Hijack this log

aliEnRIK

Please run COMBOFIX
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out

If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download
(If no log comes up or you lose it, COMBOFIX.TXT can be found in C drive)

saffysue

Thanks here it is :

ComboFix 11-03-03.01 - vonny 03/03/2011 20:15:19.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1919.1466 [GMT 1:00]
Running from: c:\documents and settings\vonny\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Drivers\wvxdij.sys

.
((((((((((((((((((((((((( Files Created from 2011-02-03 to 2011-03-03 )))))))))))))))))))))))))))))))
.

2011-03-03 19:34 . 2011-03-03 19:34

---

d

---

w- c:\program files\CCleaner
2011-03-03 17:45 . 2011-02-23 14:56 301528 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-03-03 17:45 . 2011-02-23 14:54 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-03-03 17:45 . 2011-02-23 14:56 371544 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-03-03 17:45 . 2011-02-23 14:55 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-03-03 17:45 . 2011-02-23 14:55 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-03-03 17:45 . 2011-02-23 14:55 102232 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-03-03 17:45 . 2011-02-23 14:55 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-03-03 17:45 . 2011-02-23 14:54 30680 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-03-03 17:45 . 2011-02-23 15:04 40648 ----a-w- c:\windows\avastSS.scr
2011-03-03 17:45 . 2011-02-23 15:04 190016 ----a-w- c:\windows\system32\aswBoot.exe
2011-03-03 17:45 . 2011-03-03 17:45

---

d

---

w- c:\program files\AVAST Software
2011-03-03 17:45 . 2011-03-03 17:45

---

d

---

w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-03-03 16:23 . 2011-03-03 16:23 388096 ----a-r- c:\documents and settings\vonny\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-03-03 16:23 . 2011-03-03 16:23

---

d

---

w- c:\program files\Trend Micro
2011-03-03 12:52 . 2011-03-03 12:52

---

d

---

w- c:\program files\Common Files\Java
2011-03-03 12:51 . 2011-03-03 12:51

---

d

---

w- c:\documents and settings\All Users\Application Data\McAfee
2011-02-26 12:51 . 2011-02-26 12:51

---

d

---

w- c:\program files\SSC Service Utility
2011-02-21 19:51 . 2011-02-21 19:51

---

d

---

w- c:\documents and settings\vonny\Local Settings\Application Data\Mozilla
2011-02-21 18:51 . 2001-08-17 13:56 252032 -c--a-w- c:\windows\system32\dllcache\sis300iv.dll
2011-02-21 18:51 . 2001-08-17 13:56 252032 ----a-w- c:\windows\system32\sis300iv.dll
2011-02-21 18:51 . 2001-08-17 11:50 101760 -c--a-w- c:\windows\system32\dllcache\sis300ip.sys
2011-02-21 18:51 . 2001-08-17 11:50 101760 ----a-w- c:\windows\system32\drivers\sis300ip.sys
2011-02-21 18:00 . 2011-02-21 18:00

---

d

---

w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2011-02-21 17:33 . 2011-02-21 17:33

---

d

---

w- c:\documents and settings\vonny\Application Data\DriverCure
2011-02-21 17:33 . 2011-02-21 17:33

---

d

---

w- c:\documents and settings\vonny\Application Data\ParetoLogic
2011-02-21 17:33 . 2011-02-21 18:44

---

d

---

w- c:\documents and settings\All Users\Application Data\ParetoLogic
2011-02-21 16:21 . 2011-02-21 16:21

---

d

---

w- c:\windows\system32\wbem\Repository
2011-02-21 16:21 . 2011-02-21 16:21

---

d

---

w- c:\documents and settings\All Users\Application Data\NOS
2011-02-21 16:21 . 2011-02-21 16:21

---

d

---

w- c:\program files\NOS
2011-02-21 15:40 . 2011-02-21 15:40

---

d

---

w- c:\windows\SIS
2011-02-21 15:40 . 2011-02-21 18:21 65536 ----a-w- c:\windows\system32\sis760.bin
2011-02-21 15:40 . 2011-02-21 18:21 65536 ----a-w- c:\windows\system32\sis741.bin
2011-02-21 15:40 . 2011-02-21 18:21 49152 ----a-w- c:\windows\system32\sis660.bin
2011-02-21 15:40 . 2007-06-25 08:53 3526144 ----a-w- c:\windows\system32\sisgrv(2).dll
2011-02-21 15:40 . 2011-02-21 15:40

---

d

---

w- c:\program files\SiS VGA Utilities V3.81
2011-02-21 13:15 . 2011-02-21 13:15

---

d

---

w- c:\documents and settings\All Users\Application Data\Driver Boost
2011-02-21 13:14 . 2011-02-21 13:14

---

d

---

w- c:\program files\DriverBoost
2011-02-19 16:47 . 2011-02-19 16:47

---

d

---

w- c:\documents and settings\vonny\IECompatCache
2011-02-19 12:26 . 2011-02-20 07:49

---

d

---

w- c:\documents and settings\vonny\Application Data\ElevatedDiagnostics

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-21 18:21 . 2007-08-03 15:35 3976192 ----a-w- c:\windows\system32\sisgl770.dll
2011-02-21 18:21 . 2007-08-03 15:31 18688 ----a-w- c:\windows\system32\drivers\srvkp.sys
2011-02-21 18:21 . 2007-08-03 15:14 3527168 ----a-w- c:\windows\system32\sisgrv.dll
2011-02-21 18:21 . 2007-08-03 15:10 321536 ----a-w- c:\windows\system32\drivers\sisgrp.sys
2011-02-21 18:21 . 2007-08-03 15:07 9728 ----a-w- c:\windows\system32\SiSPIns2.dll
2011-02-21 18:21 . 2007-08-03 15:05 172032 ----a-w- c:\windows\system32\SiSInst.dll
2011-02-21 18:21 . 2007-08-03 15:05 258048 ----a-w- c:\windows\system32\SiSParse.dll
2011-02-21 18:21 . 2007-08-03 15:05 49152 ----a-w- c:\windows\system32\SiSBase.dll
2011-02-02 20:40 . 2010-09-19 12:03 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-02 18:19 . 2010-09-19 12:03 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-01-28 14:38 . 2010-10-10 10:13 15880 ----a-w- c:\windows\system32\lsdelete.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 15:04 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-20 16384512]
"SkyTel"="SkyTel.EXE" [2007-08-03 1826816]
"Auto EPSON Stylus C48 Series on GOLF"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE" [2005-05-16 99840]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632

---

r- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C48 Series]
2005-05-16 18:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I091.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C48 Series (Copy 1)]
2005-05-16 18:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I091.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 20:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 13:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [10/10/2010 10:40 64288]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [03/03/2011 18:45 371544]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [03/03/2011 18:45 301528]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [03/03/2011 18:45 19544]
R3 ip100xp;ASUS NX1001 Network Adapter NT Driver;c:\windows\system32\drivers\ipfnd51.sys [31/08/2010 11:55 26752]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/08/2010 13:15 1405384]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [12/08/2010 13:15 15232]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - ASWSNX
*NewlyCreated* - HTTPFILTER

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2011-02-19 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-08-12 12:55]

2011-03-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-24 09:36]

2011-03-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-24 09:36]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.ntlworld.com/
mStart Page = hxxp://home.!!!!!!!!!!!!
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\vonny\Application Data\Mozilla\Firefox\Profiles\bqczr5ta.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.ntlworld.com/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-CmPCIaudio - CMICNFG3.cpl



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-03 20:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@DACL=(02 0010)
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@DACL=(02 0010)
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@DACL=(02 0010)
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2011-03-03 20:23:53
ComboFix-quarantined-files.txt 2011-03-03 19:23

Pre-Run: 307,040,161,792 bytes free
Post-Run: 307,046,883,328 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 7944457A1A868AD7984DC78C49E51250

aliEnRIK

Hows it running now?

saffysue

I am extremely grateful for your help but unfortunately its just the same, I am particularly worried that I can't get windows firewall to work and can't get to windows updates .

closed

If you have a router, the firewall isn't something to worry about.

If this has just started happening, you could try a system restore

anything in your event log?

follow post 10

start, run, cmd

net start > c:\start.txt

notepad c:\start.txt

post contents

saffysue

Yes I did that in post 10

closed

did what????

saffysue

This :

strip out as much as you can from startup, including adaware and spybot, and post a fresh log

aliEnRIK

TICK and FIX this in hijack -
O9 - Extra button: Ladbrokes Casino - {41506D17-8406-4FA3-BA47-DA350F6EA1B3} - C:\Microgaming\Casino\Ladbrokes\casinogame.exe (HKCU)

closed

they and several other things are still in the hijackthis log you posted.