Help with HJT file?[RESOLVED]

Kazzaa · January 29, 2011

i have a netbook with Windows XP which has had some problems for a while. Freezing, slow to run, windows explorer takes approx. 5 mins to open when computer has started. Windows installer keeps popping up when random buttons are clicked. I cannot acces Windows update or manually install any updates. I cannot install AVG or another anti-virus as it always fails due to "another installation already in progress". I have managed to install tune up programs to no avail, & windows defender or one care scanner are not finding any viruses. Hijack this is my last resort. Hopefully someone can spot what the problem is???

Thanks in advance for any help you can offer??

I include the log file here as it would not attach!

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:58:16 PM, on 29/01/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\idt\wdm\STacSV.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ie&c=91&bd=Pavilion&pf=cnnb

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ie

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ie

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6886.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1289937724671

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} (PCPitstop AntiVirus) - http://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1285972845937

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV.exe

--

End of file - 4397 bytes

schrauber · January 30, 2011

Hello, K-Dog

Welcome to the BestTechie Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

Please take note of some guidelines for this fix:

Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Please download OTL from one of the following mirrors:
- This is THE Mirror

[*]Save it to your desktop.

[*]Double click on the icon on your desktop.

[*]Under the Custom Scan box paste this in

netsvcs

%SYSTEMDRIVE%\*.exe

%systemroot%\*. /mp /s

CREATERESTOREPOINT

[*]Push the Quick Scan button.

[*]Two reports will open, copy and paste them in a reply here:

OTL.txt <-- Will be opened
Extra.txt <-- Will be minimized

Please download Rootkit Unhooker from one of the following links and save it to your desktop.

Link 1 (.exe file) Link 2 (zipped file) Link 3 (.rar file)

In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

Double-click on RKUnhookerLE.exe to start the program. Vista/Windows 7 users right-click and select Run As Administrator.
Click the Report tab, then click Scan.
Check Drivers, Stealth, and uncheck the rest.
Click OK.
Wait until it's finished and then go to File > Save Report.
Save the report to your Desktop.
Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

Kazzaa · January 30, 2011

Hey Tom,

Thanks for your response. Prior to your post I had run a spybot search & destroy scan but I won't run anything else until i have completed your instructions.

The results of the OTL scan are as follows:

OTL.Txt

Extras.Txt

Kazzaa · January 31, 2011

Hi again Tom,

I got nowhere with the Rootkit Unhooker, basically i spent all night trying to get it going to no avail. It downloads fine, installed fine but when i clcik it to open a small box saying " Please wait a few seconds.... Initialising" appears & then nothing more happens. The computer totally freezes on that screen, cannot open anything else, the clock doesn't even change & i have to hold the power button to shut the pc down. I removed the program & installed another version but same thing happened. SO no results there for ya...

schrauber · January 31, 2011

Hi,

Please don't attach the logfiles, just post them here in the thread

Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to <schrauber> before saving it to your desktop.

Link 1

Link 2

--------------------------------------------------------------------

Double click on the renamed Combofix.exe & follow the prompts.

When finished, it will produce a report for you.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.

ComboFix SHOULD NOT be used unless requested by a forum helper

If you need help, see this link:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Kazzaa · January 31, 2011

Hi,

I have followed these steps... firstly I disabled Avira (not a problem), then ComboFix said that AVG Free was running, which I thought it wasn't. I couldn't find a running AVG program, so I ran AVG removal tool, & ComboFix still said AVG was running. I assumed it was a glitch so I ran ComboFix (you will see from the report that it DOES say AVG is running, I just couldn't find the location).

First few steps went fine, the Windows Recovery Console was not installed so it connected with the Microsoft site & downlaoded 100% but then didn't install the console. I don't know why this is?? ComboFix ran fine after that & I enclose the log report.

So just remember when viewing it:

1 - AVG was running but I couldn't find it

2 - the recovery console was not & is not now installed.

Just in case these facts affect how we proceed from here.

Thanks,

K-Dog

ComboFix 11-01-31.01 - miss madigan 31/01/2011 21:10:28.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1015.589 [GMT 0:00]

Running from: c:\documents and settings\miss madigan\Desktop\schrauber.exe

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_RKHIT

-------\Service_RkHit

((((((((((((((((((((((((( Files Created from 2010-12-28 to 2011-01-31 )))))))))))))))))))))))))))))))

.

2011-01-30 19:13 . 2011-01-31 11:39 34560 ----a-w- c:\windows\system32\drivers\Normandy.sys

2011-01-30 17:56 . 2011-01-30 17:56 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-01-30 15:29 . 2011-01-30 15:29 -------- d-----w- c:\documents and settings\miss madigan\Application Data\Avira

2011-01-30 15:27 . 2010-12-13 08:40 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-01-30 15:27 . 2010-12-13 08:40 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys

2011-01-30 15:27 . 2010-06-17 14:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2011-01-30 15:27 . 2010-06-17 14:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2011-01-30 15:27 . 2011-01-30 15:27 -------- d-----w- c:\program files\Avira

2011-01-30 15:27 . 2011-01-30 15:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2011-01-30 14:24 . 2011-01-30 17:42 -------- d-----w- c:\program files\MSECACHE

2011-01-29 12:45 . 2011-01-29 12:45 388096 ----a-r- c:\documents and settings\miss madigan\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-01-29 12:45 . 2011-01-29 12:45 -------- d-----w- c:\program files\Trend Micro

2011-01-28 20:03 . 2009-10-22 12:54 37392 ----a-w- c:\windows\system32\drivers\82495002.sys

2011-01-28 20:02 . 2009-09-25 16:59 128016 ----a-w- c:\windows\system32\drivers\82495001.sys

2011-01-28 20:02 . 2009-10-09 22:31 315408 ----a-w- c:\windows\system32\drivers\8249500.sys

2011-01-28 19:51 . 2011-01-28 19:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL

2011-01-28 17:21 . 2011-01-28 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\PCPitstop

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-18 22:17 . 2010-12-18 22:17 951291 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\remregfix.reg

2010-12-18 22:17 . 2010-12-18 22:17 896 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\databasepath.reg

2010-12-18 22:17 . 2010-12-18 22:17 890 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\Remove-itRestorePoint.vbs

2010-12-18 22:17 . 2010-12-18 22:17 5228 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\nfig.reg

2010-12-18 22:17 . 2010-12-18 22:17 4994 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\s.reg

2010-12-18 22:17 . 2010-12-18 22:17 4512 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\hpregfix.reg

2010-12-18 22:17 . 2010-12-18 22:17 4224 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\beep.sys

2010-12-18 22:17 . 2010-12-18 22:17 3008 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\bgregfix.reg

2010-12-18 22:17 . 2010-12-18 22:17 2600 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\exefix.reg

2010-12-18 22:17 . 2010-12-18 22:17 18308 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\IEDef.reg

2010-12-18 22:17 . 2010-12-18 22:17 1754 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\regf.reg

2010-12-18 22:17 . 2010-12-18 22:17 29634504 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\scan.exe

2010-12-18 22:17 . 2008-04-15 12:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys

2010-12-18 22:17 . 2010-12-18 22:17 16384 ----a-w- c:\documents and settings\miss madigan\Local Settings\Application Data\tskill.exe

2010-11-16 19:30 . 2010-10-10 16:02 10240 ----a-w- c:\windows\system32\drivers\compbatt.sys

.

<pre>
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\CyberLink\YouCam\YouCamTray .exe
c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu .exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain .exe
c:\program files\HP\HPBTWD .exe
c:\program files\IDT\WDM\sttray .exe
c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr .exe
c:\program files\Synaptics\SynTP\SynTPEnh .exe
c:\program files\syncables\syncables desktop\Syncables .exe
c:\program files\uTorrent\uTorrent .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^miss madigan^Start Menu^Programs^Startup^_uninst_setup_9.0.0.722_19.11.2010_22-12.exe.lnk]

backup=c:\windows\pss\_uninst_setup_9.0.0.722_19.11.2010_22-12.exe.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AESTFltr]

2009-02-18 21:41 737280 ----a-w- c:\windows\system32\AESTFltr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-15 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2008-02-15 21:46 159744 ----a-w- c:\windows\system32\hkcmd.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\syncables\\syncables desktop\\jre\\bin\\javaw.exe"=

"c:\\Program Files\\uTorrent\\uTorrent .exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [24/09/2008 21:09 103792]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [30/01/2011 15:27 135336]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]

R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [05/06/2009 12:16 113664]

R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [02/03/2009 21:03 38912]

S2 BOTService;BOTService;"c:\program files\Roxio\BackOnTrack\Instant Restore\BOTService.exe" --> c:\program files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [?]

S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [05/06/2009 12:17 160256]

S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

S3 utexntcx;AVZ Kernel Driver;\??\c:\windows\system32\Drivers\utexntcx.sys --> c:\windows\system32\Drivers\utexntcx.sys [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

sepmfxtv

.

Contents of the 'Scheduled Tasks' folder

2011-01-27 c:\windows\Tasks\BackOnTrack Update.job

- c:\windows\BotInvokeUpdate.exe [2009-07-23 05:41]

2011-01-31 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]

.

------- Supplementary Scan -------

.

uStart Page = www.google.ie

mStart Page = www.google.ie

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

Trusted Zone: microsoft.com

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-klmdb.sys

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-01-31 21:26

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1460)

c:\windows\system32\WININET.dll

c:\windows\system32\msi.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\idt\wdm\STacSV.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\system32\igfxsrvc.exe

.

**************************************************************************

.

Completion time: 2011-01-31 21:31:37 - machine was rebooted

ComboFix-quarantined-files.txt 2011-01-31 21:31

Pre-Run: 140,954,198,016 bytes free

Post-Run: 140,876,398,592 bytes free

- - End Of File - - 280CB042CF25FCBF6B4F4689E5B78EAD

schrauber · February 1, 2011

Hi,

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:


RenV::
c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe
c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\CyberLink\YouCam\YouCamTray .exe
c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu .exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain .exe
c:\program files\HP\HPBTWD .exe
c:\program files\IDT\WDM\sttray .exe
c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr .exe
c:\program files\Synaptics\SynTP\SynTPEnh .exe
c:\program files\syncables\syncables desktop\Syncables .exe
c:\program files\uTorrent\uTorrent .exe
Driver::
sepmfxtv
SysCow
File::
c:\windows\system32\drivers\syscow32x.sys
NetSvc::
sepmfxtv
DDS::
uStart Page = www.google.ie
mStart Page = www.google.ie

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Kazzaa · February 4, 2011

Hey,

Thanks again for all your help so far. I followed your last instructions, (& searched unsuccessfully for AVG & tried to disbale it but i got nowhere again). Ran combofix as you said, after draging and dropping the text above into it. The log is as follows:

ComboFix 11-01-31.02 - miss madigan 04/02/2011 14:51:20.2.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1015.588 [GMT 0:00]

Running from: c:\documents and settings\miss madigan\Desktop\schrauber.exe

Command switches used :: c:\documents and settings\miss madigan\Desktop\CFScript.txt

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

"c:\windows\system32\drivers\syscow32x.sys"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_SYSCOW

-------\Service_SysCow

((((((((((((((((((((((((( Files Created from 2011-01-04 to 2011-02-04 )))))))))))))))))))))))))))))))