📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

Have I got a virus

24

Comments

  • avantra
    avantra Posts: 1,333
    Part of the Furniture 1,000 Posts Photogenic Combo Breaker
    Forumite
    Look like u picked up a Rootkit, scan your machine with Sophos Anti-Rootkit or similar tools, BTH , you better run any dodgy crap in a sand box like Boxi.
    Five exclamation marks the sure sign of an insane mind!!!!!

    Terry Pratchett.
  • barriejohn69
    barriejohn69 Posts: 887
    Part of the Furniture Combo Breaker
    Forumite
    When you mention run it through boxi, is that before I open any files I download?

    I'm still running malwarebytes and have sophos antiroot also running. I'll post the results on here tomorrow and let it run over night.

    Thanks for all of your help
    I would like to thank everyone who contributed to the Ramada/Days Inn BRG thread.
  • cit_k
    cit_k Posts: 24,812 Forumite
    In the mean time, do not enter any sites that require a password (ebay, paypal, bank, etc) - your computer is not safe for anything like that now, it could be logging your keystrokes, it could be sending passwords to someone else, it could be doing pretty much anything (it could be busy sending out spam right now for all you know).
    [greenhighlight]but it matters when the most senior politician in the land is happy to use language and examples that are simply not true.
    [/greenhighlight][redtitle]
    The impact of this is to stigmatise people on benefits,
    and we should be deeply worried about that    [/redtitle](house of lords debate, talking about Cameron)
  • avantra
    avantra Posts: 1,333
    Part of the Furniture 1,000 Posts Photogenic Combo Breaker
    Forumite
    barriejohn69 wrote: »
    When you mention run it through boxi, is that before I open any files I download?

    I'm still running malwarebytes and have sophos antiroot also running. I'll post the results on here tomorrow and let it run over night.

    Thanks for all of your help

    http://www.sandboxie.com/
    Five exclamation marks the sure sign of an insane mind!!!!!

    Terry Pratchett.
  • barriejohn69
    barriejohn69 Posts: 887
    Part of the Furniture Combo Breaker
    Forumite
    this is the log now

    Malwarebytes' Anti-Malware 1.44
    Database version: 3510
    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18865
    12/01/2010 07:46:14
    mbam-log-2010-01-12 (07-46-14).txt
    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 266093
    Time elapsed: 3 hour(s), 38 minute(s), 25 second(s)
    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0
    Memory Processes Infected:
    (No malicious items detected)
    Memory Modules Infected:
    (No malicious items detected)
    Registry Keys Infected:
    (No malicious items detected)
    Registry Values Infected:
    (No malicious items detected)
    Registry Data Items Infected:
    (No malicious items detected)
    Folders Infected:
    (No malicious items detected)
    Files Infected:
    (No malicious items detected)
    I would like to thank everyone who contributed to the Ramada/Days Inn BRG thread.
  • aliEnRIK
    aliEnRIK Posts: 17,741
    Part of the Furniture Combo Breaker
    Forumite
    There are millions of keygens with trojans in them, so youve shot yourself in the foot with this one

    Please run COMBOFIX

    Shut down your anti virus
    Follow the simple instructions it gives
    Post the COMPLETE log it creates here (Split into sections if need be)

    If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download
    :idea:
  • barriejohn69
    barriejohn69 Posts: 887
    Part of the Furniture Combo Breaker
    Forumite
    Daft question I know but how do I turn bit defender off? I've unticked the boxes etc but combofix says it is still running and gives me a warning
    I would like to thank everyone who contributed to the Ramada/Days Inn BRG thread.
  • barriejohn69
    barriejohn69 Posts: 887
    Part of the Furniture Combo Breaker
    Forumite
    I tried to turn off bitdefender, here is the log

    ComboFix 10-01-11.03 - barrie 12/01/2010 12:28:44.1.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2038.870 [GMT 0:00]
    Running from: c:\users\barrie\Desktop\ComboFix.exe
    AV: BitDefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
    FW: BitDefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
    SP: BitDefender Antispyware *enabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    * Resident AV is active
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\$recycle.bin\S-1-5-21-1226935768-1524449612-196860458-500
    c:\windows\setup.exe
    c:\windows\system32\install.exe
    c:\windows\system32\logs
    d:\progra~1\BITDEF~1\BITDEF~2\ntSVc.ocx
    .
    ((((((((((((((((((((((((( Files Created from 2009-12-12 to 2010-01-12 )))))))))))))))))))))))))))))))
    .
    2010-01-12 12:40 . 2010-01-12 12:41
    d
    w- c:\users\barrie\AppData\Local\temp
    2010-01-12 12:40 . 2010-01-12 12:40
    d
    w- c:\users\Default\AppData\Local\temp
    2010-01-11 22:45 . 2010-01-11 22:45 5115824 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2010-01-11 22:33 . 2010-01-11 22:33
    d
    w- c:\programdata\Office Genuine Advantage
    2010-01-11 22:33 . 2010-01-11 22:33
    d
    w- c:\users\barrie\Office Genuine Advantage
    2010-01-11 21:13 . 2010-01-11 21:13
    d
    w- c:\program files\ESET
    2010-01-11 21:02 . 2010-01-11 21:02 53136 ----a-w- c:\windows\system32\PxSecure.dll
    2010-01-11 21:02 . 2010-01-11 21:02 47664 ----a-w- c:\windows\system32\drivers\pxrts.sys
    2010-01-11 21:02 . 2010-01-11 21:02 30280 ----a-w- c:\windows\system32\drivers\pxscan.sys
    2010-01-11 21:02 . 2010-01-11 21:02 24496 ----a-w- c:\windows\system32\drivers\pxkbf.sys
    2010-01-11 21:02 . 2010-01-11 21:02
    d
    w- c:\program files\Prevx
    2010-01-11 21:02 . 2010-01-11 21:02
    d
    w- c:\programdata\PrevxCSI
    2010-01-11 21:01 . 2010-01-11 21:01 12800 ----a-w- c:\windows\system32\bootdelete.exe
    2010-01-11 20:46 . 2010-01-11 22:56 13896 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
    2010-01-11 20:46 . 2010-01-11 21:01
    d
    w- c:\programdata\Hitman Pro
    2010-01-11 20:46 . 2010-01-11 20:46
    d
    w- c:\program files\Hitman Pro 3.5
    2009-12-24 17:23 . 2009-12-24 17:24
    d
    w- c:\program files\Google
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-01-12 12:41 . 2008-12-24 14:37
    d
    w- c:\users\barrie\AppData\Roaming\DMCache
    2010-01-12 12:20 . 2009-01-31 15:49 81984 ----a-w- c:\windows\system32\bdod.bin
    2010-01-12 04:33 . 2009-09-14 13:39
    d
    w- c:\program files\QuickTime
    2010-01-12 04:33 . 2009-02-17 21:09
    d
    w- c:\program files\eFax Messenger 4.4
    2010-01-12 04:33 . 2007-11-21 06:11
    d
    w- c:\program files\Launch Manager
    2010-01-12 04:33 . 2007-08-13 23:56
    d
    w- c:\program files\Common Files\LightScribe
    2010-01-12 04:33 . 2009-08-20 21:24
    d
    w- c:\program files\Microsoft
    2010-01-12 04:33 . 2009-08-20 21:23
    d
    w- c:\program files\Windows Live
    2010-01-12 04:33 . 2007-11-21 06:26
    d
    w- c:\program files\Acer
    2010-01-07 16:07 . 2009-09-23 16:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-01-07 16:07 . 2009-09-23 16:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-12-24 11:25 . 2008-07-30 21:07
    d
    w- c:\program files\Lx_cats
    2009-12-10 11:46 . 2006-11-02 11:18
    d
    w- c:\program files\Windows Mail
    2009-12-10 11:11 . 2007-08-14 00:17
    d
    w- c:\programdata\Microsoft Help
    2009-12-06 09:41 . 2008-07-26 22:06
    d
    w- c:\program files\Java
    2009-12-05 19:28 . 2009-12-05 18:00
    d
    w- c:\users\barrie\AppData\Roaming\Epson
    2009-12-05 17:54 . 2009-12-05 17:54
    d
    w- c:\programdata\UDL
    2009-12-05 17:53 . 2009-12-05 17:51
    d
    w- c:\program files\Epson Software
    2009-12-05 17:53 . 2007-08-13 23:15
    d--h--w- c:\program files\InstallShield Installation Information
    2009-12-05 17:52 . 2007-08-13 23:15
    d
    w- c:\program files\Common Files\InstallShield
    2009-12-05 17:52 . 2009-12-05 17:46
    d
    w- c:\program files\epson
    2009-12-05 17:51 . 2009-12-05 17:50
    d
    w- c:\program files\ABBYY FineReader 6.0 Sprint
    2009-12-05 17:47 . 2009-12-05 17:43
    d
    w- c:\programdata\EPSON
    2009-11-22 16:11 . 2009-11-22 16:11
    d
    w- c:\programdata\TomTom
    2009-11-22 16:10 . 2009-11-22 16:10
    d
    w- c:\program files\TomTom International B.V
    2009-11-22 16:07 . 2009-11-22 16:07
    d
    w- c:\program files\TomTom DesktopSuite
    2009-11-21 06:40 . 2009-12-09 09:12 916480 ----a-w- c:\windows\system32\wininet.dll
    2009-11-21 06:34 . 2009-12-09 09:12 71680 ----a-w- c:\windows\system32\iesetup.dll
    2009-11-21 06:34 . 2009-12-09 09:12 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2009-11-21 04:59 . 2009-12-09 09:12 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-11-18 09:41 . 2009-11-18 09:41
    d
    w- c:\program files\Windows Portable Devices
    2009-11-18 09:41 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
    2009-11-18 09:40 . 2009-11-18 09:40 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
    2009-11-18 09:40 . 2009-11-18 09:40 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
    2009-11-17 10:48 . 2009-11-17 10:48 13331936 ----a-w- c:\programdata\Sage\SBD Software Updates\Installed\Accounts2009Update1.exe
    2009-11-17 10:43 . 2009-07-01 07:17
    d
    w- c:\program files\Common Files\Sage Report Designer 2007
    2009-11-17 10:43 . 2009-05-11 13:06
    d
    w- c:\program files\Common Files\Sage Line50
    2009-11-17 10:43 . 2008-09-08 17:05
    d
    w- c:\program files\Common Files\Sage SBD
    2009-11-17 10:41 . 2009-07-01 07:17
    d
    w- c:\program files\Sage
    2009-11-14 16:06 . 2009-10-30 20:35
    d
    w- c:\users\barrie\AppData\Roaming\DVD Flick
    2009-11-09 12:31 . 2009-12-10 11:09 24064 ----a-w- c:\windows\system32\nshhttp.dll
    2009-11-09 12:30 . 2009-12-10 11:09 30720 ----a-w- c:\windows\system32\httpapi.dll
    2009-11-09 10:36 . 2009-12-10 11:09 411648 ----a-w- c:\windows\system32\drivers\http.sys
    2009-11-02 17:50 . 2009-03-18 08:37 5648 ----a-w- c:\users\barrie\AppData\Local\d3d9caps.dat
    2009-10-29 21:49 . 2009-10-29 21:49 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
    2009-10-29 09:17 . 2009-11-26 08:06 2048 ----a-w- c:\windows\system32\tzres.dll
    2002-04-16 11:27 . 2002-04-16 11:27 5 --sha-w- c:\windows\System32\CdI5T.drv
    1998-03-19 23:00 . 1998-03-19 23:00 1048 --sha-w- c:\windows\System32\flfnlf.sys
    1998-03-19 23:00 . 1998-03-19 23:00 1048 --sha-w- c:\windows\System32\rlfnlf.sys
    1998-03-19 23:00 . 1998-03-19 23:00 1048 --sha-w- c:\windows\System32\TMail3FL.SYS
    1998-03-19 23:00 . 1998-03-19 23:00 1048 --sha-w- c:\windows\System32\TMailRL.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
    "eFax 4.4"="c:\program files\eFax Messenger 4.4\J2GDllCmd.exe" [2008-10-07 95744]
    "IDMan"="d:\internet download manager\IDMan.exe" [2009-05-13 2745776]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
    "TomTomHOME.exe"="d:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-11-13 247144]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
    "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-26 86016]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-26 8433664]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-26 81920]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-09 865840]
    "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
    "eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 1286144]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-09-04 4702208]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-10 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-10 154136]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-10 137752]
    "PLFSet"="c:\windows\PLFSet.dll" [2007-04-25 45056]
    "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2007-07-31 707080]
    "PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
    "GrooveMonitor"="d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "LXBTCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2007-02-22 73728]
    "BDAgent"="d:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-11-12 782336]
    "BitDefender Antiphishing Helper"="d:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-04-01 69632]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-10-03 39792]
    "WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
    "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-08-02 151552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
    "iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
    "EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-12-04 665424]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
    c:\users\barrie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    eFax 4.4.lnk - c:\program files\eFax Messenger 4.4\J2GTray.exe [2008-10-7 656896]
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-8-14 535336]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
    backup=c:\windows\pss\Acer VCM.lnk.CommonStartup
    backupExtension=.CommonStartup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
    2009-08-13 14:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
    2007-05-03 02:53 103344 ----a-w- c:\program files\Lexmark 5200 Series\ezprint.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
    2009-05-13 20:06 2745776 ----a-w- d:\internet download manager\IDMan.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2009-10-28 20:21 141600 ----a-w- d:\program files\iTunes\iTunesHelper.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxbtmon.exe]
    2007-05-03 02:50 230320 ----a-w- c:\program files\Lexmark 5200 Series\lxbtmon.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
    2010-01-07 16:07 1394000 ----a-w- d:\program files\Malwarebytes' Anti-Malware\mbam.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2009-09-05 00:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
    2007-09-04 10:39 1826816 ----a-w- c:\windows\SkyTel.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "VistaSp2"=hex(b):8f,d5,7b,0a,e2,21,ca,01
    R0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [11/01/2010 21:02 30280]
    R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [21/11/2007 06:13 13560]
    R2 BDVEDISK;BDVEDISK;d:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [06/10/2008 17:16 82696]
    R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [11/01/2010 21:02 6224896]
    R2 pxrts;pxrts;c:\windows\System32\drivers\pxrts.sys [11/01/2010 21:02 47664]
    R2 TomTomHOMEService;TomTomHOMEService;d:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
    R3 bdfm;BDFM;c:\windows\System32\drivers\bdfm.sys [18/09/2008 11:09 111112]
    R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [17/10/2008 14:01 104456]
    R3 pxkbf;pxkbf;c:\windows\System32\drivers\pxkbf.sys [11/01/2010 21:02 24496]
    R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [13/08/2007 22:49 43008]
    S2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [14/08/2007 00:54 50688]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24/12/2009 17:23 135664]
    S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [17/07/2008 12:06 118784]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [13/08/2007 22:49 179712]
    S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [30/07/2008 13:25 21504]
    S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [20/08/2009 21:26 54632]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
    S3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\System32\drivers\hitmanpro35.sys [11/01/2010 20:46 13896]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder
    2010-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 17:23]
    2010-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 17:23]
    2010-01-12 c:\windows\Tasks\User_Feed_Synchronization-{BC033A5A-C0E0-449B-A391-0209B2EE2FC8}.job
    - c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.co.uk/
    uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
    mStart Page = hxxp://en.uk.acer.yahoo.com
    uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    IE: Download all links with IDM - d:\internet download manager\IEGetAll.htm
    IE: Download FLV video content with IDM - d:\internet download manager\IEGetVL.htm
    IE: Download with IDM - d:\internet download manager\IEExt.htm
    IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
    .
    - - - - ORPHANS REMOVED - - - -
    HKCU-Run-Driver Updater - (no file)
    MSConfigStartUp-Snappy Fax - d:\program files\Snappy Fax Version 4\sf4.exe
    MSConfigStartUp-TomTomHOME - d:\program files\TomTom HOME 2\HOMERunner.exe

    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-01-12 12:41
    Windows 6.0.6002 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    LXBTCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MEMSWEEP2]
    "ImagePath"="\??\c:\windows\system32\EE36.tmp"
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
    "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
    .
    LOCKED REGISTRY KEYS
    [HKEY_USERS\S-1-5-21-1226935768-1524449612-196860458-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "scansk"=hex(0):68,0c,ae,70,d5,1c,ee,83,5a,72,05,00,21,75,ca,c5,40,e5,40,2a,92,
    88,03,b5,f7,c2,a0,e3,d9,b6,02,b4,94,38,69,64,32,15,90,0a,00,00,00,00,00,00,\
    [HKEY_USERS\S-1-5-21-1226935768-1524449612-196860458-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "scansk"=hex(0):1d,f0,21,97,ec,c4,7a,1a,1a,87,75,be,05,32,c4,e7,b9,fa,d6,ba,32,
    e8,2d,14,38,d4,b3,8a,3a,d3,54,3a,6c,36,c2,04,df,f8,ef,ac,00,00,00,00,00,00,\
    [HKEY_USERS\S-1-5-21-1226935768-1524449612-196860458-1000_Classes\CLSID\{820ae9cd-ff16-4761-b171-a8f470056816}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "Model"=dword:0000007a
    "Therad"=dword:0000001e
    "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
    1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
    [HKEY_USERS\S-1-5-21-1226935768-1524449612-196860458-1000_Classes\CLSID\{88556723-b7c9-4010-8ad8-30bc36ac3bda}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "Model"=dword:0000016a
    "Therad"=dword:0000001a
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2010-01-12 12:44:29
    ComboFix-quarantined-files.txt 2010-01-12 12:44
    Pre-Run: 10,063,474,688 bytes free
    Post-Run: 10,362,691,584 bytes free
    - - End Of File - - 23B4153A6FADA7971D9F0B71890FEF0A
    I would like to thank everyone who contributed to the Ramada/Days Inn BRG thread.
  • aliEnRIK
    aliEnRIK Posts: 17,741
    Part of the Furniture Combo Breaker
    Forumite
    Its a bit if a mess to say the least

    If you follow my advice you do so AT YOUR OWN RISK as I cant guarantee what will happen ~


    Open notepad and copy/paste the text in RED below

    File::
    c:\windows\system32\PxSecure.dll
    c:\windows\system32\drivers\pxrts.sys
    c:\windows\system32\drivers\pxscan.sys
    c:\windows\system32\drivers\pxkbf.sy
    c:\windows\system32\bootdelete.exe
    c:\windows\system32\drivers\hitmanpro35.sys
    c:\windows\system32\bdod.bin
    c:\windows\System32\CdI5T.drv
    c:\windows\System32\flfnlf.sys
    c:\windows\System32\rlfnlf.sys
    c:\windows\System32\TMail3FL.SYS
    c:\windows\System32\TMailRL.sys

    Save this as "CFScript" (FULL file will be 'CFScript.txt')

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

    CFScript.gif


    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

    Combofix should never take more that 30 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    :idea:
  • barriejohn69
    barriejohn69 Posts: 887
    Part of the Furniture Combo Breaker
    Forumite
    This is the latest log

    ComboFix 10-01-11.04 - barrie 12/01/2010 18:31:43.2.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2038.941 [GMT 0:00]
    Running from: c:\users\barrie\Desktop\ComboFix.exe
    Command switches used :: c:\users\barrie\Desktop\CFScript.txt
    AV: BitDefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
    FW: BitDefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
    SP: BitDefender Antispyware *enabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    * Resident AV is active

    FILE ::
    "c:\windows\system32\bdod.bin"
    "c:\windows\system32\bootdelete.exe"
    "c:\windows\System32\CdI5T.drv"
    "c:\windows\system32\drivers\hitmanpro35.sys"
    "c:\windows\system32\drivers\pxkbf.sy"
    "c:\windows\system32\drivers\pxrts.sys"
    "c:\windows\system32\drivers\pxscan.sys"
    "c:\windows\System32\flfnlf.sys"
    "c:\windows\system32\PxSecure.dll"
    "c:\windows\System32\rlfnlf.sys"
    "c:\windows\System32\TMail3FL.SYS"
    "c:\windows\System32\TMailRL.sys"
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\windows\system32\bdod.bin
    c:\windows\system32\bootdelete.exe
    c:\windows\System32\CdI5T.drv
    c:\windows\system32\drivers\hitmanpro35.sys
    c:\windows\system32\drivers\pxrts.sys
    c:\windows\system32\drivers\pxscan.sys
    c:\windows\System32\flfnlf.sys
    c:\windows\system32\PxSecure.dll
    c:\windows\System32\rlfnlf.sys
    c:\windows\System32\TMail3FL.SYS
    c:\windows\System32\TMailRL.sys
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Service_Apple Mobile Device
    \Legacy_hitmanpro35
    \Legacy_pxrts
    \Legacy_pxscan
    \Service_hitmanpro35
    \Service_pxrts
    \Service_pxscan

    ((((((((((((((((((((((((( Files Created from 2009-12-12 to 2010-01-12 )))))))))))))))))))))))))))))))
    .
    2010-01-12 18:44 . 2010-01-12 18:47
    d
    w- c:\users\barrie\AppData\Local\temp
    2010-01-12 18:44 . 2010-01-12 18:44
    d
    w- c:\users\Public\AppData\Local\temp
    2010-01-11 22:33 . 2010-01-11 22:33
    d
    w- c:\programdata\Office Genuine Advantage
    2010-01-11 22:33 . 2010-01-11 22:33
    d
    w- c:\users\barrie\Office Genuine Advantage
    2010-01-11 21:13 . 2010-01-11 21:13
    d
    w- c:\program files\ESET
    2010-01-11 21:02 . 2010-01-11 21:02 24496 ----a-w- c:\windows\system32\drivers\pxkbf.sys
    2010-01-11 21:02 . 2010-01-11 21:02
    d
    w- c:\program files\Prevx
    2010-01-11 21:02 . 2010-01-11 21:02
    d
    w- c:\programdata\PrevxCSI
    2010-01-11 20:46 . 2010-01-11 21:01
    d
    w- c:\programdata\Hitman Pro
    2010-01-11 20:46 . 2010-01-11 20:46
    d
    w- c:\program files\Hitman Pro 3.5
    2009-12-24 17:23 . 2009-12-24 17:24
    d
    w- c:\program files\Google
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-01-12 18:44 . 2008-12-24 14:37
    d
    w- c:\users\barrie\AppData\Roaming\DMCache
    2010-01-12 04:33 . 2009-09-14 13:39
    d
    w- c:\program files\QuickTime
    2010-01-12 04:33 . 2009-02-17 21:09
    d
    w- c:\program files\eFax Messenger 4.4
    2010-01-12 04:33 . 2007-11-21 06:11
    d
    w- c:\program files\Launch Manager
    2010-01-12 04:33 . 2007-08-13 23:56
    d
    w- c:\program files\Common Files\LightScribe
    2010-01-12 04:33 . 2009-08-20 21:24
    d
    w- c:\program files\Microsoft
    2010-01-12 04:33 . 2009-08-20 21:23
    d
    w- c:\program files\Windows Live
    2010-01-12 04:33 . 2007-11-21 06:26
    d
    w- c:\program files\Acer
    2010-01-11 22:45 . 2010-01-11 22:45 5115824 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2010-01-07 16:07 . 2009-09-23 16:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-01-07 16:07 . 2009-09-23 16:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-12-24 11:25 . 2008-07-30 21:07
    d
    w- c:\program files\Lx_cats
    2009-12-10 11:46 . 2006-11-02 11:18
    d
    w- c:\program files\Windows Mail
    2009-12-10 11:11 . 2007-08-14 00:17
    d
    w- c:\programdata\Microsoft Help
    2009-12-06 09:41 . 2008-07-26 22:06
    d
    w- c:\program files\Java
    2009-12-05 19:28 . 2009-12-05 18:00
    d
    w- c:\users\barrie\AppData\Roaming\Epson
    2009-12-05 17:54 . 2009-12-05 17:54
    d
    w- c:\programdata\UDL
    2009-12-05 17:53 . 2009-12-05 17:51
    d
    w- c:\program files\Epson Software
    2009-12-05 17:53 . 2007-08-13 23:15
    d--h--w- c:\program files\InstallShield Installation Information
    2009-12-05 17:52 . 2007-08-13 23:15
    d
    w- c:\program files\Common Files\InstallShield
    2009-12-05 17:52 . 2009-12-05 17:46
    d
    w- c:\program files\epson
    2009-12-05 17:51 . 2009-12-05 17:50
    d
    w- c:\program files\ABBYY FineReader 6.0 Sprint
    2009-12-05 17:47 . 2009-12-05 17:43
    d
    w- c:\programdata\EPSON
    2009-11-22 16:11 . 2009-11-22 16:11
    d
    w- c:\programdata\TomTom
    2009-11-22 16:10 . 2009-11-22 16:10
    d
    w- c:\program files\TomTom International B.V
    2009-11-22 16:07 . 2009-11-22 16:07
    d
    w- c:\program files\TomTom DesktopSuite
    2009-11-21 06:40 . 2009-12-09 09:12 916480 ----a-w- c:\windows\system32\wininet.dll
    2009-11-21 06:34 . 2009-12-09 09:12 71680 ----a-w- c:\windows\system32\iesetup.dll
    2009-11-21 06:34 . 2009-12-09 09:12 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2009-11-21 04:59 . 2009-12-09 09:12 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-11-18 09:41 . 2009-11-18 09:41
    d
    w- c:\program files\Windows Portable Devices
    2009-11-18 09:40 . 2009-11-18 09:40 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
    2009-11-18 09:40 . 2009-11-18 09:40 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
    2009-11-17 10:48 . 2009-11-17 10:48 13331936 ----a-w- c:\programdata\Sage\SBD Software Updates\Installed\Accounts2009Update1.exe
    2009-11-17 10:43 . 2009-07-01 07:17
    d
    w- c:\program files\Common Files\Sage Report Designer 2007
    2009-11-17 10:43 . 2009-05-11 13:06
    d
    w- c:\program files\Common Files\Sage Line50
    2009-11-17 10:43 . 2008-09-08 17:05
    d
    w- c:\program files\Common Files\Sage SBD
    2009-11-17 10:41 . 2009-07-01 07:17
    d
    w- c:\program files\Sage
    2009-11-14 16:06 . 2009-10-30 20:35
    d
    w- c:\users\barrie\AppData\Roaming\DVD Flick
    2009-11-09 12:31 . 2009-12-10 11:09 24064 ----a-w- c:\windows\system32\nshhttp.dll
    2009-11-09 12:30 . 2009-12-10 11:09 30720 ----a-w- c:\windows\system32\httpapi.dll
    2009-11-09 10:36 . 2009-12-10 11:09 411648 ----a-w- c:\windows\system32\drivers\http.sys
    2009-11-02 17:50 . 2009-03-18 08:37 5648 ----a-w- c:\users\barrie\AppData\Local\d3d9caps.dat
    2009-10-29 21:49 . 2009-10-29 21:49 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
    2009-10-29 09:17 . 2009-11-26 08:06 2048 ----a-w- c:\windows\system32\tzres.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
    "eFax 4.4"="c:\program files\eFax Messenger 4.4\J2GDllCmd.exe" [2008-10-07 95744]
    "IDMan"="d:\internet download manager\IDMan.exe" [2009-05-13 2745776]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
    "TomTomHOME.exe"="d:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-11-13 247144]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
    "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-26 86016]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-26 8433664]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-26 81920]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-09 865840]
    "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
    "eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 1286144]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-09-04 4702208]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-10 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-10 154136]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-10 137752]
    "PLFSet"="c:\windows\PLFSet.dll" [2007-04-25 45056]
    "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2007-07-31 707080]
    "PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
    "GrooveMonitor"="d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "LXBTCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2007-02-22 73728]
    "BDAgent"="d:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-11-12 782336]
    "BitDefender Antiphishing Helper"="d:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-04-01 69632]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-10-03 39792]
    "WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
    "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-08-02 151552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
    "iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
    "EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-12-04 665424]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
    c:\users\barrie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    eFax 4.4.lnk - c:\program files\eFax Messenger 4.4\J2GTray.exe [2008-10-7 656896]
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-8-14 535336]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
    backup=c:\windows\pss\Acer VCM.lnk.CommonStartup
    backupExtension=.CommonStartup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
    2009-08-13 14:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
    2007-05-03 02:53 103344 ----a-w- c:\program files\Lexmark 5200 Series\ezprint.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
    2009-05-13 20:06 2745776 ----a-w- d:\internet download manager\IDMan.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2009-10-28 20:21 141600 ----a-w- d:\program files\iTunes\iTunesHelper.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxbtmon.exe]
    2007-05-03 02:50 230320 ----a-w- c:\program files\Lexmark 5200 Series\lxbtmon.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
    2010-01-07 16:07 1394000 ----a-w- d:\program files\Malwarebytes' Anti-Malware\mbam.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2009-09-05 00:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
    2007-09-04 10:39 1826816 ----a-w- c:\windows\SkyTel.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "VistaSp2"=hex(b):8f,d5,7b,0a,e2,21,ca,01
    R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [21/11/2007 06:13 13560]
    R2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [14/08/2007 00:54 50688]
    R2 BDVEDISK;BDVEDISK;d:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [06/10/2008 17:16 82696]
    R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [11/01/2010 21:02 6224896]
    R2 TomTomHOMEService;TomTomHOMEService;d:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
    R3 bdfm;BDFM;c:\windows\System32\drivers\bdfm.sys [18/09/2008 11:09 111112]
    R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [17/10/2008 14:01 104456]
    R3 pxkbf;pxkbf;c:\windows\System32\drivers\pxkbf.sys [11/01/2010 21:02 24496]
    R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [13/08/2007 22:49 43008]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24/12/2009 17:23 135664]
    S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [17/07/2008 12:06 118784]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [13/08/2007 22:49 179712]
    S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [30/07/2008 13:25 21504]
    S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [20/08/2009 21:26 54632]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
    --- Other Services/Drivers In Memory ---
    *NewlyCreated* - HITMANPRO35
    *NewlyCreated* - PXRTS
    *NewlyCreated* - PXSCAN
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder
    2010-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 17:23]
    2010-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 17:23]
    2010-01-12 c:\windows\Tasks\User_Feed_Synchronization-{BC033A5A-C0E0-449B-A391-0209B2EE2FC8}.job
    - c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.co.uk/
    uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
    mStart Page = hxxp://en.uk.acer.yahoo.com
    uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    IE: Download all links with IDM - d:\internet download manager\IEGetAll.htm
    IE: Download FLV video content with IDM - d:\internet download manager\IEGetVL.htm
    IE: Download with IDM - d:\internet download manager\IEExt.htm
    IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-01-12 18:47
    Windows 6.0.6002 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    LXBTCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MEMSWEEP2]
    "ImagePath"="\??\c:\windows\system32\EE36.tmp"
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
    "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
    .
    LOCKED REGISTRY KEYS
    [HKEY_USERS\S-1-5-21-1226935768-1524449612-196860458-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "scansk"=hex(0):68,0c,ae,70,d5,1c,ee,83,5a,72,05,00,21,75,ca,c5,40,e5,40,2a,92,
    88,03,b5,f7,c2,a0,e3,d9,b6,02,b4,94,38,69,64,32,15,90,0a,00,00,00,00,00,00,\
    [HKEY_USERS\S-1-5-21-1226935768-1524449612-196860458-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "scansk"=hex(0):1d,f0,21,97,ec,c4,7a,1a,1a,87,75,be,05,32,c4,e7,b9,fa,d6,ba,32,
    e8,2d,14,38,d4,b3,8a,3a,d3,54,3a,6c,36,c2,04,df,f8,ef,ac,00,00,00,00,00,00,\
    [HKEY_USERS\S-1-5-21-1226935768-1524449612-196860458-1000_Classes\CLSID\{820ae9cd-ff16-4761-b171-a8f470056816}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "Model"=dword:0000007a
    "Therad"=dword:0000001e
    "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
    1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
    [HKEY_USERS\S-1-5-21-1226935768-1524449612-196860458-1000_Classes\CLSID\{88556723-b7c9-4010-8ad8-30bc36ac3bda}]
    @Denied: (Full) (Everyone)
    @Allowed: (Read) (RestrictedCode)
    "Model"=dword:0000016a
    "Therad"=dword:0000001a
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Other Running Processes
    .
    c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
    c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
    c:\acer\Empowering Technology\eNet\eNet Service.exe
    c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\windows\system32\lxbtcoms.exe
    c:\acer\Mobility Center\MobilityService.exe
    c:\program files\CyberLink\Shared Files\RichVideo.exe
    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    c:\acer\Empowering Technology\ePower\ePowerSvc.exe
    c:\windows\system32\DRIVERS\xaudio.exe
    c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
    c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\windows\servicing\TrustedInstaller.exe
    c:\windows\system32\Taskmgr.exe
    .
    **************************************************************************
    .
    Completion time: 2010-01-12 18:58:27 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-01-12 18:58
    ComboFix2.txt 2010-01-12 12:44
    Pre-Run: 10,269,421,568 bytes free
    Post-Run: 9,921,564,672 bytes free
    - - End Of File - - 2D3850A5902E483D2FBD08213AC15A5E
    I would like to thank everyone who contributed to the Ramada/Days Inn BRG thread.
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 355.9K Banking & Borrowing
  • 255K Reduce Debt & Boost Income
  • 456.2K Spending & Discounts
  • 248.4K Work, Benefits & Business
  • 606.1K Mortgages, Homes & Bills
  • 179K Life & Family
  • 263.9K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16.2K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture