Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Can someone help me please!!  (Read 13153 times)

0 Members and 1 Guest are viewing this topic.


007will

    Topic Starter


    Beginner

    Re: Can someone help me please!!
    « Reply #16 on: May 10, 2011, 11:27:13 AM »
    ComboFix 11-05-09.03 - Owner 10/05/2011  18:13:20.2.2 - x86
    Microsoft Windows XP Home Edition  5.1.2600.3.1252.44.1033.18.1014.545 [GMT 1:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
    AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
    .
    .
    (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\All Users\Application Data\bL28601CaIgA28601
    c:\documents and settings\All Users\Application Data\bL28601CaIgA28601\bL28601CaIgA28601
    c:\documents and settings\Owner\Application Data\xfgkxer1hbbxwfxokvojijtyebjdow3k2
    .
    .
    (((((((((((((((((((((((((   Files Created from 2011-04-10 to 2011-05-10  )))))))))))))))))))))))))))))))
    .
    .
    2011-05-08 11:48 . 2011-05-09 16:33   --------   d-----w-   c:\documents and settings\Owner\Application Data\Ulirmo
    2011-05-05 21:25 . 2011-05-05 21:25   135680   ----a-w-   c:\windows\system32\drivers\ethxylvf.sys
    2011-05-05 21:22 . 2011-05-05 21:22   388096   ----a-r-   c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-05-05 21:22 . 2011-05-05 21:22   --------   d-----w-   c:\program files\Trend Micro
    2011-05-05 21:20 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Common Files\Java
    2011-05-05 20:44 . 2011-05-05 20:44   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2011-05-05 20:35 . 2010-12-20 17:09   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
    2011-05-05 20:35 . 2010-12-20 17:08   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
    2011-05-05 20:32 . 2011-05-05 20:32   --------   d-----w-   c:\program files\CCleaner
    2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\rpcns4H.dll
    2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\logonuiv.dll
    2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\ialmuTHAU.dll
    2011-05-05 18:41 . 2011-04-11 07:04   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C8C2A59-AC6B-4305-BF8F-AA42A1FBBBC0}\mpengine.dll
    2011-04-29 12:34 . 2011-04-29 12:34   --------   d-----w-   c:\windows\system32\wbem\Repository
    2011-04-29 12:30 . 2011-04-29 12:33   --------   d-s---w-   c:\documents and settings\Administrator
    2011-04-29 06:43 . 2011-04-29 06:43   --------   d-----w-   c:\documents and settings\Owner\Application Data\Sibelius Software
    2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\Owner\Application Data\Malwarebytes
    2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-04-28 23:18 . 2011-05-05 20:35   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
    2011-04-28 22:38 . 2011-04-28 22:38   --------   d-----w-   c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
    2011-04-28 22:38 . 2011-05-08 11:50   --------   d-----w-   c:\program files\SUPERAntiSpyware
    2011-04-25 15:51 . 2011-04-25 15:51   --------   d-----w-   c:\program files\iPod
    2011-04-25 15:51 . 2011-04-25 15:53   --------   d-----w-   c:\program files\iTunes
    2011-04-25 15:46 . 2011-04-25 15:46   --------   d-----w-   c:\program files\Bonjour
    2011-04-25 14:07 . 2011-04-25 14:07   --------   d-----r-   C:\MSOCache
    2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\documents and settings\Owner\Local Settings\Application Data\SoftGrid Client
    2011-04-25 13:59 . 2011-05-09 17:10   --------   d-----w-   c:\documents and settings\Owner\Application Data\SoftGrid Client
    2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\{90140011-0062-0409-0000-0000000FF1CE}
    2011-04-25 13:59 . 2011-05-09 17:10   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\SoftGrid Client
    2011-04-25 13:57 . 2011-04-25 13:57   --------   d-----w-   c:\documents and settings\All Users\Microsoft
    2011-04-25 13:57 . 2011-04-29 12:38   --------   d-----w-   c:\program files\Microsoft Application Virtualization Client
    2011-04-25 13:56 . 2011-04-25 14:01   --------   d-----w-   c:\documents and settings\Owner\Application Data\TP
    2011-04-18 21:13 . 2011-04-18 21:13   --------   d-----w-   c:\documents and settings\Owner\Application Data\Amazon
    2011-04-18 21:12 . 2011-04-18 21:12   --------   d-----w-   c:\program files\Amazon
    2011-04-17 14:07 . 2011-04-17 14:07   --------   d-----w-   c:\windows\Sun
    2011-04-16 14:29 . 2011-04-16 14:29   --------   d-----w-   c:\documents and settings\Owner\Application Data\OpenOffice.org
    2011-04-16 14:26 . 2011-04-16 14:26   --------   d-----w-   c:\program files\OpenOffice.org 3
    2011-04-16 14:25 . 2011-04-14 04:07   472808   ----a-w-   c:\windows\system32\deployJava1.dll
    2011-04-16 14:25 . 2011-04-14 01:40   73728   ----a-w-   c:\windows\system32\javacpl.cpl
    2011-04-16 14:25 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Java
    .
    .
    .
    ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTITL.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTEXT.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSTMP.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSPEC.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSCRP.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSREH_.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSMET_.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSCHOR.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRS____.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSTEXT.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSSE__.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSS___.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSROMC.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSPC__.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSP___.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSO___.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSNN__.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSM___.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFS__.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFBE_.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFB__.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCSC_.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCS__.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSC___.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUS____.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INKPEN2_.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2TEXT.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SPEC.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SCRI.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2METR.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2CHOR.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELST___.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSS___.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSM___.FOT
    2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSINKI.FOT
    2011-04-11 07:04 . 2011-02-06 22:20   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2011-04-06 15:20 . 2011-04-06 15:20   91424   ----a-w-   c:\windows\system32\dnssd.dll
    2011-04-06 15:20 . 2011-04-06 15:20   75040   ----a-w-   c:\windows\system32\jdns_sd.dll
    2011-04-06 15:20 . 2011-04-06 15:20   197920   ----a-w-   c:\windows\system32\dnssdX.dll
    2011-04-06 15:20 . 2011-04-06 15:20   107808   ----a-w-   c:\windows\system32\dns-sd.exe
    2011-03-07 05:33 . 2011-01-11 19:25   692736   ----a-w-   c:\windows\system32\inetcomm.dll
    2011-03-04 06:37 . 2004-08-04 10:00   420864   ----a-w-   c:\windows\system32\vbscript.dll
    2011-03-03 13:21 . 2004-08-04 10:00   1857920   ----a-w-   c:\windows\system32\win32k.sys
    2011-02-22 23:06 . 2006-03-04 03:33   916480   ----a-w-   c:\windows\system32\wininet.dll
    2011-02-22 23:06 . 2004-08-04 10:00   43520   ------w-   c:\windows\system32\licmgr10.dll
    2011-02-22 23:06 . 2004-08-04 10:00   1469440   ------w-   c:\windows\system32\inetcpl.cpl
    2011-02-22 11:41 . 2004-08-04 10:00   385024   ------w-   c:\windows\system32\html.iec
    2011-02-17 13:18 . 2004-08-04 10:00   455936   ----a-w-   c:\windows\system32\drivers\mrxsmb.sys
    2011-02-17 13:18 . 2004-08-04 10:00   357888   ----a-w-   c:\windows\system32\drivers\srv.sys
    2011-02-17 12:32 . 2011-01-19 20:06   5120   ----a-w-   c:\windows\system32\xpsp4res.dll
    2011-02-15 12:56 . 2004-08-04 10:00   290432   ----a-w-   c:\windows\system32\atmfd.dll
    .
    .
    (((((((((((((((((((((((((((((   [email protected]_16.53.14   )))))))))))))))))))))))))))))))))))))))))
    .
    + 2011-01-11 09:59 . 2011-01-11 09:59   51024              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_214ee422\vcomp90.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   59728              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90rus.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   42832              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90kor.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   43344              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90jpn.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   61264              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90ita.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   62800              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90fra.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   61776              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esp.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   61776              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esn.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   53584              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90enu.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   63312              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90deu.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   36688              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90cht.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   35664              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90chs.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90u.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90.dll
    + 2011-05-10 17:19 . 2011-05-10 17:19   16384              c:\windows\temp\Perflib_Perfdata_798.dat
    + 2011-01-11 09:59 . 2011-01-11 09:59   653136              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcr90.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   569680              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcp90.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   225280              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcm90.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   159048              c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_65b7a93a\atl90.dll
    + 2011-05-09 17:10 . 2011-05-09 17:10   223232              c:\windows\Installer\186080.msi
    + 2011-01-11 09:59 . 2011-01-11 09:59   3780936              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90u.dll
    + 2011-01-11 09:59 . 2011-01-11 09:59   3766088              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90.dll
    .
    (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-08 2424192]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
    "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    .
    c:\documents and settings\Default User\Start Menu\Programs\Startup\
    ykitl.exe [2011-5-8 284160]
    .
    c:\documents and settings\Owner\Start Menu\Programs\Startup\
    OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
    Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @="Service"
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
    .
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656]
    R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\program files\ASTRA32\astra32.sys [22/02/2007 12:28 30864]
    R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [28/02/2010 02:33 821664]
    R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [24/04/2010 01:10 483688]
    R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [02/12/2009 22:23 554344]
    R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [02/12/2009 22:23 211432]
    R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [02/12/2009 22:23 20584]
    R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [02/12/2009 22:23 18280]
    R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [24/04/2010 01:10 209768]
    S0 nwba;nwba;c:\windows\system32\drivers\fxufjr.sys --> c:\windows\system32\drivers\fxufjr.sys [?]
    S1 ethxylvf;ethxylvf;c:\windows\system32\drivers\ethxylvf.sys [05/05/2011 22:25 135680]
    S2 AMService;AMService;c:\windows\TEMP\kixd\setup.exe run --> c:\windows\TEMP\kixd\setup.exe run [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 14:16 130384]
    S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21:37 4640000]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 11:00 14336]
    S3 WMZuneComm;Zune Windows Mobile Connectivity Service;f:\zune\WMZuneComm.exe --> f:\zune\WMZuneComm.exe [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 14:16 753504]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    WINRM   REG_MULTI_SZ      WINRM
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = *.local
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-05-10 18:20
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ... 
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ... 
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(640)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    .
    - - - - - - - > 'explorer.exe'(560)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\SearchIndexer.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\stsystra.exe
    c:\program files\OpenOffice.org 3\program\soffice.exe
    c:\program files\OpenOffice.org 3\program\soffice.bin
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
    .
    **************************************************************************
    .
    Completion time: 2011-05-10  18:23:43 - machine was rebooted
    ComboFix-quarantined-files.txt  2011-05-10 17:23
    ComboFix2.txt  2011-05-09 16:54
    .
    Pre-Run: 488,152,834,048 bytes free
    Post-Run: 488,185,438,208 bytes free
    .
    - - End Of File - - 39F9F2BE1C45ACA3A07C972651ABE405

    SuperDave

    • Malware Removal Specialist
    • Moderator


    • Genius
    • Thanked: 991
    • Certifications: List
    • Experience: Expert
    • OS: Windows 8
    Re: Can someone help me please!!
    « Reply #17 on: May 10, 2011, 12:53:37 PM »
    Ok. Just a few more things to do. Any improvement in your computer?

    Re-running ComboFix to remove infections:

    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Open notepad and copy/paste the text in the quotebox below into it:
      Quote
      KillAll::

      File::
      c:\windows\system32\drivers\ethxylvf.sys
      c:\documents and settings\Default User\Start Menu\Programs\Startup\
      ykitl.exe

      Driver::
      ethxylvf
    • Save this as CFScript.txt, in the same location as ComboFix.exe



    • Referring to the picture above, drag CFScript into ComboFix.exe
    • When finished, it shall produce a log for you at C:\ComboFix.txt
    • Please post the contents of the log in your next reply.
    ******************************************************
    Download Security Check by screen317 from one of the following links and save it to your desktop.

    Link 1
    Link 2

    * Unzip SecurityCheck.zip and a folder named Security Check should appear.
    * Open the Security Check folder and double-click Security Check.bat
    * Follow the on-screen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt
    * Post the contents of that document in your next reply.

    Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
    Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

    007will

      Topic Starter


      Beginner

      Re: Can someone help me please!!
      « Reply #18 on: May 11, 2011, 11:23:27 AM »
       Results of screen317's Security Check version 0.99.10 
       Windows XP Service Pack 3 
       Internet Explorer 8 
      ``````````````````````````````
      Antivirus/Firewall Check:

       Windows Firewall Enabled! 
       Microsoft Security Essentials   
      ```````````````````````````````
      Anti-malware/Other Utilities Check:

       Malwarebytes' Anti-Malware   
       CCleaner     
       Java(TM) 6 Update 25 
       Out of date Java installed!
       Adobe Flash Player   
      ````````````````````````````````
      Process Check: 
      objlist.exe by Laurent

       Microsoft Security Essentials msseces.exe
      ``````````End of Log````````````

      007will

        Topic Starter


        Beginner

        Re: Can someone help me please!!
        « Reply #19 on: May 11, 2011, 11:23:56 AM »
        ComboFix 11-05-10.02 - Owner 11/05/2011  18:10:05.3.2 - x86
        Microsoft Windows XP Home Edition  5.1.2600.3.1252.44.1033.18.1014.559 [GMT 1:00]
        Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
        Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
        AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
        .
        FILE ::
        "c:\documents and settings\Default User\Start Menu\Programs\Startup\"
        "c:\windows\system32\drivers\ethxylvf.sys"
        .
        .
        (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        c:\windows\system32\drivers\ethxylvf.sys
        .
        .
        (((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        -------\Service_ethxylvf
        .
        .
        (((((((((((((((((((((((((   Files Created from 2011-04-11 to 2011-05-11  )))))))))))))))))))))))))))))))
        .
        .
        2011-05-08 11:48 . 2011-05-09 16:33   --------   d-----w-   c:\documents and settings\Owner\Application Data\Ulirmo
        2011-05-05 21:22 . 2011-05-05 21:22   388096   ----a-r-   c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
        2011-05-05 21:22 . 2011-05-05 21:22   --------   d-----w-   c:\program files\Trend Micro
        2011-05-05 21:20 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Common Files\Java
        2011-05-05 20:44 . 2011-05-05 20:44   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
        2011-05-05 20:35 . 2010-12-20 17:09   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
        2011-05-05 20:35 . 2010-12-20 17:08   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
        2011-05-05 20:32 . 2011-05-05 20:32   --------   d-----w-   c:\program files\CCleaner
        2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\rpcns4H.dll
        2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\logonuiv.dll
        2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\ialmuTHAU.dll
        2011-05-05 18:41 . 2011-04-11 07:04   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C8C2A59-AC6B-4305-BF8F-AA42A1FBBBC0}\mpengine.dll
        2011-04-29 12:34 . 2011-04-29 12:34   --------   d-----w-   c:\windows\system32\wbem\Repository
        2011-04-29 12:30 . 2011-04-29 12:33   --------   d-s---w-   c:\documents and settings\Administrator
        2011-04-29 06:43 . 2011-04-29 06:43   --------   d-----w-   c:\documents and settings\Owner\Application Data\Sibelius Software
        2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\Owner\Application Data\Malwarebytes
        2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
        2011-04-28 23:18 . 2011-05-05 20:35   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
        2011-04-28 22:38 . 2011-04-28 22:38   --------   d-----w-   c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
        2011-04-28 22:38 . 2011-05-08 11:50   --------   d-----w-   c:\program files\SUPERAntiSpyware
        2011-04-25 15:51 . 2011-04-25 15:51   --------   d-----w-   c:\program files\iPod
        2011-04-25 15:51 . 2011-04-25 15:53   --------   d-----w-   c:\program files\iTunes
        2011-04-25 15:46 . 2011-04-25 15:46   --------   d-----w-   c:\program files\Bonjour
        2011-04-25 14:07 . 2011-04-25 14:07   --------   d-----r-   C:\MSOCache
        2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\documents and settings\Owner\Local Settings\Application Data\SoftGrid Client
        2011-04-25 13:59 . 2011-05-10 18:53   --------   d-----w-   c:\documents and settings\Owner\Application Data\SoftGrid Client
        2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\{90140011-0062-0409-0000-0000000FF1CE}
        2011-04-25 13:59 . 2011-05-10 18:53   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\SoftGrid Client
        2011-04-25 13:57 . 2011-04-25 13:57   --------   d-----w-   c:\documents and settings\All Users\Microsoft
        2011-04-25 13:57 . 2011-04-29 12:38   --------   d-----w-   c:\program files\Microsoft Application Virtualization Client
        2011-04-25 13:56 . 2011-04-25 14:01   --------   d-----w-   c:\documents and settings\Owner\Application Data\TP
        2011-04-18 21:13 . 2011-04-18 21:13   --------   d-----w-   c:\documents and settings\Owner\Application Data\Amazon
        2011-04-18 21:12 . 2011-04-18 21:12   --------   d-----w-   c:\program files\Amazon
        2011-04-17 14:07 . 2011-04-17 14:07   --------   d-----w-   c:\windows\Sun
        2011-04-16 14:29 . 2011-04-16 14:29   --------   d-----w-   c:\documents and settings\Owner\Application Data\OpenOffice.org
        2011-04-16 14:26 . 2011-04-16 14:26   --------   d-----w-   c:\program files\OpenOffice.org 3
        2011-04-16 14:25 . 2011-04-14 04:07   472808   ----a-w-   c:\windows\system32\deployJava1.dll
        2011-04-16 14:25 . 2011-04-14 01:40   73728   ----a-w-   c:\windows\system32\javacpl.cpl
        2011-04-16 14:25 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Java
        .
        .
        .
        ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTITL.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTEXT.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSTMP.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSPEC.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSCRP.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSREH_.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSMET_.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSCHOR.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRS____.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSTEXT.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSSE__.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSS___.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSROMC.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSPC__.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSP___.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSO___.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSNN__.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSM___.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFS__.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFBE_.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFB__.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCSC_.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCS__.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSC___.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUS____.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INKPEN2_.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2TEXT.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SPEC.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SCRI.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2METR.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2CHOR.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELST___.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSS___.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSM___.FOT
        2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSINKI.FOT
        2011-04-11 07:04 . 2011-02-06 22:20   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
        2011-04-06 15:20 . 2011-04-06 15:20   91424   ----a-w-   c:\windows\system32\dnssd.dll
        2011-04-06 15:20 . 2011-04-06 15:20   75040   ----a-w-   c:\windows\system32\jdns_sd.dll
        2011-04-06 15:20 . 2011-04-06 15:20   197920   ----a-w-   c:\windows\system32\dnssdX.dll
        2011-04-06 15:20 . 2011-04-06 15:20   107808   ----a-w-   c:\windows\system32\dns-sd.exe
        2011-03-07 05:33 . 2011-01-11 19:25   692736   ----a-w-   c:\windows\system32\inetcomm.dll
        2011-03-04 06:37 . 2004-08-04 10:00   420864   ----a-w-   c:\windows\system32\vbscript.dll
        2011-03-03 13:21 . 2004-08-04 10:00   1857920   ----a-w-   c:\windows\system32\win32k.sys
        2011-02-22 23:06 . 2006-03-04 03:33   916480   ----a-w-   c:\windows\system32\wininet.dll
        2011-02-22 23:06 . 2004-08-04 10:00   43520   ------w-   c:\windows\system32\licmgr10.dll
        2011-02-22 23:06 . 2004-08-04 10:00   1469440   ------w-   c:\windows\system32\inetcpl.cpl
        2011-02-22 11:41 . 2004-08-04 10:00   385024   ------w-   c:\windows\system32\html.iec
        2011-02-17 13:18 . 2004-08-04 10:00   455936   ----a-w-   c:\windows\system32\drivers\mrxsmb.sys
        2011-02-17 13:18 . 2004-08-04 10:00   357888   ----a-w-   c:\windows\system32\drivers\srv.sys
        2011-02-17 12:32 . 2011-01-19 20:06   5120   ----a-w-   c:\windows\system32\xpsp4res.dll
        2011-02-15 12:56 . 2004-08-04 10:00   290432   ----a-w-   c:\windows\system32\atmfd.dll
        .
        .
        (((((((((((((((((((((((((((((   [email protected]_16.53.14   )))))))))))))))))))))))))))))))))))))))))
        .
        + 2011-01-11 09:59 . 2011-01-11 09:59   51024              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_214ee422\vcomp90.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   59728              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90rus.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   42832              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90kor.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   43344              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90jpn.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   61264              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90ita.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   62800              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90fra.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   61776              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esp.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   61776              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esn.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   53584              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90enu.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   63312              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90deu.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   36688              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90cht.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   35664              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90chs.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90u.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90.dll
        + 2011-05-11 17:15 . 2011-05-11 17:15   16384              c:\windows\temp\Perflib_Perfdata_660.dat
        + 2011-01-11 09:59 . 2011-01-11 09:59   653136              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcr90.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   569680              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcp90.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   225280              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcm90.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   159048              c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_65b7a93a\atl90.dll
        + 2011-05-09 17:10 . 2011-05-09 17:10   223232              c:\windows\Installer\186080.msi
        + 2011-01-11 09:59 . 2011-01-11 09:59   3780936              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90u.dll
        + 2011-01-11 09:59 . 2011-01-11 09:59   3766088              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90.dll
        .
        (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* empty entries & legit default entries are not shown
        REGEDIT4
        .
        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
        "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-08 2424192]
        .
        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
        "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
        "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
        "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
        "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
        "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]
        "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
        "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
        "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
        .
        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
        .
        c:\documents and settings\Default User\Start Menu\Programs\Startup\
        ykitl.exe [2011-5-8 284160]
        .
        c:\documents and settings\Owner\Start Menu\Programs\Startup\
        OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
        .
        c:\documents and settings\All Users\Start Menu\Programs\Startup\
        HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
        Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
        .
        [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
        "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
        "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
        2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
        .
        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
        @="Service"
        .
        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
        @="Driver"
        .
        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
        @="Service"
        .
        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
        "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
        "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
        "c:\\Program Files\\iTunes\\iTunes.exe"=
        .
        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
        .
        R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872]
        R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656]
        R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\program files\ASTRA32\astra32.sys [22/02/2007 12:28 30864]
        R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [28/02/2010 02:33 821664]
        R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [24/04/2010 01:10 483688]
        R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [02/12/2009 22:23 554344]
        R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [02/12/2009 22:23 211432]
        R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [02/12/2009 22:23 20584]
        R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [02/12/2009 22:23 18280]
        R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [24/04/2010 01:10 209768]
        S0 nwba;nwba;c:\windows\system32\drivers\fxufjr.sys --> c:\windows\system32\drivers\fxufjr.sys [?]
        S2 AMService;AMService;c:\windows\TEMP\kixd\setup.exe run --> c:\windows\TEMP\kixd\setup.exe run [?]
        S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 14:16 130384]
        S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21:37 4640000]
        S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 11:00 14336]
        S3 WMZuneComm;Zune Windows Mobile Connectivity Service;f:\zune\WMZuneComm.exe --> f:\zune\WMZuneComm.exe [?]
        S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 14:16 753504]
        .
        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
        WINRM   REG_MULTI_SZ      WINRM
        .
        .
        ------- Supplementary Scan -------
        .
        uInternet Settings,ProxyOverride = *.local
        .
        .
        **************************************************************************
        .
        catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2011-05-11 18:16
        Windows 5.1.2600 Service Pack 3 NTFS
        .
        scanning hidden processes ... 
        .
        scanning hidden autostart entries ...
        .
        scanning hidden files ... 
        .
        scan completed successfully
        hidden files: 0
        .
        **************************************************************************
        .
        --------------------- LOCKED REGISTRY KEYS ---------------------
        .
        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
        @Denied: (A 2) (Everyone)
        @="FlashBroker"
        "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
        .
        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
        "Enabled"=dword:00000001
        .
        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
        @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
        .
        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
        @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
        .
        [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
        @Denied: (A 2) (Everyone)
        @="IFlashBroker4"
        .
        [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
        @="{00020424-0000-0000-C000-000000000046}"
        .
        [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
        @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
        "Version"="1.0"
        .
        --------------------- DLLs Loaded Under Running Processes ---------------------
        .
        - - - - - - - > 'winlogon.exe'(620)
        c:\program files\SUPERAntiSpyware\SASWINLO.DLL
        c:\windows\system32\WININET.dll
        .
        - - - - - - - > 'explorer.exe'(3248)
        c:\windows\system32\WININET.dll
        c:\windows\system32\ieframe.dll
        c:\windows\system32\webcheck.dll
        c:\windows\system32\WPDShServiceObj.dll
        c:\windows\system32\PortableDeviceTypes.dll
        c:\windows\system32\PortableDeviceApi.dll
        .
        ------------------------ Other Running Processes ------------------------
        .
        c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
        c:\program files\Bonjour\mDNSResponder.exe
        c:\program files\Java\jre6\bin\jqs.exe
        c:\windows\system32\SearchIndexer.exe
        c:\windows\system32\wscntfy.exe
        c:\windows\stsystra.exe
        c:\program files\OpenOffice.org 3\program\soffice.exe
        c:\program files\OpenOffice.org 3\program\soffice.bin
        c:\program files\iPod\bin\iPodService.exe
        c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
        .
        **************************************************************************
        .
        Completion time: 2011-05-11  18:19:13 - machine was rebooted
        ComboFix-quarantined-files.txt  2011-05-11 17:19
        ComboFix2.txt  2011-05-10 17:23
        ComboFix3.txt  2011-05-09 16:54
        .
        Pre-Run: 488,131,448,832 bytes free
        Post-Run: 488,109,334,528 bytes free
        .
        - - End Of File - - 3134006567461E2BA064FDD000367D38

        SuperDave

        • Malware Removal Specialist
        • Moderator


        • Genius
        • Thanked: 991
        • Certifications: List
        • Experience: Expert
        • OS: Windows 8
        Re: Can someone help me please!!
        « Reply #20 on: May 11, 2011, 11:57:15 AM »
        SysProt Antirootkit

        Download
        SysProt Antirootkit from the link below (you will find it at the bottom
        of the page under attachments, or you can get it from one of the
        mirrors).

        http://sites.google.com/site/sysprotantirootkit/

        Unzip it into a folder on your desktop.
        • Double click Sysprot.exe to start the program.
        • Click on the Log tab.
        • In the Write to log box select the following items.
          • Process << Selected
          • Kernel Modules << Selected
          • SSDT << Selected
          • Kernel Hooks << Selected
          • IRP Hooks << NOT Selected
          • Ports << NOT Selected
          • Hidden Files << Selected
        • At the bottom of the page
          • Hidden Objects Only << Selected
        • Click on the Create Log button on the bottom right.
        • After a few seconds a new window should appear.
        • Select Scan Root Drive. Click on the Start button.
        • When it is complete a new window will appear to indicate that the scan is finished.
        • The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.
        Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

        007will

          Topic Starter


          Beginner

          Re: Can someone help me please!!
          « Reply #21 on: May 12, 2011, 10:55:14 AM »
          SysProt AntiRootkit v1.0.1.0
          by swatkat

          ******************************************************************************************
          ******************************************************************************************

          No Hidden Processes found

          ******************************************************************************************
          ******************************************************************************************
          Kernel Modules:
          Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
          Service Name: ---
          Module Base: AA45C000
          Module End: AA474000
          Hidden: Yes

          Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
          Service Name: ---
          Module Base: F7B58000
          Module End: F7B5A000
          Hidden: Yes

          Module Name: C:\WINDOWS\system32\DRIVERS\WinUSB.sys
          Service Name: WinUSB
          Module Base: F7966000
          Module End: F796E000
          Hidden: Yes

          Module Name: C:\WINDOWS\system32\DRIVERS\wudfrd.sys
          Service Name: WudfRd
          Module Base: AA1CC000
          Module End: AA1ED000
          Hidden: Yes

          ******************************************************************************************
          ******************************************************************************************
          SSDT:
          Function Name: ZwTerminateProcess
          Address: AA567620
          Driver Base: AA55D000
          Driver End: AA57F000
          Driver Name: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

          ******************************************************************************************
          ******************************************************************************************
          No Kernel Hooks found

          ******************************************************************************************
          ******************************************************************************************
          Hidden files/folders:
          Object: C:\Qoobox\BackEnv\AppData.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Cache.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Cookies.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Desktop.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Favorites.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\History.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Music.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\NetHood.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Personal.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Pictures.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Programs.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Recent.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\SendTo.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\SetPath.bat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\StartUp.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\SysPath.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\Templates.folder.dat
          Status: Access denied

          Object: C:\Qoobox\BackEnv\VikPev00
          Status: Access denied


          SuperDave

          • Malware Removal Specialist
          • Moderator


          • Genius
          • Thanked: 991
          • Certifications: List
          • Experience: Expert
          • OS: Windows 8
          Re: Can someone help me please!!
          « Reply #22 on: May 12, 2011, 01:27:18 PM »
          Looking good. Let's try this scan.

          I'd like to scan your machine with ESET OnlineScan

          •Hold down Control and click on the following link to open ESET OnlineScan in a new window.
          ESET OnlineScan
          •Click the button.
          •For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
          • Click on to download the ESET Smart Installer. Save it to your desktop.
          • Double click on the icon on your desktop.
          •Check
          •Click the button.
          •Accept any security warnings from your browser.
          •Check
          •Push the Start button.
          •ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
          •When the scan completes, push
          •Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
          •Push the button.
          •Push
          A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
          Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender

          007will

            Topic Starter


            Beginner

            Re: Can someone help me please!!
            « Reply #23 on: May 14, 2011, 04:44:45 AM »
            C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\37\4bb6a8a5-26d0d414   Java/TrojanDownloader.OpenStream.NBV trojan
            C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\3ba0d75f-12867f1f   Java/TrojanDownloader.OpenStream.NBV trojan
            C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\6\27241306-4d955265   Java/TrojanDownloader.Agent.NCQ trojan

            SuperDave

            • Malware Removal Specialist
            • Moderator


            • Genius
            • Thanked: 991
            • Certifications: List
            • Experience: Expert
            • OS: Windows 8
            Re: Can someone help me please!!
            « Reply #24 on: May 14, 2011, 12:29:45 PM »
            Please run ESET again and this time, clean the infections. How's your computer working now? Any other issues?
            Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender


            007will

              Topic Starter


              Beginner

              Re: Can someone help me please!!
              « Reply #26 on: May 15, 2011, 03:42:24 AM »
              ComboFix 11-05-14.01 - Owner 15/05/2011  10:25:44.4.2 - x86
              Microsoft Windows XP Home Edition  5.1.2600.3.1252.44.1033.18.1014.331 [GMT 1:00]
              Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
              Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
              AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
              .
              .
              (((((((((((((((((((((((((   Files Created from 2011-04-15 to 2011-05-15  )))))))))))))))))))))))))))))))
              .
              .
              2011-05-15 09:33 . 2011-05-15 09:33   28752   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\MpKsld931e1f3.sys
              2011-05-15 09:15 . 2011-05-15 09:15   28752   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\MpKslca26fab0.sys
              2011-05-15 09:14 . 2011-04-11 07:04   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\mpengine.dll
              2011-05-15 09:06 . 2011-05-15 09:06   404640   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
              2011-05-14 10:34 . 2011-05-14 10:34   --------   d-----w-   c:\documents and settings\All Users\Application Data\VirtualizedApplications
              2011-05-14 08:29 . 2011-05-14 08:29   --------   d-----w-   c:\program files\ESET
              2011-05-08 11:48 . 2011-05-09 16:33   --------   d-----w-   c:\documents and settings\Owner\Application Data\Ulirmo
              2011-05-05 21:22 . 2011-05-05 21:22   388096   ----a-r-   c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
              2011-05-05 21:22 . 2011-05-05 21:22   --------   d-----w-   c:\program files\Trend Micro
              2011-05-05 21:20 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Common Files\Java
              2011-05-05 20:44 . 2011-05-05 20:44   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
              2011-05-05 20:35 . 2010-12-20 17:09   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
              2011-05-05 20:35 . 2010-12-20 17:08   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
              2011-05-05 20:32 . 2011-05-05 20:32   --------   d-----w-   c:\program files\CCleaner
              2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\rpcns4H.dll
              2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\logonuiv.dll
              2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\ialmuTHAU.dll
              2011-04-29 12:34 . 2011-04-29 12:34   --------   d-----w-   c:\windows\system32\wbem\Repository
              2011-04-29 12:30 . 2011-04-29 12:33   --------   d-s---w-   c:\documents and settings\Administrator
              2011-04-29 06:43 . 2011-04-29 06:43   --------   d-----w-   c:\documents and settings\Owner\Application Data\Sibelius Software
              2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\Owner\Application Data\Malwarebytes
              2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
              2011-04-28 23:18 . 2011-05-05 20:35   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
              2011-04-28 22:38 . 2011-04-28 22:38   --------   d-----w-   c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
              2011-04-28 22:38 . 2011-05-08 11:50   --------   d-----w-   c:\program files\SUPERAntiSpyware
              2011-04-25 15:51 . 2011-04-25 15:51   --------   d-----w-   c:\program files\iPod
              2011-04-25 15:51 . 2011-04-25 15:53   --------   d-----w-   c:\program files\iTunes
              2011-04-25 15:46 . 2011-04-25 15:46   --------   d-----w-   c:\program files\Bonjour
              2011-04-25 14:07 . 2011-04-25 14:07   --------   d-----r-   C:\MSOCache
              2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\documents and settings\Owner\Local Settings\Application Data\SoftGrid Client
              2011-04-25 13:59 . 2011-05-14 11:28   --------   d-----w-   c:\documents and settings\Owner\Application Data\SoftGrid Client
              2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\{90140011-0062-0409-0000-0000000FF1CE}
              2011-04-25 13:59 . 2011-05-14 11:28   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\SoftGrid Client
              2011-04-25 13:57 . 2011-04-25 13:57   --------   d-----w-   c:\documents and settings\All Users\Microsoft
              2011-04-25 13:57 . 2011-04-29 12:38   --------   d-----w-   c:\program files\Microsoft Application Virtualization Client
              2011-04-25 13:56 . 2011-04-25 14:01   --------   d-----w-   c:\documents and settings\Owner\Application Data\TP
              2011-04-18 21:13 . 2011-04-18 21:13   --------   d-----w-   c:\documents and settings\Owner\Application Data\Amazon
              2011-04-18 21:12 . 2011-04-18 21:12   --------   d-----w-   c:\program files\Amazon
              2011-04-17 14:07 . 2011-04-17 14:07   --------   d-----w-   c:\windows\Sun
              2011-04-16 14:29 . 2011-04-16 14:29   --------   d-----w-   c:\documents and settings\Owner\Application Data\OpenOffice.org
              2011-04-16 14:26 . 2011-04-16 14:26   --------   d-----w-   c:\program files\OpenOffice.org 3
              2011-04-16 14:25 . 2011-04-14 04:07   472808   ----a-w-   c:\windows\system32\deployJava1.dll
              2011-04-16 14:25 . 2011-04-14 01:40   73728   ----a-w-   c:\windows\system32\javacpl.cpl
              2011-04-16 14:25 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Java
              .
              .
              .
              ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTITL.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTEXT.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSTMP.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSPEC.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSCRP.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSREH_.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSMET_.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSCHOR.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRS____.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSTEXT.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSSE__.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSS___.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSROMC.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSPC__.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSP___.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSO___.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSNN__.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSM___.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFS__.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFBE_.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFB__.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCSC_.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCS__.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSC___.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUS____.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INKPEN2_.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2TEXT.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SPEC.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SCRI.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2METR.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2CHOR.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELST___.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSS___.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSM___.FOT
              2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSINKI.FOT
              2011-04-11 07:04 . 2011-02-06 22:20   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
              2011-04-06 15:20 . 2011-04-06 15:20   91424   ----a-w-   c:\windows\system32\dnssd.dll
              2011-04-06 15:20 . 2011-04-06 15:20   75040   ----a-w-   c:\windows\system32\jdns_sd.dll
              2011-04-06 15:20 . 2011-04-06 15:20   197920   ----a-w-   c:\windows\system32\dnssdX.dll
              2011-04-06 15:20 . 2011-04-06 15:20   107808   ----a-w-   c:\windows\system32\dns-sd.exe
              2011-03-07 05:33 . 2011-01-11 19:25   692736   ----a-w-   c:\windows\system32\inetcomm.dll
              2011-03-04 06:37 . 2004-08-04 10:00   420864   ----a-w-   c:\windows\system32\vbscript.dll
              2011-03-03 13:21 . 2004-08-04 10:00   1857920   ----a-w-   c:\windows\system32\win32k.sys
              2011-02-22 23:06 . 2006-03-04 03:33   916480   ----a-w-   c:\windows\system32\wininet.dll
              2011-02-22 23:06 . 2004-08-04 10:00   43520   ------w-   c:\windows\system32\licmgr10.dll
              2011-02-22 23:06 . 2004-08-04 10:00   1469440   ------w-   c:\windows\system32\inetcpl.cpl
              2011-02-22 11:41 . 2004-08-04 10:00   385024   ------w-   c:\windows\system32\html.iec
              2011-02-17 13:18 . 2004-08-04 10:00   455936   ----a-w-   c:\windows\system32\drivers\mrxsmb.sys
              2011-02-17 13:18 . 2004-08-04 10:00   357888   ----a-w-   c:\windows\system32\drivers\srv.sys
              2011-02-17 12:32 . 2011-01-19 20:06   5120   ----a-w-   c:\windows\system32\xpsp4res.dll
              2011-02-15 12:56 . 2004-08-04 10:00   290432   ----a-w-   c:\windows\system32\atmfd.dll
              .
              .
              (((((((((((((((((((((((((((((   [email protected]_16.53.14   )))))))))))))))))))))))))))))))))))))))))
              .
              + 2011-01-11 09:59 . 2011-01-11 09:59   51024              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_214ee422\vcomp90.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   59728              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90rus.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   42832              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90kor.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   43344              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90jpn.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   61264              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90ita.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   62800              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90fra.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   61776              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esp.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   61776              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esn.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   53584              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90enu.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   63312              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90deu.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   36688              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90cht.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   35664              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90chs.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90u.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90.dll
              + 2011-05-15 09:33 . 2011-05-15 09:33   16384              c:\windows\temp\Perflib_Perfdata_74c.dat
              + 2011-01-11 09:59 . 2011-01-11 09:59   653136              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcr90.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   569680              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcp90.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   225280              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcm90.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   159048              c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_65b7a93a\atl90.dll
              + 2011-05-15 09:06 . 2011-05-15 09:06   240288              c:\windows\system32\Macromed\Flash\FlashUtil10q_ActiveX.exe
              + 2011-05-15 09:06 . 2011-05-15 09:06   321184              c:\windows\system32\Macromed\Flash\FlashUtil10q_ActiveX.dll
              + 2011-05-09 17:10 . 2011-05-09 17:10   223232              c:\windows\Installer\186080.msi
              + 2011-01-11 09:59 . 2011-01-11 09:59   3780936              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90u.dll
              + 2011-01-11 09:59 . 2011-01-11 09:59   3766088              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90.dll
              + 2011-01-19 20:26 . 2011-05-11 17:41   42829768              c:\windows\system32\MRT.exe
              .
              (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* empty entries & legit default entries are not shown
              REGEDIT4
              .
              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
              "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-08 2424192]
              .
              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
              "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
              "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
              "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
              "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
              "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]
              "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
              "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
              "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
              .
              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
              "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
              .
              c:\documents and settings\Owner\Start Menu\Programs\Startup\
              OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
              .
              c:\documents and settings\All Users\Start Menu\Programs\Startup\
              HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
              Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
              .
              [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
              "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
              "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
              .
              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
              2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
              .
              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
              @="Service"
              .
              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
              @="Driver"
              .
              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
              @="Service"
              .
              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "%windir%\\system32\\sessmgr.exe"=
              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
              "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
              "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
              "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
              "c:\\Program Files\\iTunes\\iTunes.exe"=
              .
              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
              "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
              .
              R1 MpKslca26fab0;MpKslca26fab0;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\MpKslca26fab0.sys [15/05/2011 10:15 28752]
              R1 MpKsld931e1f3;MpKsld931e1f3;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\MpKsld931e1f3.sys [15/05/2011 10:33 28752]
              R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872]
              R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656]
              R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\program files\ASTRA32\astra32.sys [22/02/2007 12:28 30864]
              R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [28/02/2010 02:33 821664]
              R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [24/04/2010 01:10 483688]
              R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [02/12/2009 22:23 554344]
              R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [02/12/2009 22:23 211432]
              R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [02/12/2009 22:23 20584]
              R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [02/12/2009 22:23 18280]
              R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [24/04/2010 01:10 209768]
              S0 nwba;nwba;c:\windows\system32\drivers\fxufjr.sys --> c:\windows\system32\drivers\fxufjr.sys [?]
              S2 AMService;AMService;c:\windows\TEMP\kixd\setup.exe run --> c:\windows\TEMP\kixd\setup.exe run [?]
              S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 14:16 130384]
              S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21:37 4640000]
              S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 11:00 14336]
              S3 WMZuneComm;Zune Windows Mobile Connectivity Service;f:\zune\WMZuneComm.exe [11/11/2010 14:57 268528]
              S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 14:16 753504]
              .
              --- Other Services/Drivers In Memory ---
              .
              *NewlyCreated* - MPKSLD931E1F3
              .
              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
              WINRM   REG_MULTI_SZ      WINRM
              .
              Contents of the 'Scheduled Tasks' folder
              .
              2011-05-15 c:\windows\Tasks\MP Scheduled Scan.job
              - c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 12:26]
              .
              .
              ------- Supplementary Scan -------
              .
              uInternet Settings,ProxyOverride = *.local
              .
              .
              **************************************************************************
              .
              catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2011-05-15 10:35
              Windows 5.1.2600 Service Pack 3 NTFS
              .
              scanning hidden processes ... 
              .
              scanning hidden autostart entries ...
              .
              scanning hidden files ... 
              .
              scan completed successfully
              hidden files: 0
              .
              **************************************************************************
              .
              --------------------- LOCKED REGISTRY KEYS ---------------------
              .
              [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
              @Denied: (A 2) (Everyone)
              @="FlashBroker"
              "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"
              .
              [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
              "Enabled"=dword:00000001
              .
              [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
              @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"
              .
              [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
              @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
              .
              [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
              @Denied: (A 2) (Everyone)
              @="IFlashBroker4"
              .
              [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
              @="{00020424-0000-0000-C000-000000000046}"
              .
              [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
              @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
              "Version"="1.0"
              .
              --------------------- DLLs Loaded Under Running Processes ---------------------
              .
              - - - - - - - > 'winlogon.exe'(620)
              c:\program files\SUPERAntiSpyware\SASWINLO.DLL
              c:\windows\system32\WININET.dll
              .
              - - - - - - - > 'explorer.exe'(724)
              c:\windows\system32\WININET.dll
              c:\windows\system32\ieframe.dll
              c:\windows\system32\webcheck.dll
              c:\windows\system32\WPDShServiceObj.dll
              c:\windows\system32\PortableDeviceTypes.dll
              c:\windows\system32\PortableDeviceApi.dll
              .
              ------------------------ Other Running Processes ------------------------
              .
              c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
              c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
              c:\program files\Bonjour\mDNSResponder.exe
              c:\program files\Java\jre6\bin\jqs.exe
              f:\zune\ZuneBusEnum.exe
              c:\windows\system32\SearchIndexer.exe
              c:\windows\stsystra.exe
              c:\program files\OpenOffice.org 3\program\soffice.exe
              c:\program files\OpenOffice.org 3\program\soffice.bin
              c:\program files\iPod\bin\iPodService.exe
              c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
              .
              **************************************************************************
              .
              Completion time: 2011-05-15  10:38:24 - machine was rebooted
              ComboFix-quarantined-files.txt  2011-05-15 09:38
              ComboFix2.txt  2011-05-11 17:19
              ComboFix3.txt  2011-05-10 17:23
              ComboFix4.txt  2011-05-09 16:54
              .
              Pre-Run: 487,744,663,552 bytes free
              Post-Run: 487,813,476,352 bytes free
              .
              - - End Of File - - 089C36B5AA4188206B2D13BE7F2779A3

              007will

                Topic Starter


                Beginner

                Re: Can someone help me please!!
                « Reply #27 on: May 15, 2011, 03:43:51 AM »
                SORRY! READ THE WRONG PAGE. DONT WORRY ABOUT THE PREVIOUS COUPLE OF POSTS!!

                007will

                  Topic Starter


                  Beginner

                  Re: Can someone help me please!!
                  « Reply #28 on: May 15, 2011, 04:29:46 AM »
                  I've scanned again and got rid of the infections. Touch wood, everything seems to be okay at the mo i think...

                  SuperDave

                  • Malware Removal Specialist
                  • Moderator


                  • Genius
                  • Thanked: 991
                  • Certifications: List
                  • Experience: Expert
                  • OS: Windows 8
                  Re: Can someone help me please!!
                  « Reply #29 on: May 15, 2011, 12:59:16 PM »
                  That's great. Let's do some cleanup.

                  To uninstall ComboFix

                  • Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
                  • In the field, type in ComboFix /uninstall


                  (Note: Make sure there's a space between the word ComboFix and the forward-slash.)

                  • Then, press Enter, or click OK.
                  • This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
                  *******************************************************
                  Clean out your temporary internet files and temp files.

                  Download TFC by OldTimer to your desktop.

                  Double-click TFC.exe to run it.

                  Note: If you are running on Vista, right-click on the file and choose Run As Administrator

                  TFC will close all programs when run, so make sure you have saved all your work before you begin.

                  * Click the Start button to begin the cleaning process.
                  * Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
                  * Please let TFC run uninterrupted until it is finished.

                  Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
                  *******************************************************
                  Looking over your log it seems you don't have any evidence of a third party firewall.

                  Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

                  Remember only install ONE firewall

                  1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
                  2) Online Armor
                  3) Agnitum Outpost
                  4) PC Tools Firewall Plus

                  If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
                  **************************************************
                  Use the Secunia Software Inspector to check for out of date software.

                  •Click Start Now

                  •Check the box next to Enable thorough system inspection.

                  •Click Start

                  •Allow the scan to finish and scroll down to see if any updates are needed.
                  •Update anything listed.
                  .
                  ----------

                  Go to Microsoft Windows Update and get all critical updates.

                  ----------

                  I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

                  SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
                  * Using SpywareBlaster to protect your computer from Spyware and Malware
                  * If you don't know what ActiveX controls are, see here

                  Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

                  Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

                  Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
                  Safe Surfing!
                  Intel(R) Core (TM) i3-3220 CPU 3.30 GHz 8.0 Gb RAM Windows 8.1 with a dual boot to Windows XP  Home with SP3, Comodo  with Windows Firewall & Windows Defender