Author Topic: Can someone help me please!! (Read 32028 times)

007will · « **Reply #15 on:** May 10, 2011, 11:26:42 AM »

http://virusscan.jotti.org/en-gb/scanresult/01b7612528486ee80756776c20e5be28dd792b5f

http://virusscan.jotti.org/en-gb/scanresult/fc5eb0e11068590e5fbc6d3b16b706d3f8e4a611

http://virusscan.jotti.org/en-gb/scanresult/84391c69438966404bbdce4fc504ddcf4e87473f

http://virusscan.jotti.org/en-gb/scanresult/9880348cf42936dbe2702d75b9841c5bebf7b9f7

Sorry i couldn't find the last link you listed.

007will · « **Reply #16 on:** May 10, 2011, 11:27:13 AM »

ComboFix 11-05-09.03 - Owner 10/05/2011 18:13:20.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1014.545 [GMT 1:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\bL28601CaIgA28601
c:\documents and settings\All Users\Application Data\bL28601CaIgA28601\bL28601CaIgA28601
c:\documents and settings\Owner\Application Data\xfgkxer1hbbxwfxokvojijtyebjdow3k2
.
.
((((((((((((((((((((((((( Files Created from 2011-04-10 to 2011-05-10 )))))))))))))))))))))))))))))))
.
.
2011-05-08 11:48 . 2011-05-09 16:33   --------   d-----w-   c:\documents and settings\Owner\Application Data\Ulirmo
2011-05-05 21:25 . 2011-05-05 21:25   135680   ----a-w-   c:\windows\system32\drivers\ethxylvf.sys
2011-05-05 21:22 . 2011-05-05 21:22   388096   ----a-r-   c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-05 21:22 . 2011-05-05 21:22   --------   d-----w-   c:\program files\Trend Micro
2011-05-05 21:20 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Common Files\Java
2011-05-05 20:44 . 2011-05-05 20:44   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-05-05 20:35 . 2010-12-20 17:09   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-05 20:35 . 2010-12-20 17:08   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2011-05-05 20:32 . 2011-05-05 20:32   --------   d-----w-   c:\program files\CCleaner
2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\rpcns4H.dll
2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\logonuiv.dll
2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\ialmuTHAU.dll
2011-05-05 18:41 . 2011-04-11 07:04   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C8C2A59-AC6B-4305-BF8F-AA42A1FBBBC0}\mpengine.dll
2011-04-29 12:34 . 2011-04-29 12:34   --------   d-----w-   c:\windows\system32\wbem\Repository
2011-04-29 12:30 . 2011-04-29 12:33   --------   d-s---w-   c:\documents and settings\Administrator
2011-04-29 06:43 . 2011-04-29 06:43   --------   d-----w-   c:\documents and settings\Owner\Application Data\Sibelius Software
2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\Owner\Application Data\Malwarebytes
2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2011-04-28 23:18 . 2011-05-05 20:35   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2011-04-28 22:38 . 2011-04-28 22:38   --------   d-----w-   c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2011-04-28 22:38 . 2011-05-08 11:50   --------   d-----w-   c:\program files\SUPERAntiSpyware
2011-04-25 15:51 . 2011-04-25 15:51   --------   d-----w-   c:\program files\iPod
2011-04-25 15:51 . 2011-04-25 15:53   --------   d-----w-   c:\program files\iTunes
2011-04-25 15:46 . 2011-04-25 15:46   --------   d-----w-   c:\program files\Bonjour
2011-04-25 14:07 . 2011-04-25 14:07   --------   d-----r-   C:\MSOCache
2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\documents and settings\Owner\Local Settings\Application Data\SoftGrid Client
2011-04-25 13:59 . 2011-05-09 17:10   --------   d-----w-   c:\documents and settings\Owner\Application Data\SoftGrid Client
2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\{90140011-0062-0409-0000-0000000FF1CE}
2011-04-25 13:59 . 2011-05-09 17:10   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\SoftGrid Client
2011-04-25 13:57 . 2011-04-25 13:57   --------   d-----w-   c:\documents and settings\All Users\Microsoft
2011-04-25 13:57 . 2011-04-29 12:38   --------   d-----w-   c:\program files\Microsoft Application Virtualization Client
2011-04-25 13:56 . 2011-04-25 14:01   --------   d-----w-   c:\documents and settings\Owner\Application Data\TP
2011-04-18 21:13 . 2011-04-18 21:13   --------   d-----w-   c:\documents and settings\Owner\Application Data\Amazon
2011-04-18 21:12 . 2011-04-18 21:12   --------   d-----w-   c:\program files\Amazon
2011-04-17 14:07 . 2011-04-17 14:07   --------   d-----w-   c:\windows\Sun
2011-04-16 14:29 . 2011-04-16 14:29   --------   d-----w-   c:\documents and settings\Owner\Application Data\OpenOffice.org
2011-04-16 14:26 . 2011-04-16 14:26   --------   d-----w-   c:\program files\OpenOffice.org 3
2011-04-16 14:25 . 2011-04-14 04:07   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2011-04-16 14:25 . 2011-04-14 01:40   73728   ----a-w-   c:\windows\system32\javacpl.cpl
2011-04-16 14:25 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTITL.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSTMP.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSPEC.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSCRP.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSREH_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSMET_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSCHOR.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRS____.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSTEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSSE__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSS___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSROMC.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSPC__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSP___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSO___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSNN__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSM___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFS__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFBE_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFB__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCSC_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCS__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSC___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUS____.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INKPEN2_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2TEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SPEC.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SCRI.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2METR.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2CHOR.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELST___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSS___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSM___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSINKI.FOT
2011-04-11 07:04 . 2011-02-06 22:20   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-04-06 15:20 . 2011-04-06 15:20   91424   ----a-w-   c:\windows\system32\dnssd.dll
2011-04-06 15:20 . 2011-04-06 15:20   75040   ----a-w-   c:\windows\system32\jdns_sd.dll
2011-04-06 15:20 . 2011-04-06 15:20   197920   ----a-w-   c:\windows\system32\dnssdX.dll
2011-04-06 15:20 . 2011-04-06 15:20   107808   ----a-w-   c:\windows\system32\dns-sd.exe
2011-03-07 05:33 . 2011-01-11 19:25   692736   ----a-w-   c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 10:00   420864   ----a-w-   c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-04 10:00   1857920   ----a-w-   c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2006-03-04 03:33   916480   ----a-w-   c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2004-08-04 10:00   43520   ------w-   c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2004-08-04 10:00   1469440   ------w-   c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2004-08-04 10:00   385024   ------w-   c:\windows\system32\html.iec
2011-02-17 13:18 . 2004-08-04 10:00   455936   ----a-w-   c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-08-04 10:00   357888   ----a-w-   c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2011-01-19 20:06   5120   ----a-w-   c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-08-04 10:00   290432   ----a-w-   c:\windows\system32\atmfd.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-05-09_16.53.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-01-11 09:59 . 2011-01-11 09:59   51024 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_214ee422\vcomp90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90rus.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90kor.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90jpn.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90ita.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90fra.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esp.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esn.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   53584 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90enu.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   63312 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90deu.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90cht.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   35664 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90chs.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90u.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90.dll
+ 2011-05-10 17:19 . 2011-05-10 17:19   16384 c:\windows\temp\Perflib_Perfdata_798.dat
+ 2011-01-11 09:59 . 2011-01-11 09:59   653136 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcr90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   569680 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcp90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcm90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   159048 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_65b7a93a\atl90.dll
+ 2011-05-09 17:10 . 2011-05-09 17:10   223232 c:\windows\Installer\186080.msi
+ 2011-01-11 09:59 . 2011-01-11 09:59   3780936 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90u.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   3766088 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-08 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
ykitl.exe [2011-5-8 284160]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\program files\ASTRA32\astra32.sys [22/02/2007 12:28 30864]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [28/02/2010 02:33 821664]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [24/04/2010 01:10 483688]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [02/12/2009 22:23 554344]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [02/12/2009 22:23 211432]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [02/12/2009 22:23 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [02/12/2009 22:23 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [24/04/2010 01:10 209768]
S0 nwba;nwba;c:\windows\system32\drivers\fxufjr.sys --> c:\windows\system32\drivers\fxufjr.sys [?]
S1 ethxylvf;ethxylvf;c:\windows\system32\drivers\ethxylvf.sys [05/05/2011 22:25 135680]
S2 AMService;AMService;c:\windows\TEMP\kixd\setup.exe run --> c:\windows\TEMP\kixd\setup.exe run [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 14:16 130384]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21:37 4640000]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 11:00 14336]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;f:\zune\WMZuneComm.exe --> f:\zune\WMZuneComm.exe [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 14:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM   REG_MULTI_SZ     WINRM
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-10 18:20
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(640)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(560)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\stsystra.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2011-05-10 18:23:43 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-10 17:23
ComboFix2.txt 2011-05-09 16:54
.
Pre-Run: 488,152,834,048 bytes free
Post-Run: 488,185,438,208 bytes free
.
- - End Of File - - 39F9F2BE1C45ACA3A07C972651ABE405

SuperDave · « **Reply #17 on:** May 10, 2011, 12:53:37 PM »

Ok. Just a few more things to do. Any improvement in your computer?

Re-running ComboFix to remove infections:

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the quotebox below into it:
Quote
KillAll::

File::
c:\windows\system32\drivers\ethxylvf.sys
c:\documents and settings\Default User\Start Menu\Programs\Startup\
ykitl.exe

Driver::
ethxylvf
Save this as CFScript.txt, in the same location as ComboFix.exe
Referring to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt
Please post the contents of the log in your next reply.

******************************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

007will · « **Reply #18 on:** May 11, 2011, 11:23:27 AM »

Results of screen317's Security Check version 0.99.10
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 25
Out of date Java installed!
Adobe Flash Player
````````````````````````````````
Process Check:
objlist.exe by Laurent
Microsoft Security Essentials msseces.exe
``````````End of Log````````````

007will · « **Reply #19 on:** May 11, 2011, 11:23:56 AM »

ComboFix 11-05-10.02 - Owner 11/05/2011 18:10:05.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1014.559 [GMT 1:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\documents and settings\Default User\Start Menu\Programs\Startup\"
"c:\windows\system32\drivers\ethxylvf.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\ethxylvf.sys
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_ethxylvf
.
.
((((((((((((((((((((((((( Files Created from 2011-04-11 to 2011-05-11 )))))))))))))))))))))))))))))))
.
.
2011-05-08 11:48 . 2011-05-09 16:33   --------   d-----w-   c:\documents and settings\Owner\Application Data\Ulirmo
2011-05-05 21:22 . 2011-05-05 21:22   388096   ----a-r-   c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-05 21:22 . 2011-05-05 21:22   --------   d-----w-   c:\program files\Trend Micro
2011-05-05 21:20 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Common Files\Java
2011-05-05 20:44 . 2011-05-05 20:44   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-05-05 20:35 . 2010-12-20 17:09   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-05 20:35 . 2010-12-20 17:08   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2011-05-05 20:32 . 2011-05-05 20:32   --------   d-----w-   c:\program files\CCleaner
2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\rpcns4H.dll
2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\logonuiv.dll
2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\ialmuTHAU.dll
2011-05-05 18:41 . 2011-04-11 07:04   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7C8C2A59-AC6B-4305-BF8F-AA42A1FBBBC0}\mpengine.dll
2011-04-29 12:34 . 2011-04-29 12:34   --------   d-----w-   c:\windows\system32\wbem\Repository
2011-04-29 12:30 . 2011-04-29 12:33   --------   d-s---w-   c:\documents and settings\Administrator
2011-04-29 06:43 . 2011-04-29 06:43   --------   d-----w-   c:\documents and settings\Owner\Application Data\Sibelius Software
2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\Owner\Application Data\Malwarebytes
2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2011-04-28 23:18 . 2011-05-05 20:35   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2011-04-28 22:38 . 2011-04-28 22:38   --------   d-----w-   c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2011-04-28 22:38 . 2011-05-08 11:50   --------   d-----w-   c:\program files\SUPERAntiSpyware
2011-04-25 15:51 . 2011-04-25 15:51   --------   d-----w-   c:\program files\iPod
2011-04-25 15:51 . 2011-04-25 15:53   --------   d-----w-   c:\program files\iTunes
2011-04-25 15:46 . 2011-04-25 15:46   --------   d-----w-   c:\program files\Bonjour
2011-04-25 14:07 . 2011-04-25 14:07   --------   d-----r-   C:\MSOCache
2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\documents and settings\Owner\Local Settings\Application Data\SoftGrid Client
2011-04-25 13:59 . 2011-05-10 18:53   --------   d-----w-   c:\documents and settings\Owner\Application Data\SoftGrid Client
2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\{90140011-0062-0409-0000-0000000FF1CE}
2011-04-25 13:59 . 2011-05-10 18:53   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\SoftGrid Client
2011-04-25 13:57 . 2011-04-25 13:57   --------   d-----w-   c:\documents and settings\All Users\Microsoft
2011-04-25 13:57 . 2011-04-29 12:38   --------   d-----w-   c:\program files\Microsoft Application Virtualization Client
2011-04-25 13:56 . 2011-04-25 14:01   --------   d-----w-   c:\documents and settings\Owner\Application Data\TP
2011-04-18 21:13 . 2011-04-18 21:13   --------   d-----w-   c:\documents and settings\Owner\Application Data\Amazon
2011-04-18 21:12 . 2011-04-18 21:12   --------   d-----w-   c:\program files\Amazon
2011-04-17 14:07 . 2011-04-17 14:07   --------   d-----w-   c:\windows\Sun
2011-04-16 14:29 . 2011-04-16 14:29   --------   d-----w-   c:\documents and settings\Owner\Application Data\OpenOffice.org
2011-04-16 14:26 . 2011-04-16 14:26   --------   d-----w-   c:\program files\OpenOffice.org 3
2011-04-16 14:25 . 2011-04-14 04:07   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2011-04-16 14:25 . 2011-04-14 01:40   73728   ----a-w-   c:\windows\system32\javacpl.cpl
2011-04-16 14:25 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTITL.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSTMP.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSPEC.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSCRP.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSREH_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSMET_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSCHOR.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRS____.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSTEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSSE__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSS___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSROMC.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSPC__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSP___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSO___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSNN__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSM___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFS__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFBE_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFB__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCSC_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCS__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSC___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUS____.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INKPEN2_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2TEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SPEC.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SCRI.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2METR.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2CHOR.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELST___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSS___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSM___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSINKI.FOT
2011-04-11 07:04 . 2011-02-06 22:20   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-04-06 15:20 . 2011-04-06 15:20   91424   ----a-w-   c:\windows\system32\dnssd.dll
2011-04-06 15:20 . 2011-04-06 15:20   75040   ----a-w-   c:\windows\system32\jdns_sd.dll
2011-04-06 15:20 . 2011-04-06 15:20   197920   ----a-w-   c:\windows\system32\dnssdX.dll
2011-04-06 15:20 . 2011-04-06 15:20   107808   ----a-w-   c:\windows\system32\dns-sd.exe
2011-03-07 05:33 . 2011-01-11 19:25   692736   ----a-w-   c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 10:00   420864   ----a-w-   c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-04 10:00   1857920   ----a-w-   c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2006-03-04 03:33   916480   ----a-w-   c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2004-08-04 10:00   43520   ------w-   c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2004-08-04 10:00   1469440   ------w-   c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2004-08-04 10:00   385024   ------w-   c:\windows\system32\html.iec
2011-02-17 13:18 . 2004-08-04 10:00   455936   ----a-w-   c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-08-04 10:00   357888   ----a-w-   c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2011-01-19 20:06   5120   ----a-w-   c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-08-04 10:00   290432   ----a-w-   c:\windows\system32\atmfd.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-05-09_16.53.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-01-11 09:59 . 2011-01-11 09:59   51024 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_214ee422\vcomp90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90rus.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90kor.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90jpn.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90ita.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90fra.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esp.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esn.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   53584 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90enu.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   63312 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90deu.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90cht.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   35664 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90chs.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90u.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90.dll
+ 2011-05-11 17:15 . 2011-05-11 17:15   16384 c:\windows\temp\Perflib_Perfdata_660.dat
+ 2011-01-11 09:59 . 2011-01-11 09:59   653136 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcr90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   569680 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcp90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcm90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   159048 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_65b7a93a\atl90.dll
+ 2011-05-09 17:10 . 2011-05-09 17:10   223232 c:\windows\Installer\186080.msi
+ 2011-01-11 09:59 . 2011-01-11 09:59   3780936 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90u.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   3766088 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-08 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
ykitl.exe [2011-5-8 284160]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\program files\ASTRA32\astra32.sys [22/02/2007 12:28 30864]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [28/02/2010 02:33 821664]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [24/04/2010 01:10 483688]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [02/12/2009 22:23 554344]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [02/12/2009 22:23 211432]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [02/12/2009 22:23 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [02/12/2009 22:23 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [24/04/2010 01:10 209768]
S0 nwba;nwba;c:\windows\system32\drivers\fxufjr.sys --> c:\windows\system32\drivers\fxufjr.sys [?]
S2 AMService;AMService;c:\windows\TEMP\kixd\setup.exe run --> c:\windows\TEMP\kixd\setup.exe run [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 14:16 130384]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21:37 4640000]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 11:00 14336]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;f:\zune\WMZuneComm.exe --> f:\zune\WMZuneComm.exe [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 14:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM   REG_MULTI_SZ     WINRM
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-11 18:16
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(620)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3248)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\stsystra.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2011-05-11 18:19:13 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-11 17:19
ComboFix2.txt 2011-05-10 17:23
ComboFix3.txt 2011-05-09 16:54
.
Pre-Run: 488,131,448,832 bytes free
Post-Run: 488,109,334,528 bytes free
.
- - End Of File - - 3134006567461E2BA064FDD000367D38

SuperDave · « **Reply #20 on:** May 11, 2011, 11:57:15 AM »

SysProt Antirootkit

Download
SysProt Antirootkit from the link below (you will find it at the bottom
of the page under attachments, or you can get it from one of the
mirrors).

http://sites.google.com/site/sysprotantirootkit/

Unzip it into a folder on your desktop.

Double click Sysprot.exe to start the program.
Click on the Log tab.
In the Write to log box select the following items.

Process << Selected
Kernel Modules << Selected
SSDT << Selected
Kernel Hooks << Selected
IRP Hooks << NOT Selected
Ports << NOT Selected
Hidden Files << Selected

At the bottom of the page

Hidden Objects Only << Selected

Click on the Create Log button on the bottom right.
After a few seconds a new window should appear.
Select Scan Root Drive. Click on the Start button.
When it is complete a new window will appear to indicate that the scan is finished.
The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.

007will · « **Reply #21 on:** May 12, 2011, 10:55:14 AM »

SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

No Hidden Processes found

******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
Service Name: ---
Module Base: AA45C000
Module End: AA474000
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
Service Name: ---
Module Base: F7B58000
Module End: F7B5A000
Hidden: Yes

Module Name: C:\WINDOWS\system32\DRIVERS\WinUSB.sys
Service Name: WinUSB
Module Base: F7966000
Module End: F796E000
Hidden: Yes

Module Name: C:\WINDOWS\system32\DRIVERS\wudfrd.sys
Service Name: WudfRd
Module Base: AA1CC000
Module End: AA1ED000
Hidden: Yes

******************************************************************************************
******************************************************************************************
SSDT:
Function Name: ZwTerminateProcess
Address: AA567620
Driver Base: AA55D000
Driver End: AA57F000
Driver Name: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS

******************************************************************************************
******************************************************************************************
No Kernel Hooks found

******************************************************************************************
******************************************************************************************
Hidden files/folders:
Object: C:\Qoobox\BackEnv\AppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cache.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cookies.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Desktop.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Favorites.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\History.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Music.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\NetHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Personal.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Pictures.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Programs.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Recent.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SendTo.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SetPath.bat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartUp.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SysPath.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Templates.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\VikPev00
Status: Access denied

SuperDave · « **Reply #22 on:** May 12, 2011, 01:27:18 PM »

Looking good. Let's try this scan.

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the

button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on to download the ESET Smart Installer. Save it to your desktop.
Double click on the icon on your desktop.

•Check

•Click the

button.
•Accept any security warnings from your browser.
•Check

•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push

•Push

, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the

button.
•Push

A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

007will · « **Reply #23 on:** May 14, 2011, 04:44:45 AM »

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\37\4bb6a8a5-26d0d414   Java/TrojanDownloader.OpenStream.NBV trojan
C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\31\3ba0d75f-12867f1f   Java/TrojanDownloader.OpenStream.NBV trojan
C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\6\27241306-4d955265   Java/TrojanDownloader.Agent.NCQ trojan

SuperDave · « **Reply #24 on:** May 14, 2011, 12:29:45 PM »

Please run ESET again and this time, clean the infections. How's your computer working now? Any other issues?

007will · « **Reply #25 on:** May 15, 2011, 03:18:51 AM »

The first and last file i couldn't find but here are the results for the rest.

http://virusscan.jotti.org/en-gb/scanresult/d6ffeee1d24a1531e91b17f4e2e35fe86b924006

http://virusscan.jotti.org/en-gb/scanresult/84391c69438966404bbdce4fc504ddcf4e87473f/66ee4b78e7f4dca13e54b43985109d4933be4897

http://virusscan.jotti.org/en-gb/scanresult/f1504c02d1a67e8a72aee63a14005f4f091f3c5d

007will · « **Reply #26 on:** May 15, 2011, 03:42:24 AM »

ComboFix 11-05-14.01 - Owner 15/05/2011 10:25:44.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1014.331 [GMT 1:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((( Files Created from 2011-04-15 to 2011-05-15 )))))))))))))))))))))))))))))))
.
.
2011-05-15 09:33 . 2011-05-15 09:33   28752   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\MpKsld931e1f3.sys
2011-05-15 09:15 . 2011-05-15 09:15   28752   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\MpKslca26fab0.sys
2011-05-15 09:14 . 2011-04-11 07:04   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\mpengine.dll
2011-05-15 09:06 . 2011-05-15 09:06   404640   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-14 10:34 . 2011-05-14 10:34   --------   d-----w-   c:\documents and settings\All Users\Application Data\VirtualizedApplications
2011-05-14 08:29 . 2011-05-14 08:29   --------   d-----w-   c:\program files\ESET
2011-05-08 11:48 . 2011-05-09 16:33   --------   d-----w-   c:\documents and settings\Owner\Application Data\Ulirmo
2011-05-05 21:22 . 2011-05-05 21:22   388096   ----a-r-   c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-05 21:22 . 2011-05-05 21:22   --------   d-----w-   c:\program files\Trend Micro
2011-05-05 21:20 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Common Files\Java
2011-05-05 20:44 . 2011-05-05 20:44   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-05-05 20:35 . 2010-12-20 17:09   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-05 20:35 . 2010-12-20 17:08   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2011-05-05 20:32 . 2011-05-05 20:32   --------   d-----w-   c:\program files\CCleaner
2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\rpcns4H.dll
2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\logonuiv.dll
2011-05-05 18:46 . 2011-05-05 18:46   114176   --sha-r-   c:\windows\system32\ialmuTHAU.dll
2011-04-29 12:34 . 2011-04-29 12:34   --------   d-----w-   c:\windows\system32\wbem\Repository
2011-04-29 12:30 . 2011-04-29 12:33   --------   d-s---w-   c:\documents and settings\Administrator
2011-04-29 06:43 . 2011-04-29 06:43   --------   d-----w-   c:\documents and settings\Owner\Application Data\Sibelius Software
2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\Owner\Application Data\Malwarebytes
2011-04-28 23:18 . 2011-04-28 23:18   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2011-04-28 23:18 . 2011-05-05 20:35   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2011-04-28 22:38 . 2011-04-28 22:38   --------   d-----w-   c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2011-04-28 22:38 . 2011-05-08 11:50   --------   d-----w-   c:\program files\SUPERAntiSpyware
2011-04-25 15:51 . 2011-04-25 15:51   --------   d-----w-   c:\program files\iPod
2011-04-25 15:51 . 2011-04-25 15:53   --------   d-----w-   c:\program files\iTunes
2011-04-25 15:46 . 2011-04-25 15:46   --------   d-----w-   c:\program files\Bonjour
2011-04-25 14:07 . 2011-04-25 14:07   --------   d-----r-   C:\MSOCache
2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\documents and settings\Owner\Local Settings\Application Data\SoftGrid Client
2011-04-25 13:59 . 2011-05-14 11:28   --------   d-----w-   c:\documents and settings\Owner\Application Data\SoftGrid Client
2011-04-25 13:59 . 2011-04-25 13:59   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\{90140011-0062-0409-0000-0000000FF1CE}
2011-04-25 13:59 . 2011-05-14 11:28   --------   d-----w-   c:\windows\system32\config\systemprofile\Application Data\SoftGrid Client
2011-04-25 13:57 . 2011-04-25 13:57   --------   d-----w-   c:\documents and settings\All Users\Microsoft
2011-04-25 13:57 . 2011-04-29 12:38   --------   d-----w-   c:\program files\Microsoft Application Virtualization Client
2011-04-25 13:56 . 2011-04-25 14:01   --------   d-----w-   c:\documents and settings\Owner\Application Data\TP
2011-04-18 21:13 . 2011-04-18 21:13   --------   d-----w-   c:\documents and settings\Owner\Application Data\Amazon
2011-04-18 21:12 . 2011-04-18 21:12   --------   d-----w-   c:\program files\Amazon
2011-04-17 14:07 . 2011-04-17 14:07   --------   d-----w-   c:\windows\Sun
2011-04-16 14:29 . 2011-04-16 14:29   --------   d-----w-   c:\documents and settings\Owner\Application Data\OpenOffice.org
2011-04-16 14:26 . 2011-04-16 14:26   --------   d-----w-   c:\program files\OpenOffice.org 3
2011-04-16 14:25 . 2011-04-14 04:07   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2011-04-16 14:25 . 2011-04-14 01:40   73728   ----a-w-   c:\windows\system32\javacpl.cpl
2011-04-16 14:25 . 2011-05-05 21:20   --------   d-----w-   c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTITL.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSTEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSTMP.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSPEC.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSSCRP.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSREH_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSMET_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRSCHOR.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\RPRS____.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSTEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSSE__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSS___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSROMC.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSPC__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSP___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSO___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSNN__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSM___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFS__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFBE_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSFB__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCSC_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSCS__.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUSC___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\OPUS____.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INKPEN2_.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2TEXT.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SPEC.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2SCRI.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2METR.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\INK2CHOR.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELST___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSS___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSM___.FOT
2011-04-29 06:43 . 2011-04-29 06:43   1409   ----a-w-   c:\windows\Fonts\HELSINKI.FOT
2011-04-11 07:04 . 2011-02-06 22:20   7071056   ----a-w-   c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-04-06 15:20 . 2011-04-06 15:20   91424   ----a-w-   c:\windows\system32\dnssd.dll
2011-04-06 15:20 . 2011-04-06 15:20   75040   ----a-w-   c:\windows\system32\jdns_sd.dll
2011-04-06 15:20 . 2011-04-06 15:20   197920   ----a-w-   c:\windows\system32\dnssdX.dll
2011-04-06 15:20 . 2011-04-06 15:20   107808   ----a-w-   c:\windows\system32\dns-sd.exe
2011-03-07 05:33 . 2011-01-11 19:25   692736   ----a-w-   c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2004-08-04 10:00   420864   ----a-w-   c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2004-08-04 10:00   1857920   ----a-w-   c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2006-03-04 03:33   916480   ----a-w-   c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2004-08-04 10:00   43520   ------w-   c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2004-08-04 10:00   1469440   ------w-   c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2004-08-04 10:00   385024   ------w-   c:\windows\system32\html.iec
2011-02-17 13:18 . 2004-08-04 10:00   455936   ----a-w-   c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-08-04 10:00   357888   ----a-w-   c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2011-01-19 20:06   5120   ----a-w-   c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-08-04 10:00   290432   ----a-w-   c:\windows\system32\atmfd.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-05-09_16.53.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-01-11 09:59 . 2011-01-11 09:59   51024 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_214ee422\vcomp90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90rus.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90kor.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90jpn.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90ita.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90fra.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esp.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90esn.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   53584 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90enu.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   63312 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90deu.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90cht.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   35664 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_467ea28b\mfc90chs.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90u.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfcm90.dll
+ 2011-05-15 09:33 . 2011-05-15 09:33   16384 c:\windows\temp\Perflib_Perfdata_74c.dat
+ 2011-01-11 09:59 . 2011-01-11 09:59   653136 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcr90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   569680 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcp90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_0517bbc6\msvcm90.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   159048 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_65b7a93a\atl90.dll
+ 2011-05-15 09:06 . 2011-05-15 09:06   240288 c:\windows\system32\Macromed\Flash\FlashUtil10q_ActiveX.exe
+ 2011-05-15 09:06 . 2011-05-15 09:06   321184 c:\windows\system32\Macromed\Flash\FlashUtil10q_ActiveX.dll
+ 2011-05-09 17:10 . 2011-05-09 17:10   223232 c:\windows\Installer\186080.msi
+ 2011-01-11 09:59 . 2011-01-11 09:59   3780936 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90u.dll
+ 2011-01-11 09:59 . 2011-01-11 09:59   3766088 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.5570_x-ww_d5fe2ecb\mfc90.dll
+ 2011-01-19 20:26 . 2011-05-11 17:41   42829768 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-08 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R1 MpKslca26fab0;MpKslca26fab0;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\MpKslca26fab0.sys [15/05/2011 10:15 28752]
R1 MpKsld931e1f3;MpKsld931e1f3;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A938866-38C7-452E-BE72-C0210707AC87}\MpKsld931e1f3.sys [15/05/2011 10:33 28752]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\program files\ASTRA32\astra32.sys [22/02/2007 12:28 30864]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [28/02/2010 02:33 821664]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [24/04/2010 01:10 483688]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [02/12/2009 22:23 554344]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [02/12/2009 22:23 211432]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [02/12/2009 22:23 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [02/12/2009 22:23 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [24/04/2010 01:10 209768]
S0 nwba;nwba;c:\windows\system32\drivers\fxufjr.sys --> c:\windows\system32\drivers\fxufjr.sys [?]
S2 AMService;AMService;c:\windows\TEMP\kixd\setup.exe run --> c:\windows\TEMP\kixd\setup.exe run [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 14:16 130384]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21:37 4640000]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [04/08/2004 11:00 14336]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;f:\zune\WMZuneComm.exe [11/11/2010 14:57 268528]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 14:16 753504]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSLD931E1F3
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM   REG_MULTI_SZ     WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 12:26]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-15 10:35
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(620)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(724)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
f:\zune\ZuneBusEnum.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\stsystra.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2011-05-15 10:38:24 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-15 09:38
ComboFix2.txt 2011-05-11 17:19
ComboFix3.txt 2011-05-10 17:23
ComboFix4.txt 2011-05-09 16:54
.
Pre-Run: 487,744,663,552 bytes free
Post-Run: 487,813,476,352 bytes free
.
- - End Of File - - 089C36B5AA4188206B2D13BE7F2779A3

007will · « **Reply #27 on:** May 15, 2011, 03:43:51 AM »

SORRY! READ THE WRONG PAGE. DONT WORRY ABOUT THE PREVIOUS COUPLE OF POSTS!!

007will · « **Reply #28 on:** May 15, 2011, 04:29:46 AM »

I've scanned again and got rid of the infections. Touch wood, everything seems to be okay at the mo i think...

SuperDave · « **Reply #29 on:** May 15, 2011, 12:59:16 PM »

That's great. Let's do some cleanup.

To uninstall ComboFix

Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
In the field, type in ComboFix /uninstall

(Note: Make sure there's a space between the word ComboFix and the forward-slash.)

Then, press Enter, or click OK.
This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.

*******************************************************
Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
*******************************************************
Looking over your log it seems you don't have any evidence of a third party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
**************************************************
Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!

Computer Hope Forum

News:

Author Topic: Can someone help me please!! (Read 32028 times)

007will

Re: Can someone help me please!!

007will

Re: Can someone help me please!!

SuperDave

Re: Can someone help me please!!

007will

Re: Can someone help me please!!

007will

Re: Can someone help me please!!

SuperDave

Re: Can someone help me please!!

007will

Re: Can someone help me please!!

SuperDave

Re: Can someone help me please!!

007will

Re: Can someone help me please!!

SuperDave

Re: Can someone help me please!!

007will

Re: Can someone help me please!!

007will

Re: Can someone help me please!!

007will

Re: Can someone help me please!!

007will

Re: Can someone help me please!!

SuperDave

Re: Can someone help me please!!