173312]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\Wanda_2\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoPopUpsOnBoot"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Jewel^Start Menu^Programs^Startup^IMVU.lnk]
backup=c:\windows\pss\IMVU.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Lexi_2^Start Menu^Programs^Startup^iWin Desktop Alerts.lnk]
path=c:\documents and settings\Lexi_2\Start Menu\Programs\Startup\iWin Desktop Alerts.lnk
backup=c:\windows\pss\iWin Desktop Alerts.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Wanda_2^Start Menu^Programs^Startup^iWin Desktop Alerts.lnk]
path=c:\documents and settings\Wanda_2\Start Menu\Programs\Startup\iWin Desktop Alerts.lnk
backup=c:\windows\pss\iWin Desktop Alerts.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2008-04-07 02:25 69632 ----a-w- c:\windows\ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
2009-01-20 01:46 342848 ----a-w- c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2008-02-28 18:18 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EKIJ5000StatusMonitor]
2008-02-15 11:03 1052672 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-10-12 00:01 46368 ----a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2008-11-06 02:59 4347120 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-04-07 02:41 8466432 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-04-07 02:42 81920 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-04-07 02:42 1626112 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-10-12 00:03 29984 ----a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2007-09-17 16:56 124200 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 11:24 286720 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm]
2008-07-28 19:01 160592 ----a-w- c:\program files\Siber Systems\AI RoboForm\robotaskbaricon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-04-07 02:25 16859648 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
2008-10-07 15:23 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 14:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
2008-10-07 15:23 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1208580525\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\iWin Games\\iWinGames.exe"=
"c:\\Program Files\\iWin Games\\WebUpdater.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpsvc.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\iWin Games\\iWinTrusted.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8097:TCP"= 8097:TCP:EarthLink UHP Modem Support

R0 Achernar;Achernar - SCSI Command Filters;c:\windows\system32\drivers\Achernar.sys [7/20/2008 3:33 PM 16855]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [6/23/2009 10:01 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 10:01 AM 74480]
R2 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [9/2/2009 12:30 PM 78104]
R2 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\Printer\Center\KodakSvc.exe [2/28/2008 5:57 PM 18944]
R2 tmpreflt;tmpreflt;c:\progra~1\AVANQU~1\Fix-It\tmpreflt.sys [8/31/2007 1:36 PM 32528]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\windows\system32\drivers\Aldebaran.sys [7/20/2008 3:33 PM 21808]
R3 MailScan;MailScan;c:\progra~1\AVANQU~1\Fix-It\MailScan.sys [8/26/2008 4:14 PM 20496]
S2 gupdate1ca26895b87caa0;Google Update Service (gupdate1ca26895b87caa0);c:\program files\Google\Update\GoogleUpdate.exe [8/26/2009 3:11 PM 133104]
S2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" --> c:\program files\Windows Defender\MsMpEng.exe [?]
S3 JL2005;JL2005A Camera;c:\windows\system32\drivers\toywdm.sys [10/8/2005 5:22 PM 71512]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 10:01 AM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 09:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 20:11]

2010-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 20:11]

2010-01-03 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 21:36]

2010-01-07 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 21:36]

2010-01-06 c:\windows\Tasks\Norton Security Scan for Wanda_2.job
- c:\program files\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2009-10-29 23:58]

2010-01-07 c:\windows\Tasks\User_Feed_Synchronization-{693C586D-CC8A-4A8C-A683-B2CD2CD201FC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: {{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - c:\program files\PlaySushi\PSText.dll
DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - [You must be registered and logged in to see this link.]
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Lexi_2\Application Data\Mozilla\Firefox\Profiles\zj3jvf37.default\
FF - component: c:\documents and settings\Lexi_2\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Sony Online Entertainment\npsoe.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-01-06 22:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,24,a1,c4,fd,1b,8c,63,41,81,ee,ef,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,69,b6,31,0a,9e,6c,6b,45,bc,e9,8d,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(664)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2964)
c:\windows\system32\WININET.dll
c:\progra~1\AVANQU~1\Fix-It\WinHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-01-06 22:13:31
ComboFix-quarantined-files.txt 2010-01-07 03:13
ComboFix2.txt 2010-01-07 01:19
ComboFix3.txt 2010-01-05 16:18

Pre-Run: 130,420,482,048 bytes free
Post-Run: 130,462,568,448 bytes free

- - End Of File - - B0441ECC4BD307E82A4307EBD485B8F0

jewelcraft
Novice
Novice

Posts Posts : 28
Joined Joined : 2009-07-04
OS OS : XP
Points Points : 27292
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Internet security 2010

Post by Belahzur on Thu Jan 07, 2010 1:49 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum