Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1]   Go Down

Author Topic: Application cannot be executed. the file xxxx is infected  (Read 8517 times)

0 Members and 1 Guest are viewing this topic.

sherwindy

    Topic Starter


    Greenhorn

    Application cannot be executed. the file xxxx is infected
    « on: May 16, 2010, 06:41:43 PM »
    Hello my computer appears to be infected with this antispyware soft rogue. Every time someone logs in on the family account a host of warning messages appear and many programs cant be opened. I'm logged in on my seperate password protected account and there are no symptoms of it here. I did a AVG, Malwarebytes and HijackThis scan; The AVG found a trojan, malwarebytes found rogue.antispywaresoft although after removal of all the infections, the problem is still apparent on the family account. Any ideas?

    Here is the hijackThis log but this was on my log in account as hijack this can't be opened on the other user so not sure if this is even helpful, should I get that rkill program?:
    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 10:37:11 AM, on 17/05/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.17023)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam\Quickcam.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
    C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    C:\Documents and Settings\Sherwin\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
    O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
    O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
    O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.fujifilmimagine.com/imagine/ax/ImageUploader5.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
    O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{E11833ED-AC64-4512-9146-A58F5247EB34}: Domain = vic.bigpond.net.au
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

    --
    End of file - 12035 bytes
    Logged

    sherwindy

      Topic Starter


      Greenhorn

      Re: Application cannot be executed. the file xxxx is infected
      « Reply #1 on: May 16, 2010, 06:56:37 PM »
      okay i downloaded all of the rkill files .exe, .scr etc and none of them are able to be opened on the family xp account, it just comes up with a host of fake security messages about the files being infected. I AM GETTING ENFURIATED.

      cheeers guys
      Logged

      Dr Jay

      • Malware Removal Specialist


        • Specialist
      • Moderator emeritus
        • Thanked: 119
      • Experience: Guru
      • OS: Windows 10
      Re: Application cannot be executed. the file xxxx is infected
      « Reply #2 on: May 16, 2010, 11:29:40 PM »
      Hello, and welcome to Computer Hope.

      Please note the following information about the malware forum:
      • Only the Malware Specialist Team is allowed to give advice on removing malware from your computer.
      • From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by the staff I noted above.
      • Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
      • If you have already asked for help somewhere, please post the link to the topic you were helped.
      • We try our best to reply quickly, but for any reason we do not reply in two days, reply to this topic with the word BUMP
      • Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

      Please visit this webpage for a tutorial on downloading and running ComboFix:

      http://www.bleepingcomputer.com/combofix/how-to-use-combofix

      See the area: Using ComboFix, and when done, post the log back here.
      Logged
      ~Dr Jay

      sherwindy

        Topic Starter


        Greenhorn

        Re: Application cannot be executed. the file xxxx is infected
        « Reply #3 on: May 17, 2010, 05:01:25 AM »
        Cheers mate, I couldn't execute combofix on the other xp account due to the virus so i did it on my username; here is the log.

        ComboFix 10-05-16.02 - Sherwin 17/05/2010  20:33:53.1.1 - x86
        Microsoft Windows XP Home Edition  5.1.2600.3.1252.61.1033.18.1471.808 [GMT 10:00]
        Running from: c:\documents and settings\Sherwin\Desktop\ComboFix.exe
        AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
        .

        (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
        .

        c:\documents and settings\TEMP\Local Settings\Application Data\xeraryvrc
        c:\documents and settings\TEMP\Local Settings\Application Data\xeraryvrc\tsnmnnatssd.exe
        c:\windows\system32\AutoRun.inf
        c:\windows\system32\uactmp.db
        c:\windows\system32\UACxfjmfoax.db

        .
        (((((((((((((((((((((((((   Files Created from 2010-04-17 to 2010-05-17  )))))))))))))))))))))))))))))))
        .

        No new files created in this timespan

        .
        ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2010-05-17 09:51 . 2008-06-28 04:39   --------   d-----w-   c:\documents and settings\All Users\Application Data\avg8
        2010-05-16 12:19 . 2009-04-09 14:32   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
        2010-05-16 11:51 . 2009-07-29 09:50   --------   d-----w-   c:\documents and settings\TEMP\Application Data\FrostWire
        2010-05-07 09:43 . 2010-03-26 10:39   --------   d-----w-   c:\documents and settings\TEMP\Application Data\Skype
        2010-05-07 09:43 . 2010-03-26 10:46   --------   d-----w-   c:\documents and settings\TEMP\Application Data\skypePM
        2010-05-06 00:36 . 2009-10-02 20:18   221568   ------w-   c:\windows\system32\MpSigStub.exe
        2010-05-02 05:51 . 2008-07-16 11:09   --------   d-----w-   c:\documents and settings\Sherwin\Application Data\FrostWire
        2010-04-29 05:39 . 2009-04-09 14:32   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
        2010-04-29 05:39 . 2009-04-09 14:32   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
        2010-04-16 06:17 . 2007-12-12 05:38   --------   d-----w-   c:\documents and settings\Sherwin\Application Data\uTorrent
        2010-04-16 03:39 . 2010-03-30 21:43   --------   d-----w-   c:\documents and settings\Sherwin\Application Data\Skype
        2010-04-16 03:35 . 2010-03-30 21:48   --------   d-----w-   c:\documents and settings\Sherwin\Application Data\skypePM
        2010-04-02 01:18 . 2009-11-17 02:47   --------   d-----w-   c:\documents and settings\TEMP\Application Data\uTorrent
        2010-03-30 02:23 . 2010-03-30 02:18   --------   d-----w-   c:\program files\Common Files\LogiShrd
        2010-03-30 02:19 . 2010-03-30 02:19   --------   d-----w-   c:\documents and settings\All Users\Application Data\Logitech
        2010-03-30 02:18 . 2010-03-30 02:18   --------   d-----w-   c:\program files\Logitech
        2010-03-30 02:17 . 2010-03-30 02:17   --------   d-----w-   c:\documents and settings\All Users\Application Data\LogiShrd
        2010-03-27 03:39 . 2010-03-27 03:39   664   ----a-w-   c:\windows\system32\d3d9caps.dat
        2010-03-26 10:46 . 2010-03-26 10:46   56   ---ha-w-   c:\windows\system32\ezsidmv.dat
        2010-03-26 10:36 . 2006-06-26 13:10   --------   d-----w-   c:\program files\Google
        2010-03-26 10:34 . 2010-03-26 10:33   --------   d-----r-   c:\program files\Skype
        2010-03-26 10:33 . 2010-03-26 10:33   --------   d-----w-   c:\program files\Common Files\Skype
        2010-03-26 10:33 . 2010-03-26 10:32   --------   d-----w-   c:\documents and settings\All Users\Application Data\Skype
        2010-03-21 02:38 . 2009-09-11 10:43   69   ----a-w-   c:\documents and settings\Sherwin\jagex_runescape_preferences2.dat
        2010-03-21 02:36 . 2008-07-02 02:02   41   ----a-w-   c:\documents and settings\Sherwin\jagex_runescape_preferences.dat
        2010-03-11 12:38 . 2004-08-04 12:00   832512   ----a-w-   c:\windows\system32\wininet.dll
        2010-03-11 12:38 . 2008-09-07 04:35   78336   ----a-w-   c:\windows\system32\ieencode.dll
        2010-03-11 12:38 . 2008-09-07 04:34   17408   ----a-w-   c:\windows\system32\corpol.dll
        2010-03-09 11:09 . 2008-09-07 04:34   430080   ----a-w-   c:\windows\system32\vbscript.dll
        2010-02-24 13:11 . 2008-09-07 04:33   455680   ----a-w-   c:\windows\system32\drivers\mrxsmb.sys
        2010-02-22 09:12 . 2010-02-22 09:12   503808   ----a-w-   c:\documents and settings\Sherwin\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-707bb77f-n\msvcp71.dll
        2010-02-22 09:12 . 2010-02-22 09:12   499712   ----a-w-   c:\documents and settings\Sherwin\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-707bb77f-n\jmc.dll
        2010-02-22 09:12 . 2010-02-22 09:12   348160   ----a-w-   c:\documents and settings\Sherwin\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-707bb77f-n\msvcr71.dll
        2010-02-22 09:12 . 2010-02-22 09:12   61440   ----a-w-   c:\documents and settings\Sherwin\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-59320863-n\decora-sse.dll
        2010-02-22 09:12 . 2010-02-22 09:12   12800   ----a-w-   c:\documents and settings\Sherwin\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-59320863-n\decora-d3d.dll
        2010-02-20 03:14 . 2010-02-20 03:14   503808   ----a-w-   c:\documents and settings\TEMP\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-697d0d8d-n\msvcp71.dll
        2010-02-20 03:14 . 2010-02-20 03:14   499712   ----a-w-   c:\documents and settings\TEMP\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-697d0d8d-n\jmc.dll
        2010-02-20 03:14 . 2010-02-20 03:14   348160   ----a-w-   c:\documents and settings\TEMP\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-697d0d8d-n\msvcr71.dll
        2010-02-20 03:14 . 2010-02-20 03:14   61440   ----a-w-   c:\documents and settings\TEMP\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-70c01420-n\decora-sse.dll
        2010-02-20 03:14 . 2010-02-20 03:14   12800   ----a-w-   c:\documents and settings\TEMP\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-70c01420-n\decora-d3d.dll
        2010-02-16 23:10 . 2008-09-07 04:33   2189952   ----a-w-   c:\windows\system32\ntoskrnl.exe
        2010-02-16 13:25 . 2008-09-07 04:33   2066816   ----a-w-   c:\windows\system32\ntkrnlpa.exe
        .

        (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* empty entries & legit default entries are not shown
        REGEDIT4

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "VTTimer"="VTTimer.exe" [2005-03-07 53248]
        "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
        "VTTrayp"="VTtrayp.exe" [2005-10-31 163840]
        "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
        "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]
        "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]
        "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
        "RunNarrator"="Narrator.exe" [2008-04-14 53760]

        c:\documents and settings\All Users\Start Menu\Programs\Startup\
        Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
        WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2006-8-28 745472]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
        2009-08-22 23:34   11952   ----a-w-   c:\windows\system32\avgrsstx.dll

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
        @="Service"

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
        @="Service"

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
        2009-01-05 05:18   413696   -c--a-w-   c:\program files\QuickTime\QTTask.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
        "C-Media Mixer"=Mixer.exe /startup
        "AVG8_TRAY"=c:\progra~1\AVG\AVG8\avgtray.exe
        "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
        "DisableMonitoring"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "c:\\Program Files\\Messenger\\msmsgs.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "c:\\Program Files\\uTorrent\\uTorrent.exe"=
        "c:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
        "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
        "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
        "c:\\Program Files\\Opera\\opera.exe"=
        "c:\\Program Files\\FrostWire\\FrostWire.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
        "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
        "c:\\Program Files\\iTunes\\iTunes.exe"=
        "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
        "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
        "c:\\Documents and Settings\\TEMP\\Desktop\\uTorrent.exe"=
        "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
        "c:\\WINDOWS\\system32\\dpvsetup.exe"=
        "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "27633:TCP"= 27633:TCP:Limewire
        "27633:UDP"= 27633:UDP:Limewire

        R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [30/01/2009 5:44 PM 64288]
        R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [16/05/2008 8:10 PM 685816]
        R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [28/06/2008 2:39 PM 335240]
        R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [28/06/2008 2:39 PM 297752]
        R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [28/08/2006 6:23 PM 66048]
        R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 9:17 PM 1181328]
        R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3/11/2006 7:19 PM 13592]
        R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [28/08/2006 6:19 PM 113792]
        S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [26/03/2010 8:37 PM 135664]
        S3 BPIKSp50;BPIKSp50 NDIS Protocol Driver;\??\d:\bpiksp50.sys --> d:\BPIKSp50.sys [?]
        S3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys --> c:\windows\System32\Drivers\SjyPkt.sys [?]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
        HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
        hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
        .
        Contents of the 'Scheduled Tasks' folder

        2010-05-17 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
        - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 07:25]

        2010-05-17 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
        - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 07:25]

        2010-05-17 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
        - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 07:25]

        2010-05-17 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
        - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 07:25]

        2010-05-17 c:\windows\Tasks\Ad-Aware Update (Weekly).job
        - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 07:25]

        2010-02-18 c:\windows\Tasks\AppleSoftwareUpdate.job
        - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 01:34]

        2010-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
        - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 10:36]

        2010-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
        - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 10:36]

        2010-05-17 c:\windows\Tasks\MP Scheduled Scan.job
        - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 09:20]
        .
        .
        ------- Supplementary Scan -------
        .
        uStart Page = about:blank
        uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
        IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
        DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
        FF - ProfilePath - c:\documents and settings\Sherwin\Application Data\Mozilla\Firefox\Profiles\djnk51pv.default\
        FF - prefs.js: browser.startup.homepage - about:blank
        FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
        FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
        FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
        FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
        FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

        ---- FIREFOX POLICIES ----
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
        c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_ everywhere__temporarily_available_pref", true);
        c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
        c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_a s_broken", false);
        c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
        .
        - - - - ORPHANS REMOVED - - - -

        MSConfigStartUp-Cmaudio - cmicnfg.cpl



        **************************************************************************

        catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2010-05-17 20:50
        Windows 5.1.2600 Service Pack 3 NTFS

        scanning hidden processes ... 

        scanning hidden autostart entries ...

        scanning hidden files ... 

        scan completed successfully
        hidden files: 0

        **************************************************************************

        Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

        device: opened successfully
        user: MBR read successfully
        called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sptd.sys >>UNKNOWN [0x8A2F68AC]<<
        kernel: MBR read successfully
        detected MBR rootkit hooks:
        \Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
        \Driver\ACPI -> ACPI.sys @ 0xb9e7dcb8
        \Driver\atapi -> atapi.sys @ 0xb9e38b40
        IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579014
         ParseProcedure -> ntkrnlpa.exe @ 0x80577c76
        \Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579014
         ParseProcedure -> ntkrnlpa.exe @ 0x80577c76
        NDIS:  -> SendCompleteHandler -> 0x0
         PacketIndicateHandler -> 0x0
         SendHandler -> 0x0
        user & kernel MBR OK

        **************************************************************************
        .
        --------------------- DLLs Loaded Under Running Processes ---------------------

        - - - - - - - > 'explorer.exe'(6820)
        c:\windows\system32\WININET.dll
        c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
        c:\windows\system32\ieframe.dll
        c:\windows\system32\WPDShServiceObj.dll
        c:\windows\system32\PortableDeviceTypes.dll
        c:\windows\system32\PortableDeviceApi.dll
        .
        ------------------------ Other Running Processes ------------------------
        .
        c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
        c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        c:\program files\Bonjour\mDNSResponder.exe
        c:\progra~1\AVG\AVG8\avgrsx.exe
        c:\program files\Java\jre6\bin\jqs.exe
        c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
        c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
        c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
        c:\program files\Windows Media Player\WMPNetwk.exe
        c:\windows\system32\wbem\unsecapp.exe
        c:\windows\system32\wscntfy.exe
        c:\windows\system32\VTTimer.exe
        c:\windows\system32\VTtrayp.exe
        c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
        c:\program files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
        c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
        .
        **************************************************************************
        .
        Completion time: 2010-05-17  20:58:28 - machine was rebooted
        ComboFix-quarantined-files.txt  2010-05-17 10:58

        Pre-Run: 12,930,306,048 bytes free
        Post-Run: 13,739,872,256 bytes free

        Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
        - - End Of File - - BEA9F323B0F1972B74FC7693FECCFD2E
        Logged

        sherwindy

          Topic Starter


          Greenhorn

          Re: Application cannot be executed. the file xxxx is infected
          « Reply #4 on: May 17, 2010, 05:07:00 AM »
          i just checked the other account and it appears the virus is gone! Everything is back to normal and I can open all files and the security warnings are gone. I can't believe it was as simple as that haha thank you dragonmaster jay this website and thyself have made me realise life IS worth living and that for every evil *censored* there is on a computer making viruses, there are a hundred clean souls helping those who experience the problems.

          live in peace and prosper.
          Logged

          Dr Jay

          • Malware Removal Specialist


            • Specialist
          • Moderator emeritus
            • Thanked: 119
          • Experience: Guru
          • OS: Windows 10
          Re: Application cannot be executed. the file xxxx is infected
          « Reply #5 on: May 18, 2010, 01:44:21 PM »
          Most of the time, when you have originally detected the malware issue, it means the computer is infected by malware of some sort. Antivirus scanners may not show a sign of the malware still being there, which could be a sign of a rootkit.

          Whenever rootkit scanners, and antivirus software scan for the rootkit, it gets as close to the system kernel as possible. If the rootkit is beyond that point, it will not be detected.

          So, the idea is, is when you post to a forum that you need help removing malware, it is best to stay with the helper, to ensure your computer is clean. However, it is up to you to continue or not.

          If you choose to continue, please do the following:

          Disable CD Emulation programs using DeFogger please perform these steps:
          • Please download DeFogger to your desktop.
          • Once downloaded, double-click on the DeFogger icon to start the tool.
          • The application window will now appear.  You should now click on the Disable button to disable your CD Emulation drivers
          • When it prompts you whether or not you want to continue, please click on the Yes button to continue
          • When the program has completed you will see a Finished! message. Click on the OK button to exit the program.
          • If CD Emulation programs are present and have been disabled, DeFogger will now ask you to reboot the machine.  Please allow it to do so by clicking on the OK button.
          GMER

          Note about this tool:
          • This program may freeze. Do not reboot the computer, unless it has been frozen for over 30 minutes.
          • This program may cause a blue screen of death. If it does, do not scan, and then reply to let me know.
          • No matter what is in the log, please post all the information/contents of the log.
          Please download the GMER Rootkit Scanner. Unzip it to your Desktop.

          Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

          Double-click gmer.exe. The program will begin to run.

          **Caution**
          These types of scans can produce false positives. Do NOT take any action on any           "<--- ROOKIT" entries unless advised!

          If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
          • Click NO
          • In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
          • Now click the Scan button.
          Once the scan is complete, you may receive another notice about rootkit activity.
          • Click OK.
          • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
          • Save it where you can easily find it, such as your desktop.
          Post the contents of GMER.txt in your next reply.
          Logged
          ~Dr Jay
          Pages: [1]   Go Up
          « previous next »