We’d like to remind Forumites to please avoid political debate on the Forum.

This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

Trojan zlob

townman
townman Posts: 41 Forumite
in Techie Stuff
Just done a malwarebytes scan and found a trojan zlob,but i don't seem able to delete it.
Can anyone help please,here the malware bytes log and hijack this log.
thanks.Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5884
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
26/02/2011 18:53:44
mbam-log-2011-02-26 (18-53-44).txt
Scan type: Quick scan
Objects scanned: 165595
Time elapsed: 8 minute(s), 21 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\documents and settings\brian\my documents\my videos\my video.url (Trojan.Zlob) -> Delete on reboot.



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:04:26, on 26/02/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17095)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Real\RealPlayer\update\realsched.exe
C:\WINDOWS\ZSSnp211.exe
C:\WINDOWS\Domino.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thegingerbreads.co.uk/forum
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: vShare Plugin - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\IPS\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: vShare Plugin - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\coIEPlg.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia\vidalia.exe"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
O4 - HKCU\..\Run: [AshSnap] C:\Program Files\Ashampoo\Ashampoo Snap 4\ashsnap.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: vsharechrome - {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Program Files\vShare\vshare_toolbar.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
--
End of file - 9550 bytes
Snootchie Bootchies!

Comments

  • closed
    closed Posts: 10,886 Forumite
    edited 26 February 2011 at 8:31PM
    Did you reboot? full scan is better than quick

    http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/

    http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN&ln=en_US

    http://download.cnet.com/Avast-Free-Antivirus/3000-2239_4-10019223.html?part=dl-85737&subj=dl&!!!!!button

    lot of clutter on there

    https://forums.moneysavingexpert.com/discussion/2436849
    !!
    > . !!!! ----> .
  • townman
    townman Posts: 41 Forumite
    yes I did reboot,but have not done a full scan yet.
    Snootchie Bootchies!
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Please run COMBOFIX
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Shut down your anti virus
    Follow the simple instructions it gives
    Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out

    If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download
    (If no log comes up or you lose it, COMBOFIX.TXT can be found in C drive)
    :idea:
  • townman
    townman Posts: 41 Forumite
    This is the combofix log

    ComboFix 11-02-26.01 - Brian 27/02/2011 7:49.1.4 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2614 [GMT 0:00]
    Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe
    AV: Norton Internet Security *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
    FW: Norton Internet Security *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Service_Parameters
    \Service_Security

    ((((((((((((((((((((((((( Files Created from 2011-01-27 to 2011-02-27 )))))))))))))))))))))))))))))))
    .
    2011-02-27 07:42 . 2011-02-27 07:42 7168 ----a-w- c:\windows\system32\drivers\ute4mtyw.sys
    2011-02-26 20:40 . 2009-10-22 12:54 37392 ----a-w- c:\windows\system32\drivers\30821532.sys
    2011-02-26 20:40 . 2009-10-09 22:31 315408 ----a-w- c:\windows\system32\drivers\3082153.sys
    2011-02-26 20:40 . 2009-09-25 16:59 128016 ----a-w- c:\windows\system32\drivers\30821531.sys
    2011-02-26 19:03 . 2011-02-26 19:03 388096 ----a-r- c:\documents and settings\Brian\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-02-26 19:03 . 2011-02-26 19:03
    d
    w- c:\program files\Trend Micro
    2011-02-26 17:55 . 2011-02-26 17:55
    d
    w- c:\program files\Enigma Software Group
    2011-02-22 17:31 . 2011-02-22 17:31
    d
    w- c:\program files\Common Files\Java
    2011-02-22 17:30 . 2011-02-22 17:30
    d
    w- c:\documents and settings\All Users\Application Data\McAfee
    2011-02-18 21:37 . 2011-02-18 21:37
    d
    w- c:\documents and settings\Brian\Local Settings\Application Data\Symantec
    2011-02-18 21:37 . 2011-02-18 21:37
    d
    w- c:\documents and settings\Brian\Application Data\Tific
    2011-02-02 20:05 . 2011-02-02 20:05
    d
    w- c:\program files\Xvid
    2011-02-02 20:05 . 2008-12-13 20:01 77824 ----a-w- c:\windows\system32\xvid.ax
    2011-02-02 20:05 . 2008-12-04 21:46 180224 ----a-w- c:\windows\system32\xvidvfw.dll
    2011-02-02 20:05 . 2008-12-04 21:42 815104 ----a-w- c:\windows\system32\xvidcore.dll
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-02-02 21:40 . 2010-12-01 07:57 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-02-02 19:19 . 2010-12-01 07:57 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-01-21 14:44 . 2008-04-14 04:42 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-10 09:48 . 2006-07-11 18:35 348160 ----a-w- c:\windows\system32\msvcr71.dll
    2011-01-10 09:48 . 2005-07-21 20:23 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2011-01-07 14:09 . 2008-04-14 04:39 290048 ----a-w- c:\windows\system32\atmfd.dll
    2010-12-31 13:10 . 2008-04-14 00:00 1854976 ----a-w- c:\windows\system32\win32k.sys
    2010-12-22 12:34 . 2008-04-14 04:41 301568 ----a-w- c:\windows\system32\kerberos.dll
    2010-12-20 23:08 . 2008-04-14 04:42 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
    2010-12-20 23:08 . 2008-04-14 04:42 832512 ----a-w- c:\windows\system32\wininet.dll
    2010-12-20 23:08 . 2008-04-14 04:41 78336 ----a-w- c:\windows\system32\ieencode.dll
    2010-12-20 23:08 . 2008-04-14 04:41 17408 ----a-w- c:\windows\system32\corpol.dll
    2010-12-20 18:09 . 2010-11-27 21:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-20 18:08 . 2010-11-27 21:33 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-20 17:26 . 2008-04-14 04:41 730112 ----a-w- c:\windows\system32\lsasrv.dll
    2010-12-20 12:55 . 2008-04-13 23:07 389120 ----a-w- c:\windows\system32\html.iec
    2010-12-09 15:15 . 2008-04-14 04:41 718336 ----a-w- c:\windows\system32\ntdll.dll
    2010-12-09 14:30 . 2008-04-14 04:41 33280 ----a-w- c:\windows\system32\csrsrv.dll
    2010-12-09 13:42 . 2008-04-13 23:54 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
    2010-12-09 13:07 . 2008-04-14 00:01 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2010-12-03 00:05 . 2010-12-03 00:05 46448 ----a-w- c:\windows\apppatch\AppPatch64\EMET64.dll
    2010-12-03 00:05 . 2010-12-03 00:05 43888 ----a-w- c:\windows\apppatch\EMET.dll
    2010-12-01 05:24 . 2011-01-06 23:25 368248 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symtdi.sys
    2010-12-01 05:24 . 2011-01-06 23:25 295032 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symnets.sys
    2010-12-01 05:23 . 2011-01-06 23:25 330360 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symtdiv.sys
    .
    Sigcheck
    [-] 2008-04-13 23:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . . . c:\windows\system32\drivers\atapi.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Vidalia"="c:\program files\Vidalia\vidalia.exe" [2010-09-01 6300049]
    "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-08-24 247144]
    "NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-12-20 697856]
    "AshSnap"="c:\program files\Ashampoo\Ashampoo Snap 4\ashsnap.exe" [2010-12-06 1522000]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
    "RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-26 13508608]
    "nwiz"="nwiz.exe" [2008-01-26 1626112]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-01-26 86016]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
    "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
    "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
    "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
    "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-08-09 221184]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
    "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
    "Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2009-09-17 153608]
    "REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
    "TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-01-10 274608]
    "ZSSnp211"="c:\windows\ZSSnp211.exe" [2007-04-06 57344]
    "Domino"="c:\windows\Domino.exe" [2006-08-18 49152]
    "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]
    "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728]
    c:\documents and settings\Brian\Start Menu\Programs\Startup\
    setup_9.0.0.722_26.02.2011_22-19[1].lnk - c:\documents and settings\Brian\Desktop\Virus Removal Tool\setup_9.0.0.722_26.02.2011_22-19[1]\startup.exe [2011-2-26 72208]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-12-5 303104]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\F1 2010\\F1_2010_game.exe"=
    R0 30821532;30821532 Boot Guard Driver;c:\windows\system32\drivers\30821532.sys [26/02/2011 20:40 37392]
    R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [22/11/2010 16:52 160640]
    R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [22/11/2010 16:52 5248]
    R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1205000.07D\symds.sys [06/01/2011 23:25 340016]
    R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1205000.07D\symefa.sys [06/01/2011 23:25 652336]
    R1 30821531;30821531;c:\windows\system32\drivers\30821531.sys [26/02/2011 20:40 128016]
    R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110114.001\BHDrvx86.sys [19/01/2011 01:59 691248]
    R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1205000.07D\ironx86.sys [06/01/2011 23:25 136312]
    R2 LF30FS;LF30FS;c:\program files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys [19/11/2004 18:07 101488]
    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [27/11/2010 21:33 363344]
    R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.5.0.125\ccsvchst.exe [06/01/2011 23:25 130000]
    R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/08/2010 09:38 92008]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [05/12/2010 15:42 102448]
    R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110225.001\IDSXpx86.sys [26/02/2011 01:29 341944]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27/11/2010 21:33 20952]
    S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [03/01/2011 12:56 137600]
    S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [03/01/2011 12:56 8576]
    S3 ute4mtyw;AVZ Kernel Driver;c:\windows\system32\drivers\ute4mtyw.sys [27/02/2011 07:42 7168]
    .
    Contents of the 'Scheduled Tasks' folder
    2011-02-27 c:\windows\Tasks\Norton AntiVirus - Brian - Full System Scan.job
    - c:\program files\Norton Internet Security\Engine\18.5.0.125\navw32.exe [2011-01-06 06:57]
    2011-02-27 c:\windows\Tasks\Norton Internet Security - Brian - Full System Scan.job
    - c:\program files\Norton Internet Security\Engine\18.5.0.125\navw32.exe [2011-01-06 06:57]
    2011-02-27 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 15:07]
    2011-02-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1957994488-1004336348-1801674531-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    2011-02-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1957994488-1004336348-1801674531-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.thegingerbreads.co.uk/forum
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
    FF - ProfilePath - c:\documents and settings\Brian\Application Data\Mozilla\Firefox\Profiles\kp1htmrg.default\
    FF - prefs.js: browser.startup.homepage - www.google.co.uk
    FF - prefs.js: network.proxy.type - 0
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
    FF - Ext: vShare: [EMAIL="vshare@toolbar"]vshare@toolbar[/EMAIL] - %profile%\extensions\vshare@toolbar
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
    FF - Ext: TVU Web Player: [EMAIL="firefox@tvunetworks.com"]firefox@tvunetworks.com[/EMAIL] - %profile%\extensions\firefox@tvunetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn
    FF - Ext: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn
    FF - Ext: Java Quick Starter: [EMAIL="jqs@sun.com"]jqs@sun.com[/EMAIL] - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: PC Sync 2 Synchronisation Extension: [EMAIL="bkmrksync@nokia.com"]bkmrksync@nokia.com[/EMAIL] - c:\program files\Nokia\Nokia PC Suite 7\bkmrksync
    FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    .
    - - - - ORPHANS REMOVED - - - -
    HKLM-Run-LFAgent - (no file)

    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-27 08:03
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NIS]
    "ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
    .
    LOCKED REGISTRY KEYS
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'explorer.exe'(3208)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
    c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
    c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
    c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Other Running Processes
    .
    c:\windows\system32\bgsvcgen.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\nvsvc32.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\RTHDCPL.EXE
    c:\windows\system32\RUNDLL32.EXE
    c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
    c:\program files\Brother\ControlCenter3\brccMCtl.exe
    c:\program files\Brother\Brmfcmon\BrMfcmon.exe
    c:\program files\PC Connectivity Solution\ServiceLayer.exe
    c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
    c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe
    c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
    c:\program files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
    .
    **************************************************************************
    .
    Completion time: 2011-02-27 08:17:05 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-02-27 08:16
    Pre-Run: 105,884,139,520 bytes free
    Post-Run: 106,804,436,992 bytes free
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
    - - End Of File - - EEB89179C6C678F1E8E7E710740E6FE4
    Snootchie Bootchies!
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    UPDATE and run a FULL scan with malwarebytes. Remove anything that it finds

    Post THAT log, goto LOGS and find and post the previous log and the original log that removed everything (if theyre not one and the same)

    ................................................


    Open notepad and copy/paste the text in RED below

    File::
    c:\windows\system32\drivers\ute4mtyw.sys
    c:\windows\system32\drivers\30821532.sys
    c:\windows\system32\drivers\3082153.sys
    c:\windows\system32\drivers\30821531.sys


    Save this as "CFScript" (FULL file will be 'CFScript.txt' EXACTLY as shown)

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

    CFScript.gif


    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply
    (If SNAPSHOT is stupidly large, leave that part out)

    Combofix should never take more that 30 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    :idea:
  • townman
    townman Posts: 41 Forumite
    sorry about the delay alienrik the malwarebytes scan took ages.

    this is the 1st malwarebytes log,
    Scan type: Quick scan
    Objects scanned: 166889
    Time elapsed: 10 minute(s), 23 second(s)
    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1
    Memory Processes Infected:
    (No malicious items detected)
    Memory Modules Infected:
    (No malicious items detected)
    Registry Keys Infected:
    (No malicious items detected)
    Registry Values Infected:
    (No malicious items detected)
    Registry Data Items Infected:
    (No malicious items detected)
    Folders Infected:
    (No malicious items detected)
    Files Infected:
    c:\documents and settings\brian\my documents\my videos\my video.url (Trojan.Zlob) -> Delete on reboot.

    This is the 2nd log, (the Trojan Zlob did not delete on reboot)
    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org
    Database version: 5884
    Windows 5.1.2600 Service Pack 3
    Internet Explorer 7.0.5730.13
    26/02/2011 18:53:44
    mbam-log-2011-02-26 (18-53-44).txt
    Scan type: Quick scan
    Objects scanned: 165595
    Time elapsed: 8 minute(s), 21 second(s)
    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1
    Memory Processes Infected:
    (No malicious items detected)
    Memory Modules Infected:
    (No malicious items detected)
    Registry Keys Infected:
    (No malicious items detected)
    Registry Values Infected:
    (No malicious items detected)
    Registry Data Items Infected:
    (No malicious items detected)
    Folders Infected:
    (No malicious items detected)
    Files Infected:
    c:\documents and settings\brian\my documents\my videos\my video.url (Trojan.Zlob) -> Delete on reboot.

    did not delete on reboot

    This is the last malwarebytes log,
    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org
    Database version: 5891
    Windows 5.1.2600 Service Pack 3
    Internet Explorer 7.0.5730.13
    27/02/2011 11:53:16
    mbam-log-2011-02-27 (11-53-16).txt
    Scan type: Full scan (C:\|)
    Objects scanned: 262509
    Time elapsed: 1 hour(s), 49 minute(s), 58 second(s)
    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 4
    Memory Processes Infected:
    (No malicious items detected)
    Memory Modules Infected:
    (No malicious items detected)
    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlueSquare Poker (PUP.Casino) -> Quarantined and deleted successfully.
    Registry Values Infected:
    (No malicious items detected)
    Registry Data Items Infected:
    (No malicious items detected)
    Folders Infected:
    (No malicious items detected)
    Files Infected:
    c:\documents and settings\Brian\my documents\downloads\malwarebytes.anti-malware.v1.46.multilingual.winall.incl.keygen-crd\keygen\mayday.exe (Dont.Steal.Our.Software.A) -> Quarantined and deleted successfully.
    c:\documents and settings\brian\my documents\my videos\various\quicktime pro keygen.exe (RiskWare.Tool.CK) -> Delete on reboot.
    c:\Poker\bluesquare poker\_setuppoker_5025[1].exe (PUP.Casino) -> Quarantined and deleted successfully.
    c:\documents and settings\brian\my documents\my videos\my video.url (Trojan.Zlob) -> Delete on reboot.

    Did not delete on reboot

    this is the last combofix log

    ComboFix 11-02-26.01 - Brian 27/02/2011 12:04:01.3.4 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2694 [GMT 0:00]
    Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Brian\Desktop\CFScript.txt
    AV: Norton Internet Security *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
    FW: Norton Internet Security *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
    FILE ::
    "c:\windows\system32\drivers\3082153.sys"
    "c:\windows\system32\drivers\30821531.sys"
    "c:\windows\system32\drivers\30821532.sys"
    "c:\windows\system32\drivers\ute4mtyw.sys"
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\windows\system32\drivers\ute4mtyw.sys
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Legacy_ute4mtyw
    \Service_ute4mtyw

    ((((((((((((((((((((((((( Files Created from 2011-01-27 to 2011-02-27 )))))))))))))))))))))))))))))))
    .
    2011-02-27 09:22 . 2011-02-27 09:22
    d
    w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
    2011-02-26 19:03 . 2011-02-26 19:03 388096 ----a-r- c:\documents and settings\Brian\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-02-26 19:03 . 2011-02-26 19:03
    d
    w- c:\program files\Trend Micro
    2011-02-26 17:55 . 2011-02-26 17:55
    d
    w- c:\program files\Enigma Software Group
    2011-02-22 17:31 . 2011-02-22 17:31
    d
    w- c:\program files\Common Files\Java
    2011-02-22 17:30 . 2011-02-22 17:30
    d
    w- c:\documents and settings\All Users\Application Data\McAfee
    2011-02-18 21:37 . 2011-02-18 21:37
    d
    w- c:\documents and settings\Brian\Local Settings\Application Data\Symantec
    2011-02-18 21:37 . 2011-02-18 21:37
    d
    w- c:\documents and settings\Brian\Application Data\Tific
    2011-02-02 20:05 . 2011-02-02 20:05
    d
    w- c:\program files\Xvid
    2011-02-02 20:05 . 2008-12-13 20:01 77824 ----a-w- c:\windows\system32\xvid.ax
    2011-02-02 20:05 . 2008-12-04 21:46 180224 ----a-w- c:\windows\system32\xvidvfw.dll
    2011-02-02 20:05 . 2008-12-04 21:42 815104 ----a-w- c:\windows\system32\xvidcore.dll
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-02-02 21:40 . 2010-12-01 07:57 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-02-02 19:19 . 2010-12-01 07:57 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-01-21 14:44 . 2008-04-14 04:42 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-10 09:48 . 2006-07-11 18:35 348160 ----a-w- c:\windows\system32\msvcr71.dll
    2011-01-10 09:48 . 2005-07-21 20:23 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2011-01-07 14:09 . 2008-04-14 04:39 290048 ----a-w- c:\windows\system32\atmfd.dll
    2010-12-31 13:10 . 2008-04-14 00:00 1854976 ----a-w- c:\windows\system32\win32k.sys
    2010-12-22 12:34 . 2008-04-14 04:41 301568 ----a-w- c:\windows\system32\kerberos.dll
    2010-12-20 23:08 . 2008-04-14 04:42 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
    2010-12-20 23:08 . 2008-04-14 04:42 832512 ----a-w- c:\windows\system32\wininet.dll
    2010-12-20 23:08 . 2008-04-14 04:41 78336 ----a-w- c:\windows\system32\ieencode.dll
    2010-12-20 23:08 . 2008-04-14 04:41 17408 ----a-w- c:\windows\system32\corpol.dll
    2010-12-20 18:09 . 2010-11-27 21:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-20 18:08 . 2010-11-27 21:33 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-20 17:26 . 2008-04-14 04:41 730112 ----a-w- c:\windows\system32\lsasrv.dll
    2010-12-20 12:55 . 2008-04-13 23:07 389120 ----a-w- c:\windows\system32\html.iec
    2010-12-09 15:15 . 2008-04-14 04:41 718336 ----a-w- c:\windows\system32\ntdll.dll
    2010-12-09 14:30 . 2008-04-14 04:41 33280 ----a-w- c:\windows\system32\csrsrv.dll
    2010-12-09 13:42 . 2008-04-13 23:54 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
    2010-12-09 13:07 . 2008-04-14 00:01 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2010-12-03 00:05 . 2010-12-03 00:05 46448 ----a-w- c:\windows\apppatch\AppPatch64\EMET64.dll
    2010-12-03 00:05 . 2010-12-03 00:05 43888 ----a-w- c:\windows\apppatch\EMET.dll
    2010-12-01 05:24 . 2011-01-06 23:25 368248 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symtdi.sys
    2010-12-01 05:24 . 2011-01-06 23:25 295032 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symnets.sys
    2010-12-01 05:23 . 2011-01-06 23:25 330360 ----a-w- c:\windows\system32\drivers\NIS\1205000.07D\symtdiv.sys
    .
    Sigcheck
    [-] 2008-04-13 23:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . . . c:\windows\system32\drivers\atapi.sys
    .
    ((((((((((((((((((((((((((((( [EMAIL="SnapShot@2011-02-27_08.05.21"]SnapShot@2011-02-27_08.05.21[/EMAIL] )))))))))))))))))))))))))))))))))))))))))
    .
    + 2011-02-27 12:01 . 2011-02-27 12:01 16384 c:\windows\Temp\Perflib_Perfdata_67c.dat
    + 2011-02-27 12:13 . 2011-02-27 12:13 16384 c:\windows\Temp\Perflib_Perfdata_678.dat
    + 2011-02-27 12:12 . 2011-02-27 12:12 16384 c:\windows\Temp\Perflib_Perfdata_408.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Vidalia"="c:\program files\Vidalia\vidalia.exe" [2010-09-01 6300049]
    "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-08-24 247144]
    "NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2010-12-20 697856]
    "AshSnap"="c:\program files\Ashampoo\Ashampoo Snap 4\ashsnap.exe" [2010-12-06 1522000]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
    "RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-26 13508608]
    "nwiz"="nwiz.exe" [2008-01-26 1626112]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-01-26 86016]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
    "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
    "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
    "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
    "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
    "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-08-09 221184]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
    "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
    "Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2009-09-17 153608]
    "REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
    "TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-01-10 274608]
    "ZSSnp211"="c:\windows\ZSSnp211.exe" [2007-04-06 57344]
    "Domino"="c:\windows\Domino.exe" [2006-08-18 49152]
    "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]
    "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-12-5 303104]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\F1 2010\\F1_2010_game.exe"=
    R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [22/11/2010 16:52 160640]
    R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [22/11/2010 16:52 5248]
    R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1205000.07D\symds.sys [06/01/2011 23:25 340016]
    R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1205000.07D\symefa.sys [06/01/2011 23:25 652336]
    R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110114.001\BHDrvx86.sys [19/01/2011 01:59 691248]
    R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1205000.07D\ironx86.sys [06/01/2011 23:25 136312]
    R2 LF30FS;LF30FS;c:\program files\Everstrike Software\Lock Folder XP 3.6\LF30XP.sys [19/11/2004 18:07 101488]
    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [27/11/2010 21:33 363344]
    R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.5.0.125\ccsvchst.exe [06/01/2011 23:25 130000]
    R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [24/08/2010 09:38 92008]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [05/12/2010 15:42 102448]
    R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110225.001\IDSXpx86.sys [26/02/2011 01:29 341944]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [27/11/2010 21:33 20952]
    S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [03/01/2011 12:56 137600]
    S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [03/01/2011 12:56 8576]
    .
    Contents of the 'Scheduled Tasks' folder
    2011-02-27 c:\windows\Tasks\Norton AntiVirus - Brian - Full System Scan.job
    - c:\program files\Norton Internet Security\Engine\18.5.0.125\navw32.exe [2011-01-06 06:57]
    2011-02-27 c:\windows\Tasks\Norton Internet Security - Brian - Full System Scan.job
    - c:\program files\Norton Internet Security\Engine\18.5.0.125\navw32.exe [2011-01-06 06:57]
    2011-02-27 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1957994488-1004336348-1801674531-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    2011-02-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1957994488-1004336348-1801674531-1003.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.thegingerbreads.co.uk/forum
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
    FF - ProfilePath - c:\documents and settings\Brian\Application Data\Mozilla\Firefox\Profiles\kp1htmrg.default\
    FF - prefs.js: browser.startup.homepage - www.google.co.uk
    FF - prefs.js: network.proxy.type - 0
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
    FF - Ext: vShare: [EMAIL="vshare@toolbar"]vshare@toolbar[/EMAIL] - %profile%\extensions\vshare@toolbar
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
    FF - Ext: TVU Web Player: [EMAIL="firefox@tvunetworks.com"]firefox@tvunetworks.com[/EMAIL] - %profile%\extensions\firefox@tvunetworks.com
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn
    FF - Ext: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn
    FF - Ext: Java Quick Starter: [EMAIL="jqs@sun.com"]jqs@sun.com[/EMAIL] - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: PC Sync 2 Synchronisation Extension: [EMAIL="bkmrksync@nokia.com"]bkmrksync@nokia.com[/EMAIL] - c:\program files\Nokia\Nokia PC Suite 7\bkmrksync
    FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension
    FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-27 12:12
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NIS]
    "ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
    .
    LOCKED REGISTRY KEYS
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'explorer.exe'(2640)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
    c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
    c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
    c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Other Running Processes
    .
    c:\windows\system32\bgsvcgen.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\nvsvc32.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\RTHDCPL.EXE
    c:\windows\system32\RUNDLL32.EXE
    c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
    c:\program files\Brother\ControlCenter3\brccMCtl.exe
    c:\program files\Brother\Brmfcmon\BrMfcmon.exe
    c:\program files\PC Connectivity Solution\ServiceLayer.exe
    c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
    c:\program files\PC Connectivity Solution\Transports\NclIrSrv.exe
    c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
    c:\program files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
    .
    **************************************************************************
    .
    Completion time: 2011-02-27 12:16:10 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-02-27 12:16
    ComboFix2.txt 2011-02-27 09:27
    ComboFix3.txt 2011-02-27 08:17
    Pre-Run: 106,977,927,168 bytes free
    Post-Run: 106,966,994,944 bytes free
    - - End Of File - - 20521C33E5AA08D00560EAE117C44919

    Thanks.
    Snootchie Bootchies!
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Looks clean to me :)
    :idea:
  • townman
    townman Posts: 41 Forumite
    Thanks for all your help aliEnRIK
    Snootchie Bootchies!
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    No worries

    Happy computing
    :idea:
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 351.7K Banking & Borrowing
  • 253.4K Reduce Debt & Boost Income
  • 454K Spending & Discounts
  • 244.7K Work, Benefits & Business
  • 600.1K Mortgages, Homes & Bills
  • 177.3K Life & Family
  • 258.4K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16.2K Discuss & Feedback
  • 37.6K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture