Feb

15

Please help: Virus [after downloading from piratebay.org]

Filed Under Virus | 

I tried to download a program using piratebay.org, and after it downloaded I realized it was riddled with Trojans and whatever else. It seemingly corrupted my Mcafee, so I uninstalled it and installed Avast Home Edition and Bitdefender. Bitdefender found a few infected files and moved them, please see summary below:

———-

C:\Program Files\KaZaA\cloudload.dat Infected Trojan.Generic.387140

C:\Program Files\KaZaA\cloudload.dat Disinfection failed

C:\Program Files\KaZaA\cloudload.dat Moved

C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP924\A0136204.dll

Infected Trojan.FakeAntivirus.Gen

C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP924\A0136204.dll

Disinfection failed

C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP924\A0136204.dll

Moved

C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP925\A0136228.dll

Infected Trojan.FakeAntivirus.Gen

C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP925\A0136228.dll

Disinfection failed

C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP925\A0136228.dll

Moved

C:\WINNT\system32\mobupd.exe=>wise0015 Detected: Application.WurldMedia.A

C:\WINNT\system32\mobupd.exe=>wise0015 Disinfection failed

C:\WINNT\system32\mobupd.exe=>wise0015 Move failed

——–

I deleted the entire KaZaa folder, because I haven’t needed it in years, but where was the infected file moved to? I’m not sure how to find it and manually delete it. As for C:\System Volume Information, I can’t even find that directory. And as for the mobupd file, I found it, but my computer won’t let me delete it because I guess it’s part of my operating system.

Also, the little red shield in the taskbar says my automatic updates are turned off, but when I go to the control panel to manually turn them on, it’s already on! How do I get rid of the false red shield alert?

I’ve also gotten a number of pop-ups since this ordeal began. Is it related to the viruses, or do I need to download a pop-up blocker?

Last edited by ceeepeas; 16 Hours Ago at 04:08.

Reason: More details

Read this and post the logs requested in this thread.

Please observe Posting Rules #3 - Meaningful Subject - I have adjusted your title.

Sorry about that. I’ve posted more details. Perhaps you can help?

Hi

First thing.

We do not approve of hacked, cracked or otherwise stolen programs, before you receive help you need to delete/remove any and all such programs.

Let this be a learning experience of what happens when trying to download a program that someone worked very hard to create and expects to be payed for.

Now do this.

Download DDS and save it to your desktop from here or here or here.

Disable any script blocker, and then double click dds.scr to run the tool.When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Save both reports to your desktop post the contents of both logs here.

Geri

I know, I’m horrible, I’m sorry! I was trying to update my word processing program. What I downloaded has been deleted. And I’ll never do it again! The DDS reports are below. Any help is very appreciated!

DDS (Ver_09-01-07.01)

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume1

Install Date: 8/17/2002 4:24:07 PM

System Uptime: 1/19/2009 10:23:08 PM (0 hours ago)

Motherboard: Intel Corporation | | D850EMV2

Processor: Intel(R) Pentium(R) 4 CPU 2.40GHz | J2E1 | 2386/133mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 75 GiB total, 43.614 GiB free.

D: is CDROM ()

E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID:

Description: PCI Modem

Device ID: PCI\VEN_14A4&DEV_FE42&SUBSYS_000214A4&REV_00\4&11CD5334&0&68F0

Manufacturer:

Name: PCI Modem

PNP Device ID: PCI\VEN_14A4&DEV_FE42&SUBSYS_000214A4&REV_00\4&11CD5334&0&68F0

Service:

Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}

Description: Microsoft PS/2 Mouse

Device ID: ACPI\PNP0F03\4&3A2C8C4B&0

Manufacturer: Microsoft

Name: Microsoft PS/2 Mouse

PNP Device ID: ACPI\PNP0F03\4&3A2C8C4B&0

Service: i8042prt

==== System Restore Points ===================

RP898: 1/19/2009 3:47:42 PM - System Checkpoint

RP899: 1/19/2009 3:47:43 PM - Software Distribution Service 3.0

RP900: 1/19/2009 3:47:45 PM - System Checkpoint

RP901: 1/19/2009 3:47:45 PM - System Checkpoint

RP902: 1/19/2009 3:47:46 PM - Software Distribution Service 3.0

RP903: 1/19/2009 3:47:47 PM - System Checkpoint

RP904: 1/19/2009 3:47:47 PM - System Checkpoint

RP905: 1/19/2009 3:47:47 PM - Installed Java(TM) 6 Update 10

RP906: 1/19/2009 3:47:47 PM - System Checkpoint

RP907: 1/19/2009 3:47:47 PM - System Checkpoint

RP908: 1/19/2009 3:47:47 PM - Installed Java(TM) 6 Update 11

RP909: 1/19/2009 3:47:48 PM - Software Distribution Service 3.0

RP910: 1/19/2009 3:47:48 PM - System Checkpoint

RP911: 1/19/2009 3:47:48 PM - Software Distribution Service 3.0

RP912: 1/19/2009 3:47:48 PM - System Checkpoint

RP913: 1/19/2009 3:47:49 PM - System Checkpoint

RP914: 1/19/2009 3:47:49 PM - System Checkpoint

RP915: 1/19/2009 3:47:49 PM - System Checkpoint

RP916: 1/19/2009 3:47:50 PM - System Checkpoint

RP917: 1/19/2009 3:47:50 PM - System Checkpoint

RP918: 1/19/2009 3:47:50 PM - Software Distribution Service 3.0

RP919: 1/19/2009 3:47:50 PM - System Checkpoint

RP920: 1/19/2009 3:47:50 PM - System Checkpoint

RP921: 1/19/2009 3:47:50 PM - Installed Microsoft Office Enterprise 2007

RP922: 1/19/2009 3:47:58 PM - Last known good configuration

RP923: 1/19/2009 3:55:37 PM - Before Office

RP924: 1/19/2009 3:56:28 PM - Restore Operation

RP925: 1/19/2009 7:45:12 PM - Installed BitDefender 8 Free Edition

==== Installed Programs ======================

Acrobat.com

Adobe AIR

Adobe Atmosphere Player for Acrobat and Adobe Reader

Adobe Flash Player 10 ActiveX

Adobe Photoshop Album 2.0 Starter Edition

Adobe Reader 9

AIM 6

AOL Coach Version 2.0(Build:20041026.5 en)

AOL Uninstaller (Choose which Products to Remove)

Apple Mobile Device Support

Apple Software Update

ArcSoft Panorama Maker 3

Audacity 1.3.4 (Unicode)

avast! Antivirus

BitDefender 8 Free Edition

Bonjour

Cardiris

Do More 5.0

Download Updater (AOL LLC)

DVD Player

Enhanced MediaLoads

GIMP 2.4.6

GTW V.92 Voicemodem

HelpSpot

Hotfix for Windows Internet Explorer 7 (KB947864)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB952287)

hp deskjet 5550 series (Remove only)

hp instant support

HP Photo Printing Software

HP Share-to-Web

Intel(R) PRO Ethernet Adapter and Software

Intel(R) PROSet II

iPod for Windows 2006-03-23

iTunes

J2SE Runtime Environment 5.0 Update 10

J2SE Runtime Environment 5.0 Update 11

J2SE Runtime Environment 5.0 Update 4

J2SE Runtime Environment 5.0 Update 6

J2SE Runtime Environment 5.0 Update 9

Java(TM) 6 Update 11

Java(TM) 6 Update 2

Java(TM) 6 Update 3

Java(TM) 6 Update 5

Java(TM) 6 Update 7

Java(TM) SE Runtime Environment 6 Update 1

LiveUpdate 1.80 (Symantec Corporation)

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Hotfix (KB928366)

Microsoft .NET Framework 2.0 Service Pack 1

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Data Access Components KB870669

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office 2000 SR-1 Professional

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Works 2002 Setup Launcher

Microsoft Works 6.0

Microsoft Works Suite Add-in for Microsoft Word

MobileMe Control Panel

MSN Toolbar

Nikon Message Center

NVIDIA Windows 2000/XP Display Drivers

PC-Doctor Consumer UI

PC-Doctor Diagnostics

PC-Doctor for Windows

PC-Doctor Services

PictureProject

PS/2 Millennium Keyboard

QuickTime

RealPlayer Basic

RitzPix E-Z Print & Share

Security Update for Step By Step Interactive Training (KB898458)

Security Update for Step By Step Interactive Training (KB923723)

Security Update for Windows Internet Explorer 7 (KB928090)

Security Update for Windows Internet Explorer 7 (KB929969)

Security Update for Windows Internet Explorer 7 (KB931768)

Security Update for Windows Internet Explorer 7 (KB933566)

Security Update for Windows Internet Explorer 7 (KB937143)

Security Update for Windows Internet Explorer 7 (KB938127)

Security Update for Windows Internet Explorer 7 (KB939653)

Security Update for Windows Internet Explorer 7 (KB942615)

Security Update for Windows Internet Explorer 7 (KB944533)

Security Update for Windows Internet Explorer 7 (KB950759)

Security Update for Windows Internet Explorer 7 (KB953838)

Security Update for Windows Internet Explorer 7 (KB956390)

Security Update for Windows Internet Explorer 7 (KB958215)

Security Update for Windows Internet Explorer 7 (KB960714)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player 10 (KB911565)

Security Update for Windows Media Player 10 (KB917734)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Media Player 6.4 (KB925398)

Security Update for Windows XP (KB923689)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951376)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953839)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Shockwave

ShopperReports

Sound Blaster Audigy

Update for Windows XP (KB951072-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955839)

Viewpoint Media Player

WebFldrs XP

Windows Blaster Worm Removal Tool (KB833330)

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage v1.3.0254.0

Windows Genuine Advantage Validation Tool

Windows Internet Explorer 7

Windows Media Format 11 runtime

Windows Media Player 11

Windows XP Service Pack 3

WinRAR archiver

Works Suite OS Pack

Works Synchronization

Xilisoft iPod Rip

==== Event Viewer Messages From Past Week ========

1/13/2009 12:17:18 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer ‘time.windows.com,0×1′. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0×80072751)

1/19/2009 3:42:27 PM, error: DCOM [10005] - DCOM got error "58" attempting to start the service McMSCSvc with arguments "" in order to run the server: {03082469-BA75-44A5-89CB-D187F313E572}

1/19/2009 3:46:55 PM, error: DCOM [10005] - DCOM got error "58" attempting to start the service McMSCSvc with arguments "" in order to run the server: {398E2E68-BFDA-4834-B971-3CB8EC3C7219}

1/19/2009 4:41:23 PM, error: DCOM [10005] - DCOM got error "58" attempting to start the service McMSCSvc with arguments "" in order to run the server: {B299BB78-EBBE-48F9-8725-E6A84C4E7C1D}

1/19/2009 5:00:06 PM, error: DCOM [10005] - DCOM got error "58" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

==== End Of File ===========================

DDS (Ver_09-01-07.01) - NTFSx86

Run by Owner at 22:50:04.50 on Mon 01/19/2009

Internet Explorer: 7.0.5730.11

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.156 [GMT -5:00]

AV: avast! antivirus 4.8.1296 [VPS 090119-0] *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINNT\system32\svchost -k DcomLaunch

svchost.exe

C:\WINNT\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINNT\system32\CTHELPER.EXE

C:\WINNT\system32\PROMon.exe

C:\WINNT\system32\SK9910DM.EXE

C:\WINNT\GWMDMMSG.exe

C:\Program Files\Common Files\AOL\1110958654\ee\AOLSoftware.exe

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Softwin\BitDefender8\bdmcon.exe

C:\Program Files\Softwin\BitDefender8\bdnagent.exe

C:\Program Files\RitzPix E-Z Print & Share\OurPictures.exe

C:\WINNT\system32\ctfmon.exe

C:\Program Files\Nikon\PictureProject\NkbMonitor.exe

c:\program files\common files\aol\1110958654\ee\aolsoftware.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINNT\System32\NMSSvc.exe

C:\WINNT\System32\nvsvc32.exe

C:\WINNT\System32\svchost.exe -k imgsvc

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINNT\wanmpsvc.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\WINNT\system32\wscntfy.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Softwin\BitDefender8\bdlite.exe

C:\Program Files\AIM6\aim6.exe

C:\Program Files\AIM6\aolsoftware.exe

C:\Program Files\iTunes\iTunes.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINNT\explorer.exe

C:\Documents and Settings\Owner\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.cnn.com/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

BHO: &Research: {0b014b81-4e12-46f9-806f-55867af8fd3c} - c:\winnt\system32\winsystems.dll

BHO: ShoppingReport: {100eb1fd-d03e-47fd-81f3-ee91287f9465} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {73a8d336-7ee9-378b-4ef4-d2bc1742a3b2}: {2b3a2471-cb2d-4fe4-b873-9ee7633d8a37} - c:\winnt\system32\sodzaj.dll

BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: ST: {9394ede7-c8b5-483e-8773-474bf36af6e4} - c:\program files\msn apps\st\01.03.0000.1005\en-xu\stmain.dll

BHO: MSNToolBandBHO: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: {fca12767-5203-45bd-a3f9-9737b7a1ab37} - c:\winnt\system32\pMdExYqO.dll

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

TB: MSN: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll

TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

TB: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No File

EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\winnt\system32\Shdocvw.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

EB: ShopperReports: {a7cddcdc-beeb-4685-a062-978f5e07ceee} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll

uRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe

uRun: [PopUpStopperFreeEdition] "c:\progra~1\panicw~1\pop-up~1\PSFree.exe"

uRun: [OurPictures] "c:\program files\ritzpix e-z print & share\OurPictures.exe" /AutoStart

uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe

uRun: [Aim6]

uRun: [00184274300097377136458179870659] c:\program files\antivirus 2009\av2009.exe

mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe

mRun: [WINDVDPatch] CTHELPER.EXE

mRun: [UpdReg] c:\winnt\UpdReg.EXE

mRun: [PROMon.exe] PROMon.exe

mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

mRun: [NaimAgent_UI] c:\epoagent\naimag32.exe

mRun: [Keyboard Preload Check] c:\oemdrvrs\keyb\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"

mRun: [Jet Detection] c:\program files\creative\sbaudigy\program\ADGJDet.exe

mRun: [HPDJ Taskbar Utility] c:\winnt\system32\spool\drivers\w32×86\3\hpztsb05.exe

mRun: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE

mRun: [GWMDMMSG] GWMDMMSG.exe

mRun: [HostManager] c:\program files\common files\aol\1110958654\ee\AOLSoftware.exe

mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe

mRun: [BDMCon] "c:\program files\softwin\bitdefender8\bdmcon.exe"

mRun: [BDNewsAgent] "c:\program files\softwin\bitdefender8\bdnagent.exe"

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe

IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C}

IE: {C5428486-50A0-4a02-9D20-520B59A9F9B2} - {C9CCBB35-D123-4a31-AFFC-9B2933132116} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll

IE: {C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\winnt\system32\Shdocvw.dll

Notify: ssqPjjJY - ssqPjjJY.dll

AppInit_DLLs: sodzaj.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll

LSA: Authentication Packages = msv1_0 c:\winnt\system32\pMdExYqO

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\winnt\system32\drivers\aswSP.sys [2009-1-19 111184]

R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-1-19 254040]

R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-1-19 352920]

R4 aswFsBlk;aswFsBlk;c:\winnt\system32\drivers\aswFsBlk.sys [2009-1-19 20560]

R4 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-1-19 155160]

R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-1-3 24652]

S3 PCDRDRV;Pcdr Helper Driver;\??\c:\atf\qctest\pcdoc\pcdrdrv.sys –> c:\atf\qctest\pcdoc\PCDRDRV.sys [?]

S4 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe –> c:\progra~1\mcafee\viruss~1\mcshield.exe [?]

S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe –> c:\progra~1\mcafee\viruss~1\mcsysmon.exe [?]

=============== Created Last 30 ================

2009-01-19 20:08 14 a——- c:\documents and settings\owner\getfile.dat

2009-01-19 19:45 <DIR> –d—– c:\program files\Softwin

2009-01-19 19:44 <DIR> –d—– c:\program files\common files\Softwin

2009-01-19 17:15 <DIR> –d—– c:\program files\Antivirus 2009

2009-01-19 16:35 124,416 a——- c:\winnt\system32\yjxcorxd.dll

2009-01-19 16:35 124,416 a——- c:\winnt\system32\sodzaj.dll

2009-01-19 16:35 124,416 a——- c:\winnt\system32\perxteev.dll

2009-01-19 16:18 124,416 a——- c:\winnt\system32\daxwyeot.dll

2009-01-19 16:16 1,406,503 a–sh— c:\winnt\system32\gbjqwkbp.ini

2009-01-19 16:16 73,728 a——- c:\winnt\system32\pbkwqjbg.dll

2009-01-19 15:59 0 a——- c:\winnt\system32\mcrh.tmp

2009-01-19 15:48 124,416 a——- c:\winnt\system32\ypudxr(2).dll

2009-01-19 15:47 1,444 a–sh— c:\winnt\system32\OqYxEdMp.ini2

2009-01-19 15:47 1,444 a–sh— c:\winnt\system32\OqYxEdMp.ini

2009-01-19 15:47 303,616 a——- c:\winnt\system32\pMdExYqO.dll

2009-01-19 15:42 47,104 a——- c:\winnt\system32\hgGyyvtu.dll

2009-01-19 14:04 <DIR> –d—– c:\docume~1\alluse~1\applic~1\Azureus

2009-01-19 14:03 <DIR> –d—– c:\docume~1\owner\applic~1\Azureus

2009-01-03 17:06 <DIR> –d—– c:\program files\common files\Software Update Utility

2009-01-03 17:05 <DIR> –d—– c:\docume~1\alluse~1\applic~1\acccore

2009-01-03 17:00 <DIR> –d—– c:\program files\AIM6

==================== Find3M ====================

2009-01-14 18:52 20 —-h— c:\docume~1\alluse~1\applic~1\PKP_DLec.DAT

2008-12-13 01:40 3,593,216 a——- c:\winnt\system32\dllcache\mshtml.dll

2008-12-11 05:57 333,952 a——- c:\winnt\system32\drivers\srv.sys

2008-12-11 05:57 333,952 ——– c:\winnt\system32\dllcache\srv.sys

2008-11-10 05:43 410,984 a——- c:\winnt\system32\deploytk.dll

2008-10-23 07:36 286,720 a——- c:\winnt\system32\gdi32.dll

2008-10-23 07:36 286,720 ——– c:\winnt\system32\dllcache\gdi32.dll

2008-04-13 19:12 413,696 a–sh— c:\winnt\system32\msvcp60.dll

2008-04-13 19:12 551,936 a–sh— c:\winnt\system32\oleaut32.dll

2008-04-13 19:12 84,992 a–sh— c:\winnt\system32\olepro32.dll

2008-04-13 19:12 11,776 a–sh— c:\winnt\system32\regsvr32.exe

2008-08-26 22:36 32,768 ac-sh— c:\winnt\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082620080827\index.dat

============= FINISH: 22:52:11.67 ===============

Hi

OK you are running (2) two anti virus programs, this is not a good idea, it can cause conflects and actually give you less protection. I marked them in red below, your choice on which one 1 you remove.

Please go to Start > Control Panel > Add/Remove Programs (Windows Vista it’s Programs and Features) and remove the following:

avast! Antivirus <<< Remove one (1) of these anti virus programs

BitDefender 8 Free Edition <<< Remove one (1) of these anti virus programs

J2SE Runtime Environment 5.0 Update 10

J2SE Runtime Environment 5.0 Update 11

J2SE Runtime Environment 5.0 Update 4

J2SE Runtime Environment 5.0 Update 6

J2SE Runtime Environment 5.0 Update 9

Java(TM) 6 Update 2

Java(TM) 6 Update 3

Java(TM) 6 Update 5

Java(TM) 6 Update 7

Java(TM) SE Runtime Environment 6 Update 1

LiveUpdate 1.80 (Symantec Corporation)

Please note any other programs that you dont recognize in that list and post them in your next response

Now please do this.

Download ComboFix from Here to your Desktop.

It’s best to disable realtime protection applications as they sometimes interfere with the tool.

Check this link for any applicable programs you may have.Close all open programs and windows
Double click combofix.exe and follow the prompts.
Vista users right click Combofix.exe and select Run As Administrator.
When finished, it shall produce a log for you. Post the Combofix log
Note: Do not mouseclick combofix’s window while its running. That may cause it to stall

**NOTE - Allow ComboFix to update if prompted.

Thanks

Geri

The programs I’ve listed below are one’s I either don’t recognize or don’t know what they do–doesn’t necessarily mean they don’t belong, it just means I’m clueless:

Enhanced MediaLoads

GIMP 2.4.6

GTW V.92 Voicemodem

HelpSpot

Intel (R) PROSet II

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Hotfix (KB928366)

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft User-Mode Driver Framework Feature Pack 1.0

MobileMe Control Panel

NVIDIA Windows 2000/XP Display Drivers

PC-Doctor Diagnostics

PC-Doctor Consumer UI

PC-Doctor for Windows

PC-Doctor Services

Viewpoint Media Player

(Is it necessary to keep all of the service packs? Do they build on one another or are they independent of one another? For example, if I have service pack 3, do i need to keep service pack 1?)

My computer seems a lot healthier now. The red shield error message went away and I haven’t had any pop-ups in a little while. Does everything seem okay? What exactly happened?

Also, someone recommended I use BitDefender as a backup scanner to catch viruses Avast would miss, but I deleted BitDefender anyway.

Thanks so much for your help!

———————————–

COMBOFIX REPORT BELOW

———————————–

ComboFix 09-01-19.04 - Owner 2009-01-20 1:15:16.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.259 [GMT -5:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

AV: avast! antivirus 4.8.1296 [VPS 090119-0] *On-access scanning disabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Owner\Application Data\ShoppingReport

c:\documents and settings\Owner\Application Data\ShoppingReport\cs\Config.xml

c:\documents and settings\Owner\Application Data\ShoppingReport\cs\db\Aliases.dbs

c:\documents and settings\Owner\Application Data\ShoppingReport\cs\db\Sites.dbs

c:\documents and settings\Owner\Application Data\ShoppingReport\cs\dwld\WhiteList.xip

c:\documents and settings\Owner\Application Data\ShoppingReport\cs\report\aggr_storage.xml

c:\documents and settings\Owner\Application Data\ShoppingReport\cs\report\send_storage.xml

c:\documents and settings\Owner\Application Data\ShoppingReport\cs\res2\WhiteList.dbs

c:\documents and settings\Owner\Desktop\notepad.exe

c:\program files\Antivirus 2009

c:\program files\MyWay

c:\program files\MyWay\myBar\History\search

c:\program files\MyWay\myBar\Settings\prevcfg.htm

c:\program files\ShoppingReport

c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll

c:\program files\ShoppingReport\Uninst.exe

c:\winnt\IE4 Error Log.txt

c:\winnt\Readme.txt

c:\winnt\system32\daxwyeot.dll

c:\winnt\system32\hgGyyvtu.dll

c:\winnt\system32\mcrh.tmp

c:\winnt\system32\OqYxEdMp.ini

c:\winnt\system32\OqYxEdMp.ini2

c:\winnt\system32\P2P Networking

c:\winnt\system32\P2P Networking\Cache\Database\index256.dbb

c:\winnt\system32\P2P Networking\P2P Networking.eng

c:\winnt\system32\pbkwqjbg.dll

c:\winnt\system32\perxteev.dll

c:\winnt\system32\pMdExYqO.dll

c:\winnt\system32\sodzaj.dll

c:\winnt\system32\yjxcorxd.dll

c:\winnt\system32\ypudxr(2).dll

c:\winnt\Tasks\qmyzbpjf.job

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

——-\Legacy_RPCPATCH

——-\Legacy_RPCTFTPD

((((((((((((((((((((((((( Files Created from 2008-12-20 to 2009-01-20 )))))))))))))))))))))))))))))))

.

2009-01-19 20:08 . 2009-01-19 23:14 14 –a—— c:\documents and settings\Owner\getfile.dat

2009-01-19 19:45 . 2009-01-19 19:45 <DIR> d——– c:\program files\Softwin

2009-01-19 19:44 . 2009-01-20 00:45 <DIR> d——– c:\program files\Common Files\Softwin

2009-01-19 17:34 . 2009-01-19 17:34 <DIR> d——– c:\program files\Alwil Software

2009-01-19 16:16 . 2009-01-19 16:16 1,406,503 –ahs—- c:\winnt\system32\gbjqwkbp.ini

2009-01-19 15:17 . 2009-01-19 15:38 <DIR> d——– c:\documents and settings\All Users\Application Data\Microsoft Help

2009-01-19 14:04 . 2009-01-19 14:04 <DIR> d——– c:\documents and settings\All Users\Application Data\Azureus

2009-01-19 14:03 . 2009-01-19 15:24 <DIR> d——– c:\documents and settings\Owner\Application Data\Azureus

2009-01-03 17:08 . 2009-01-03 17:08 <DIR> d——– c:\documents and settings\Owner\Application Data\acccore

2009-01-03 17:06 . 2009-01-03 17:06 <DIR> d——– c:\program files\Common Files\Software Update Utility

2009-01-03 17:05 . 2009-01-03 17:05 <DIR> d——– c:\documents and settings\All Users\Application Data\acccore

2009-01-03 17:04 . 2009-01-03 17:08 <DIR> d——– c:\documents and settings\All Users\Application Data\AOL OCP

2009-01-03 17:00 . 2009-01-03 17:07 <DIR> d——– c:\program files\AIM6

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-20 05:58 ——— d—–w c:\program files\Java

2009-01-19 22:05 ——— d—–w c:\documents and settings\All Users\Application Data\McAfee

2009-01-19 20:34 ——— d—–w c:\program files\Microsoft Works

2009-01-14 23:52 20 —h–w c:\documents and settings\All Users\Application Data\PKP_DLec.DAT

2009-01-04 07:19 ——— d—–w c:\program files\Common Files\AOL

2009-01-03 22:17 ——— d—–w c:\documents and settings\Owner\Application Data\AOL

2009-01-03 22:17 ——— d—–w c:\documents and settings\All Users\Application Data\AOL

2009-01-03 22:05 ——— d—–w c:\program files\Viewpoint

2009-01-03 22:05 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint

2008-12-11 10:57 333,952 —-a-w c:\winnt\system32\drivers\srv.sys

2008-11-24 05:19 ——— d—–w c:\program files\iTunes

2008-11-24 05:19 ——— d—–w c:\program files\iPod

2008-11-24 05:19 ——— d—–w c:\program files\Common Files\Apple

2008-11-24 05:19 ——— d—–w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-11-24 05:15 ——— d—–w c:\program files\QuickTime

2008-04-14 00:12 413,696 –sha-w c:\winnt\system32\msvcp60.dll

2008-04-14 00:12 551,936 –sha-w c:\winnt\system32\oleaut32.dll

2008-04-14 00:12 84,992 –sha-w c:\winnt\system32\olepro32.dll

2008-04-14 00:12 11,776 –sha-w c:\winnt\system32\regsvr32.exe

2008-08-27 03:36 32,768 -csha-w c:\winnt\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082620080827\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"OurPictures"="c:\program files\RitzPix E-Z Print & Share\OurPictures.exe" [2006-06-19 4796416]

"ctfmon.exe"="c:\winnt\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="NvQTwk" [X]

"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]

"UpdReg"="c:\winnt\UpdReg.EXE" [2000-05-11 90112]

"Jet Detection"="c:\program files\Creative\SBAudigy\PROGRAM\ADGJDet.exe" [2001-10-04 28672]

"HPDJ Taskbar Utility"="c:\winnt\System32\spool\drivers\w32×86\3\hpztsb05.exe" [2002-03-18 188416]

"HostManager"="c:\program files\Common Files\AOL\1110958654\ee\AOLSoftware.exe" [2006-09-25 50736]

"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-03-16 26112]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]

"WINDVDPatch"="CTHELPER.EXE" [2002-02-07 c:\winnt\system32\CTHELPER.EXE]

"PROMon.exe"="PROMon.exe" [2002-04-18 c:\winnt\system32\PROMon.exe]

"Hot Key Kbd 9910 Daemon"="SK9910DM.EXE" [2001-01-03 c:\winnt\system32\SK9910DM.EXE]

"GWMDMMSG"="GWMDMMSG.exe" [2002-05-06 c:\winnt\GWMDMMSG.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2006-04-13 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.mxmc"= MimicICM.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\1110958654\\EE\\AOLServiceHost.exe"=

"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Common Files\\AOL\\1110958654\\EE\\aolsoftware.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

R1 aswSP;avast! Self Protection;c:\winnt\system32\drivers\aswSP.sys [2009-01-19 111184]

R4 aswFsBlk;aswFsBlk;c:\winnt\system32\drivers\aswFsBlk.sys [2009-01-19 20560]

R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2009-01-03 24652]

S3 PCDRDRV;Pcdr Helper Driver;\??\c:\atf\Qctest\PCDoc\PCDRDRV.sys –> c:\atf\Qctest\PCDoc\PCDRDRV.sys [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - NMSCFG

*NewlyCreated* - NMSSVC

*NewlyCreated* - SYMREDRV

*NewlyCreated* - SYMTDI

*Deregistered* - SYMREDRV

*Deregistered* - SYMTDI

.

Contents of the ‘Scheduled Tasks’ folder

2008-08-17 c:\winnt\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

- - - - ORPHANS REMOVED - - - -

BHO-{0B014B81-4E12-46F9-806F-55867AF8FD3C} - c:\winnt\system32\winsystems.dll

BHO-{2b3a2471-cb2d-4fe4-b873-9ee7633d8a37} - c:\winnt\system32\sodzaj.dll

BHO-{FCA12767-5203-45BD-A3F9-9737B7A1AB37} - c:\winnt\system32\pMdExYqO.dll

HKCU-Run-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe

HKCU-Run-PopUpStopperFreeEdition - c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe

HKCU-Run-Aim6 - (no file)

HKLM-Run-NaimAgent_UI - c:\epoagent\naimag32.exe

HKLM-Run-Keyboard Preload Check - c:\oemdrvrs\KEYB\Preload.exe

HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe

Notify-ssqPjjJY - ssqPjjJY.dll

.

——- Supplementary Scan ——-

.

uStart Page = hxxp://www.cnn.com/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML

IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} -

DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab

DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} - hxxps://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-20 01:21:49

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

.

——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E24A3BE2-0E58-440D-C5291999CC5C5741}\{9EE83BBD-CDA7-8737-4BFE3ADA0C41BF51}\{12860FBF-70CB-D90A-D9669DC891BE38B3}*]

"Q3FBLH6RIF6MYMN6VD31LVQSMD1"=hex:01,00,00,00,00,00,00,00,5c,63,e8,cf,f7,e6 ,fd,

3a

.

———————— Other Running Processes ————————

.

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\program files\Common Files\AOL\ACS\AOLacsd.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\winnt\system32\NMSSvc.Exe

c:\winnt\system32\nvsvc32.exe

c:\winnt\wanmpsvc.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2009-01-20 1:25:45 - machine was rebooted

ComboFix-quarantined-files.txt 2009-01-20 06:25:31

Pre-Run: 46,921,203,712 bytes free

Post-Run: 46,915,780,608 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINNT

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

209 — E O F — 2009-01-14 23:48:34

Related Posts:

written by lina \\ tags: , , , , , , , , , , , , , , , , , , , , , , , ,

Comments

Leave a Reply

You must be logged in to post a comment.