We'd like to remind Forumites to please avoid political debate on the Forum... Read More »
Advice on virus removal
Comments
-
That is about 10% of the log. Do I carry on?0
-
Please run COMBOFIX
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out
yes, post everything AFTER the snapshot pages as requested:idea:0 -
+ 2009-07-03 14:22 . 2008-04-14 00:11 81920 c:\windows\system32\ils.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 62976 c:\windows\system32\iesetup.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 48640 c:\windows\system32\iernonce.dll
+ 2009-07-03 14:22 . 2008-04-14 00:12 34304 c:\windows\system32\ie4uinit.exe
+ 2009-07-03 14:22 . 2008-04-14 00:11 65536 c:\windows\system32\icwphbk.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 73728 c:\windows\system32\icwdial.dll
+ 2009-07-03 14:22 . 2010-06-17 14:03 80384 c:\windows\system32\iccvid.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 11264 c:\windows\system32\icaapi.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 41984 c:\windows\system32\htui.dll
+ 2004-08-04 07:56 . 2009-10-21 05:38 25088 c:\windows\system32\httpapi.dll
+ 2004-08-04 07:56 . 2008-04-14 00:11 32285 c:\windows\system32\hsfcisp2.dll
+ 2003-03-31 12:00 . 2008-04-14 00:11 72704 c:\windows\system32\hlink.dll
- 2003-03-31 12:00 . 2006-07-21 08:30 72704 c:\windows\system32\hlink.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 20992 c:\windows\system32\hid.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 41472 c:\windows\system32\hhsetup.dll
+ 2003-03-31 12:00 . 2008-04-14 00:12 15872 c:\windows\system32\help.exe
+ 2009-07-03 14:21 . 2008-04-13 18:31 81152 c:\windows\system32\HAL.DLL
+ 2009-07-03 14:22 . 2008-04-14 00:12 39424 c:\windows\system32\grpconv.exe
+ 2004-08-04 07:56 . 2008-04-14 00:11 60416 c:\windows\system32\fwcfg.dll
+ 2009-07-03 14:21 . 2008-04-14 00:12 42496 c:\windows\system32\ftp.exe
+ 2003-03-31 12:00 . 2008-04-14 00:12 29696 c:\windows\system32\format.com
+ 2009-07-03 14:22 . 2008-04-14 00:12 20992 c:\windows\system32\fontview.exe
+ 2003-03-31 12:00 . 2009-10-15 16:28 81920 c:\windows\system32\fontsub.dll
+ 1999-10-17 18:01 . 1999-10-17 18:01 26384 c:\windows\system32\FM20ENU.DLL
+ 2004-08-04 07:56 . 2008-04-14 00:12 23040 c:\windows\system32\fltmc.exe
+ 2004-08-04 07:56 . 2008-04-14 00:11 16896 c:\windows\system32\fltlib.dll
+ 2004-08-20 22:01 . 2008-04-14 00:11 87552 c:\windows\system32\fldrclnr.dll
+ 2009-07-03 14:22 . 2008-04-14 00:12 27136 c:\windows\system32\findstr.exe
+ 2009-06-02 17:11 . 2009-06-02 17:11 98304 c:\windows\system32\ff_wmv9.dll
+ 2009-06-02 17:11 . 2009-06-02 17:11 85504 c:\windows\system32\ff_vfw.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 21504 c:\windows\system32\feclient.dll
+ 2004-08-04 07:56 . 2008-04-14 00:12 20992 c:\windows\system32\faxpatch.exe
+ 2009-07-03 14:22 . 2008-04-14 00:11 80384 c:\windows\system32\faultrep.dll
+ 2009-07-03 14:22 . 2008-04-14 00:12 24064 c:\windows\system32\extrac32.exe
+ 2004-08-04 07:56 . 2008-04-14 00:11 55808 c:\windows\system32\extmgr.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 56320 c:\windows\system32\eventlog.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 23040 c:\windows\system32\ersvc.dll
+ 2009-07-03 14:23 . 2008-04-14 00:11 20480 c:\windows\system32\encapi.dll
+ 2009-07-22 18:16 . 2008-04-14 00:11 40960 c:\windows\system32\en\mmcex.resources.dll
+ 2009-07-22 18:16 . 2008-04-14 00:11 28672 c:\windows\system32\en\microsoft.managementconsole.resources.dll
+ 2009-07-22 18:15 . 2008-04-14 00:11 33792 c:\windows\system32\eapsvc.dll
+ 2009-07-22 18:15 . 2008-04-14 00:11 59392 c:\windows\system32\eapqec.dll
+ 2009-07-22 18:15 . 2008-04-14 00:11 40960 c:\windows\system32\eappprxy.dll
+ 2009-07-22 18:15 . 2008-04-14 00:11 94208 c:\windows\system32\eappgnui.dll
+ 2009-07-22 18:15 . 2008-04-14 00:11 30720 c:\windows\system32\eapolqec.dll
+ 2009-07-03 14:22 . 2008-04-14 00:12 17920 c:\windows\system32\dvdupgrd.exe
+ 2009-07-03 14:22 . 2008-04-14 00:12 10752 c:\windows\system32\dumprep.exe
+ 2009-07-03 14:22 . 2008-04-14 00:11 19456 c:\windows\system32\dswave.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 51200 c:\windows\system32\dssec.dll
+ 2009-07-21 22:32 . 2003-06-16 14:32 49152 c:\windows\system32\DSndUp.exe
+ 2009-07-03 14:22 . 2008-04-14 00:11 92672 c:\windows\system32\dskquota.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 71680 c:\windows\system32\dsdmoprp.dll
- 2009-07-03 14:22 . 2003-03-31 12:00 16384 c:\windows\system32\ds32gt.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 16384 c:\windows\system32\ds32gt.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 14336 c:\windows\system32\drprov.dll
+ 2009-07-03 14:22 . 2008-04-14 00:11 87040 c:\windows\system32\drmstor.dll
+ 2006-09-29 03:00 . 2006-09-29 03:00 82944 c:\windows\system32\drivers\WudfRd.sys
+ 2006-09-29 02:55 . 2006-09-29 02:55 77568 c:\windows\system32\drivers\WudfPf.sys
+ 2006-10-19 04:00 . 2006-10-19 04:00 38528 c:\windows\system32\drivers\wpdusb.sys
+ 2009-07-21 21:45 . 2008-04-13 19:17 83072 c:\windows\system32\drivers\wdmaud.sys
+ 2004-08-04 05:29 . 2004-08-04 05:29 25471 c:\windows\system32\drivers\watv10nt.sys
+ 2004-08-04 05:29 . 2004-08-04 05:29 22271 c:\windows\system32\drivers\watv06nt.sys
+ 2009-07-03 14:21 . 2008-04-13 18:57 34560 c:\windows\system32\drivers\wanarp.sys
+ 2004-08-04 05:29 . 2004-08-04 05:29 11935 c:\windows\system32\drivers\wadv11nt.sys
+ 2004-08-04 05:29 . 2004-08-04 05:29 11871 c:\windows\system32\drivers\wadv09nt.sys
+ 2004-08-04 05:29 . 2004-08-04 05:29 11295 c:\windows\system32\drivers\wadv08nt.sys
+ 2004-08-04 05:29 . 2004-08-04 05:29 11807 c:\windows\system32\drivers\wadv07nt.sys
+ 2004-08-04 06:04 . 2008-04-13 18:43 14208 c:\windows\system32\drivers\wacompen.sys
+ 2009-07-03 14:21 . 2008-04-13 18:41 52352 c:\windows\system32\drivers\volsnap.sys
+ 2009-07-03 14:21 . 2008-04-13 18:44 81664 c:\windows\system32\drivers\videoprt.sys
+ 2004-08-04 06:07 . 2008-04-13 18:36 42240 c:\windows\system32\drivers\viaagp.sys
+ 2009-07-03 14:21 . 2008-04-13 18:44 20992 c:\windows\system32\drivers\vga.sys
+ 2004-08-04 07:56 . 2008-04-14 00:12 11325 c:\windows\system32\drivers\vchnt5.dll
+ 2009-07-03 14:21 . 2008-04-13 18:45 26368 c:\windows\system32\drivers\usbstor.sys
+ 2009-07-03 14:21 . 2008-04-13 18:45 17152 c:\windows\system32\drivers\usbohci.sys
+ 2009-07-03 14:21 . 2008-04-13 18:45 15872 c:\windows\system32\drivers\usbintel.sys
+ 2009-07-03 14:21 . 2008-04-13 18:45 59520 c:\windows\system32\drivers\usbhub.sys
+ 2009-07-03 14:23 . 2008-04-13 18:45 30208 c:\windows\system32\drivers\usbehci.sys
+ 2001-08-17 14:03 . 2008-04-13 18:45 25728 c:\windows\system32\drivers\usbcamd2.sys
+ 2001-08-17 14:03 . 2008-04-13 18:45 25600 c:\windows\system32\drivers\usbcamd.sys
+ 2004-08-04 06:04 . 2008-04-13 18:56 12800 c:\windows\system32\drivers\usb8023x.sys
+ 2009-07-03 14:21 . 2008-04-13 18:56 12800 c:\windows\system32\drivers\usb8023.sys
+ 2009-07-03 14:21 . 2008-04-13 18:32 66048 c:\windows\system32\drivers\udfs.sys
+ 2004-08-04 06:07 . 2008-04-13 18:36 44672 c:\windows\system32\drivers\uagp35.sys
+ 2006-08-16 09:27 . 2008-04-13 18:56 12288 c:\windows\system32\drivers\tunmp.sys
+ 2009-07-03 14:21 . 2008-04-14 00:13 40840 c:\windows\system32\drivers\termdd.sys
+ 2009-07-03 14:21 . 2008-04-14 00:13 21896 c:\windows\system32\drivers\tdtcp.sys
+ 2009-07-03 14:21 . 2008-04-14 00:13 12040 c:\windows\system32\drivers\tdpipe.sys
+ 2009-07-03 14:21 . 2008-04-13 19:00 19072 c:\windows\system32\drivers\tdi.sys
+ 2009-07-03 14:21 . 2008-04-13 18:40 14976 c:\windows\system32\drivers\tape.sys
+ 2009-07-21 21:45 . 2008-04-13 19:15 60800 c:\windows\system32\drivers\sysaudio.sys
+ 2009-07-21 21:45 . 2008-04-13 18:45 56576 c:\windows\system32\drivers\swmidi.sys
+ 2009-07-03 14:21 . 2008-04-13 18:45 49408 c:\windows\system32\drivers\stream.sys
+ 2009-09-11 11:27 . 2009-05-11 08:12 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2009-07-03 14:21 . 2008-04-13 18:36 73472 c:\windows\system32\drivers\sr.sys
+ 2009-07-03 14:21 . 2008-04-13 18:46 25344 c:\windows\system32\drivers\sonydcam.sys
+ 2004-08-04 05:41 . 2004-08-04 05:41 13240 c:\windows\system32\drivers\slwdmsup.sys
+ 2004-08-04 05:41 . 2004-08-04 05:41 95424 c:\windows\system32\drivers\slnthal.sys
+ 2004-08-04 06:07 . 2008-04-13 18:36 40960 c:\windows\system32\drivers\sisagp.sys
+ 2009-07-03 14:21 . 2008-04-13 18:40 11392 c:\windows\system32\drivers\sfloppy.sys
+ 2004-08-04 05:59 . 2008-04-13 18:40 11008 c:\windows\system32\drivers\sffp_sd.sys
+ 2009-07-22 18:16 . 2008-04-13 18:40 10240 c:\windows\system32\drivers\sffp_mmc.sys
+ 2004-08-04 05:59 . 2008-04-13 18:40 11904 c:\windows\system32\drivers\sffdisk.sys
+ 2009-07-03 14:21 . 2008-04-13 19:15 64512 c:\windows\system32\drivers\serial.sys
+ 2009-07-03 14:21 . 2008-04-13 18:40 15744 c:\windows\system32\drivers\serenum.sys
+ 2003-03-31 12:00 . 2008-04-13 16:39 20480 c:\windows\system32\drivers\secdrv.sys
+ 2004-08-04 06:07 . 2008-04-13 18:36 79232 c:\windows\system32\drivers\sdbus.sys
+ 2009-07-03 14:21 . 2008-04-13 18:40 96384 c:\windows\system32\drivers\scsiport.sys0 -
I'm guessing this is the bit we're interested in!
- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-04 39408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-11-16 2424560]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2004-07-22 88361]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-03-17 32768]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-25 339968]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-07-04 122368]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-29 185896]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-01-13 37888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"HitmanPro35"="c:\program files\Hitman Pro 3.5\HitmanPro35.exe" [2010-11-14 6387008]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [14/04/2004 07:52 5632]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [04/09/2009 21:50 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [04/09/2009 21:49 67656]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/09/2009 11:27 135336]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [02/02/2010 10:12 135664]
S3 DOSMEMIO;MEMIO;\??\d:\memio.sys --> d:\MEMIO.SYS [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [04/09/2009 21:50 12872]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - DWPROT
*NewlyCreated* - SASDIFSV
*Deregistered* - Dwsh00006609
*Deregistered* - wg3n
*Deregistered* - wg4n
*Deregistered* - wg5n
*Deregistered* - wg6n
.
Contents of the 'Scheduled Tasks' folder
2010-11-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
2010-11-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 10:12]
2010-11-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 10:12]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.guardian.co.uk/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\johnny\Application Data\Mozilla\Firefox\Profiles\b2vgctu6.default\
FF - prefs.js: browser.startup.homepage - hxxp://vshare.toolbarhome.com/?hp=df
FF - prefs.js: keyword.URL - hxxp://www.google.com/#sclient=psy&hl=en&q=
FF - plugin: c:\documents and settings\johnny\Application Data\Mozilla\Firefox\Profiles\b2vgctu6.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\documents and settings\johnny\Application Data\Mozilla\Firefox\Profiles\b2vgctu6.default\extensions\support@ancestry.com\plugins\npImgCtl.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-19 13:00
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
- - - - - - - > 'winlogon.exe'(612)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
- - - - - - - > 'explorer.exe'(3252)
c:\program files\Google\Quick Search Box\bin\1.2.1151.245\qsb.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-11-19 13:03:04
ComboFix-quarantined-files.txt 2010-11-19 13:03
ComboFix2.txt 2009-07-16 04:12
ComboFix3.txt 2009-07-14 17:20
ComboFix4.txt 2009-07-14 17:12
ComboFix5.txt 2010-11-19 12:52
Pre-Run: 18,138,050,560 bytes free
Post-Run: 18,190,237,696 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
- - End Of File - - 9B0C9BFD6457BB5F5381D1DFC3F8E8810 -
You have a firefox plugin called 'veetle'
It seems this may have a trojan attached to it
Id recommend removing it
anyways -
Open notepad and copy/paste the text in RED below
File::
c:\windows\system32\iFPSP.dll
c:\windows\system32\drivers\N10.SYS
c:\windows\system32\drivers\ifpusb.sys
c:\windows\system32\drivers\Ifp900.sys
c:\windows\system32\drivers\Ifp800.sys
c:\windows\system32\drivers\Ifp700.sys
c:\windows\system32\drivers\Ifp500.sys
c:\windows\system32\drivers\ifp300.sys
c:\windows\system32\drivers\Ifp1000.sys
Save this as "CFScript" (FULL file will be 'CFScript.txt' EXACTLY as shown)
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply
(If SNAPSHOT is stupidly large, leave that part out)
Combofix should never take more that 30 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
......................................................
reboot and run a fresh hijack log:idea:0 -
ComboFix 10-11-17.02 - johnny 19/11/2010 18:14:03.6.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.703.325 [GMT 0:00]
Running from: c:\documents and settings\johnny\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\johnny\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((( Files Created from 2010-10-19 to 2010-11-19 )))))))))))))))))))))))))))))))
.
2010-11-19 11:13 . 2010-11-19 11:13 388096 ----a-r- c:\documents and settings\johnny\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-11-19 11:13 . 2010-11-19 11:13
d
w- c:\program files\Trend Micro
2010-11-15 09:45 . 2010-11-15 09:45
d
w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-11-14 15:54 . 2010-11-14 15:55
d
w- c:\program files\Veetle
2010-11-14 13:10 . 2010-11-17 14:48 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-11-14 13:10 . 2010-11-14 13:10
d
w- c:\program files\Hitman Pro 3.5
2010-11-14 13:09 . 2010-11-14 13:09
d
w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-11-13 15:47 . 2010-04-29 15:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-13 15:47 . 2010-11-13 15:47
d
w- c:\program files\Malwarebytes' Anti-Malware
2010-11-13 15:47 . 2010-04-29 15:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-12 10:22 . 2010-09-15 04:50 472808 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2010-11-12 10:22 . 2010-09-15 04:50 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-01 09:47 . 2010-11-01 09:47
d
w- c:\program files\Common Files\Adobe
2010-10-30 15:05 . 2008-12-13 19:01 77824 ----a-w- c:\windows\system32\xvid.ax
2010-10-30 15:05 . 2010-10-30 15:05
d
w- c:\program files\Xvid
2010-10-30 09:18 . 2010-10-30 09:18
d
w- c:\documents and settings\All Users\Application Data\McAfee
2010-10-30 09:18 . 2010-10-30 15:10
d
w- c:\program files\McAfee Security Scan
2010-10-28 12:01 . 2004-06-27 15:45 278528 ----a-w- c:\windows\system32\iFPSP.dll
2010-10-28 12:01 . 2004-03-29 16:28 14531 ----a-w- c:\windows\system32\drivers\N10.SYS
2010-10-28 12:01 . 2004-03-29 16:28 14531 ----a-w- c:\windows\system32\drivers\ifpusb.sys
2010-10-28 12:01 . 2004-03-29 16:28 14531 ----a-w- c:\windows\system32\drivers\Ifp900.sys
2010-10-28 12:01 . 2004-03-29 16:28 14531 ----a-w- c:\windows\system32\drivers\Ifp800.sys
2010-10-28 12:01 . 2004-03-29 16:28 14531 ----a-w- c:\windows\system32\drivers\Ifp700.sys
2010-10-28 12:01 . 2004-03-29 16:28 14531 ----a-w- c:\windows\system32\drivers\Ifp500.sys
2010-10-28 12:01 . 2004-03-29 16:28 14531 ----a-w- c:\windows\system32\drivers\ifp300.sys
2010-10-28 12:01 . 2004-03-29 16:28 14531 ----a-w- c:\windows\system32\drivers\Ifp1000.sys
2010-10-28 12:01 . 2010-10-28 12:01
d
w- c:\program files\iriver
2010-10-28 12:00 . 2003-02-27 15:12 696320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2010-10-28 12:00 . 2002-12-05 13:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2010-10-28 12:00 . 2002-12-02 14:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2010-10-28 12:00 . 2002-12-02 12:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2010-10-28 12:00 . 2002-12-02 12:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2010-10-28 12:00 . 2010-10-28 12:00 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2010-10-28 12:00 . 2010-10-28 12:00 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-04 17:01 . 2009-09-11 11:27 126856 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-11-04 17:01 . 2009-09-11 11:27 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-09-18 11:23 . 2009-07-03 14:22 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2009-07-03 14:22 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2003-03-31 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2003-03-31 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-15 02:29 . 2009-07-14 11:49 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-09 14:16 . 2006-06-23 18:33 667136 ----a-w- c:\windows\system32\wininet.dll
2010-09-09 14:16 . 2009-07-03 14:21 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-09-09 14:16 . 2004-08-04 07:56 81920
w- c:\windows\system32\ieencode.dll
2010-09-08 16:49 . 2004-08-04 05:59 369664
w- c:\windows\system32\html.iec
2010-09-08 11:17 . 2010-09-08 11:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 11:17 . 2010-09-08 11:17 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-09-01 11:51 . 2009-07-03 14:22 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2009-07-03 14:21 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2005-10-17 21:29 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2009-07-03 14:21 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2009-07-03 14:21 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-07-22 17:39 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2009-07-03 14:21 617472 ----a-w- c:\windows\system32\comctl32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-04 39408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-11-16 2424560]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2004-07-22 88361]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-03-17 32768]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-25 339968]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-07-04 122368]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-29 185896]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-01-13 37888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"HitmanPro35"="c:\program files\Hitman Pro 3.5\HitmanPro35.exe" [2010-11-14 6387008]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [14/04/2004 07:52 5632]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [04/09/2009 21:50 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [04/09/2009 21:49 67656]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/09/2009 11:27 135336]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [02/02/2010 10:12 135664]
S3 DOSMEMIO;MEMIO;\??\d:\memio.sys --> d:\MEMIO.SYS [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [04/09/2009 21:50 12872]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - DWPROT
*NewlyCreated* - SASDIFSV
*Deregistered* - Dwsh00006609
*Deregistered* - wg3n
*Deregistered* - wg4n
*Deregistered* - wg5n
*Deregistered* - wg6n
.
Contents of the 'Scheduled Tasks' folder
2010-11-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
2010-11-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 10:12]
2010-11-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 10:12]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.guardian.co.uk/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\johnny\Application Data\Mozilla\Firefox\Profiles\b2vgctu6.default\
FF - prefs.js: browser.startup.homepage - hxxp://vshare.toolbarhome.com/?hp=df
FF - prefs.js: keyword.URL - hxxp://www.google.com/#sclient=psy&hl=en&q=
FF - plugin: c:\documents and settings\johnny\Application Data\Mozilla\Firefox\Profiles\b2vgctu6.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\documents and settings\johnny\Application Data\Mozilla\Firefox\Profiles\b2vgctu6.default\extensions\support@ancestry.com\plugins\npImgCtl.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-19 18:19
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
- - - - - - - > 'winlogon.exe'(612)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
- - - - - - - > 'explorer.exe'(1612)
c:\program files\Google\Quick Search Box\bin\1.2.1151.245\qsb.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-11-19 18:25:12
ComboFix-quarantined-files.txt 2010-11-19 18:25
ComboFix2.txt 2010-11-19 13:03
ComboFix3.txt 2009-07-16 04:12
ComboFix4.txt 2009-07-14 17:20
ComboFix5.txt 2010-11-19 18:11
Pre-Run: 18,196,205,568 bytes free
Post-Run: 18,190,684,160 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
- - End Of File - - 9EA66E982C047FB579070174F3A776100 -
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:35:05, on 19/11/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.guardian.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HitmanPro35] "C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe" /scan:boot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Windows Network Data Management System Service] "C:\DOCUME~1\johnny\LOCALS~1\Temp\058.exe" *
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} (Java Plug-in 1.6.0_15) -
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 7162 bytes0 -
For some reason the scripts not worked
Open malwarebytes, goto MORE TOOLS and run tool and force remove the files using the tool:idea:0
This discussion has been closed.
Confirm your email address to Create Threads and Reply
Categories
- All Categories
- 350.1K Banking & Borrowing
- 252.8K Reduce Debt & Boost Income
- 453.1K Spending & Discounts
- 243K Work, Benefits & Business
- 597.4K Mortgages, Homes & Bills
- 176.5K Life & Family
- 256K Travel & Transport
- 1.5M Hobbies & Leisure
- 16.1K Discuss & Feedback
- 37.6K Read-Only Boards