Possible virus, command.exe detected on computer by Trend Micro

Hi,

Is this the same system that kevinf80 finished working with you on, on the 2nd of june?

Thanks.

No, this is actually my fathers computer

Ok,

I'm K27 and i will be reviewing your log for you.

Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use.

Please Print or Save to Notepad all instructions and please follow them carefully and if there's something you don't understand or that will not work please let me know and we will go through it together.

Please DO NOT use this system for anything apart from visiting this forum and other sites I direct you too, as this will only make the cleanup process all the more diffecult.

Failure to reply in three (3) days will result in this topic being closed and I will remove it from my notifications, If you require more time then that is fine but please let me know.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

I need to see some additional information about what is happening in your machine.
Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.com
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explanation about the tool.
• When done, DDS will open two (2) logs

• Save both reports to your desktop.
• The instructions here ask you to attach the Attach.txt.

• Instead of attaching, please copy/past both logs into your next reply.

• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run.After downloading the tool, disconnect from the internet and disable all antivirus protection.
Run the scan, enable your A/V and reconnect to the internet.
Information on A/V control HERE

Please COPY/PASTE the MBAM log and BOTH DDS logs.

Thanks

Ok, will do. Just to be clear, there is an infection then?

Hard to say at this stage. HJT is just a primarily test to get a quick look at the system. We will know more after running other diagnostic tools.

Thanks

Here are the logs, Malwarebytes got rid of just a few things:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6842

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/12/2011 2:13:23 PM

mbam-log-2011-06-12 (14-13-23).txt

Scan type: Quick scan

Objects scanned: 201106

Time elapsed: 33 minute(s), 2 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

c:\program files\MyWay (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Files Infected:

c:\command.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\smdat32a.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Scott at 14:38:40 on 2011-06-12

Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.511.140 [GMT -7:00]

.

AV: Trend Micro Titanium Internet Security *Enabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe

C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\cisvc.exe

C:\Program Files\Citrix\GoToMyPC\g2svc.exe

C:\Program Files\Citrix\GoToMyPC\g2comm.exe

C:\Program Files\Hewlett-Packard\HP MediaSmart Server\MSSConnectorService.exe

C:\Program Files\Citrix\GoToMyPC\g2pre.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Citrix\GoToMyPC\g2tray.exe

C:\Program Files\Hewlett-Packard\HP MediaSmart Server\MediaCollectorClient.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Windows Home Server\WHSConnector.exe

C:\WINDOWS\system32\svchost.exe -k HPService

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\atiptaxx.exe

C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe

C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe

C:\WINDOWS\MXOALDR.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe

C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE

C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\rundll32.exe

C:\Program Files\Windows Home Server\WHSTrayApp.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/webhp?rls=ig

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = 127.0.0.1;*.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll

BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\TmIEPlg.dll

BHO: BrowserHelper Class: {9a065c65-4ee7-4ddd-9918-f129089a894a} - c:\program files\windows home server\WHSDeskBands.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll

BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll

BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - c:\program files\trend micro\amsp\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: {fdd3b846-8d59-4ffb-8758-209b6ad74acc} - c:\program files\microsoft money\system\mnyviewer.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll

TB: Home Server Banner: {d73e76a3-f902-45bd-8fc8-95ae8e014671} - c:\program files\windows home server\WHSDeskBands.dll

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll

EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

EB: MoneySide: {9404901d-06da-4b23-a0ee-3ea4f64ec9b3} - c:\program files\microsoft money\system\mnyviewer.dll

uRun: [ATI Launchpad]

uRun: [ATIRmtWndr] c:\program files\ati multimedia\remctrl\ATIX10.exe

uRun: [ ]

uRun: [ATI Scheduler] c:\program files\ati multimedia\main\ATISched.EXE

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [ATIModeChange] Ati2mdxx.exe

mRun: [AtiPTA] atiptaxx.exe

mRun: [MaxtorOneTouch] c:\program files\maxtor\onetouch\utils\Onetouch.exe

mRun: [hpbdfawep] c:\program files\hp\dfawep\bin\hpbdfawep.exe 1

mRun: [MXOBG] c:\windows\MXOALDR.EXE

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [Nuance PDF Converter 6-reminder] "c:\program files\nuance\pdf converter 6\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\pdf converter 6\ereg\Ereg.ini"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Trend Micro Titanium] c:\program files\trend micro\titanium\uiframework\uiWinMgr.exe -set Silent "1" SplashURL ""

mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Trend Micro Client Framework] "c:\program files\trend micro\uniclient\uifrmwrk\UIWatchDog.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\docume~1\scott\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

StartupFolder: c:\docume~1\scott\startm~1\programs\startup\weprin~1.lnk - c:\program files\weprint\WePrint Server.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\windows\installer\{21e49794-7c13-4e84-8659-55bd378267d5}\WHSTrayApp.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {44226DFF-747E-4edc-B30C-78752E50CD0C} - {44226DFF-747E-4edc-B30C-78752E50CD0C} - c:\program files\ati multimedia\tv\EXPLBAR.DLL

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} - c:\program files\microsoft money\system\mnyviewer.dll

Trusted Zone: musicmatch.com\online

DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB

DPF: {00000161-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/msaudio.cab

DPF: {26B2A5DA-BFD6-422F-A89A-28A54C74B12B} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_4/PhotoCenter_ActiveX_Control.cab

DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab

DPF: {33363249-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/i263_32.cab

DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

DPF: {41F17733-B041-4099-A042-B518BB6A408C} - hxxp://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_5/PhotoCenter_ActiveX_Control.cab

DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: DhcpNameServer = 68.87.76.182 68.87.78.134

TCP: Interfaces\{2132F9E7-EF73-4F8F-8FF4-6E4376F906A9} : DhcpNameServer = 68.87.76.182 68.87.78.134

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - c:\program files\trend micro\amsp\module\20002\6.5.1234\6.5.1234\TmBpIe32.dll

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1079\TmIEPlg.dll

Notify: GoToMyPC - c:\program files\citrix\gotomypc\G2WinLogon.dll

.

============= SERVICES / DRIVERS ===============

.

R2 Amsp;Trend Micro Solution Platform;c:\program files\trend micro\amsp\coreServiceShell.exe [2011-5-17 188272]

R2 HPMSSConnectorSvc;HPMSSConnectorService;c:\program files\hewlett-packard\hp mediasmart server\MSSConnectorService.exe [2009-10-5 20992]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-12 366640]

R2 MediaCollectorService;MediaCollectorService;c:\program files\hewlett-packard\hp mediasmart server\MediaCollectorClient.exe [2009-10-5 81920]

R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2011-5-17 64080]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-1-16 24652]

R2 WHSConnector;Windows Home Server Connector Service;c:\program files\windows home server\WHSConnector.exe [2011-1-10 376688]

R3 BackupReader;BackupReader;c:\windows\system32\drivers\BackupReader.sys [2009-10-7 44776]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-6-12 22712]

R3 tbcspud;Santa Cruz Driver;c:\windows\system32\drivers\tbcspud.sys [1979-12-31 144768]

R3 tbcwdm;Santa Cruz WDM Driver;c:\windows\system32\drivers\tbcwdm.sys [1979-12-31 545088]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-3 135664]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-3 135664]

S3 iaudUSB;Intel Audio Player;c:\windows\system32\drivers\iAudUSB.sys [2003-10-12 13877]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-12 39984]

S3 vtdg46xx;vtdg46xx;c:\progra~1\turtle~1\santac~1\contro~1\vtdg46xx.sys [2003-1-2 19232]

.

=============== Created Last 30 ================

.

2011-06-12 20:14:35 -------- d-----w- c:\documents and settings\scott\application data\Malwarebytes

2011-06-12 20:14:06 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-12 20:14:03 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-06-12 20:13:57 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-12 20:13:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-06-07 00:31:59 388096 ----a-r- c:\documents and settings\scott\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe

2011-05-18 02:28:20 92112 ----a-w- c:\windows\system32\drivers\tmtdi.sys

2011-05-18 02:27:59 80464 ----a-w- c:\windows\system32\drivers\tmactmon.sys

2011-05-18 02:27:59 64080 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys

2011-05-18 02:27:59 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys

.

==================== Find3M  ====================

.

2002-08-29 11:00:00 94784 --sh--w- c:\windows\TWAIN.DLL

2008-04-14 00:12:07 50688 --sh--w- c:\windows\twain_32.dll

2008-04-14 00:12:01 57344 --sh--w- c:\windows\system32\msvcirt.dll

2008-04-14 00:12:01 413696 --sha-w- c:\windows\system32\msvcp60.dll

2008-04-14 00:12:01 343040 --sha-w- c:\windows\system32\msvcrt.dll

2008-04-14 00:12:02 551936 --sh--w- c:\windows\system32\oleaut32.dll

2008-04-14 00:12:02 84992 --sha-w- c:\windows\system32\olepro32.dll

2008-04-14 00:12:32 11776 --sh--w- c:\windows\system32\regsvr32.exe

.

============= FINISH: 14:41:41.50 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-06-12.02)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 1/11/2003 11:01:49 AM

System Uptime: 6/12/2011 2:18:01 PM (0 hours ago)

.

Motherboard: Dell Computer Corp. |  |      

Processor:               Intel(R) Pentium(R) 4 CPU 2.40GHz | Microprocessor | 2386/533mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 112 GiB total, 1.807 GiB free.

D: is CDROM ()

E: is CDROM ()

P: is NetworkDisk (NTFS) - 912 GiB total, 853.77 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318}

Description: HP LaserJet P3005

Device ID: ROOT\MULTIFUNCTION\0000

Manufacturer: Hewlett-Packard

Name: HP LaserJet P3005

PNP Device ID: ROOT\MULTIFUNCTION\0000

Service:

.

Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318}

Description: Officejet Pro L7600

Device ID: ROOT\MULTIFUNCTION\0001

Manufacturer: HP

Name: Officejet Pro L7600

PNP Device ID: ROOT\MULTIFUNCTION\0001

Service:

.

Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}

Description: Officejet Pro L7600

Device ID: ROOT\PRINTER\0000

Manufacturer: HP

Name: Officejet Pro L7600

PNP Device ID: ROOT\PRINTER\0000

Service:

.

==== System Restore Points ===================

.

RP1771: 3/14/2011 7:36:21 PM - System Checkpoint

RP1772: 3/15/2011 8:16:31 PM - System Checkpoint

RP1773: 3/17/2011 10:42:49 AM - System Checkpoint

RP1774: 3/18/2011 3:00:23 AM - Software Distribution Service 3.0

RP1775: 3/19/2011 3:26:18 AM - System Checkpoint

RP1776: 3/20/2011 4:26:14 AM - System Checkpoint

RP1777: 3/21/2011 5:26:10 AM - System Checkpoint

RP1778: 3/22/2011 6:26:09 AM - System Checkpoint

RP1779: 3/23/2011 7:26:09 AM - System Checkpoint

RP1780: 3/24/2011 3:00:18 AM - Software Distribution Service 3.0

RP1781: 3/25/2011 3:26:09 AM - System Checkpoint

RP1782: 3/26/2011 4:26:09 AM - System Checkpoint

RP1783: 3/27/2011 5:26:10 AM - System Checkpoint

RP1784: 3/28/2011 6:26:01 AM - System Checkpoint

RP1785: 3/29/2011 7:26:01 AM - System Checkpoint

RP1786: 3/30/2011 8:26:01 AM - System Checkpoint

RP1787: 3/31/2011 9:26:01 AM - System Checkpoint

RP1788: 4/1/2011 10:26:02 AM - System Checkpoint

RP1789: 4/2/2011 11:26:01 AM - System Checkpoint

RP1790: 4/3/2011 12:26:01 PM - System Checkpoint

RP1791: 4/4/2011 1:26:01 PM - System Checkpoint

RP1792: 4/5/2011 2:26:01 PM - System Checkpoint

RP1793: 4/6/2011 3:26:01 PM - System Checkpoint

RP1794: 4/7/2011 4:26:07 PM - System Checkpoint

RP1795: 4/9/2011 5:52:31 PM - System Checkpoint

RP1796: 4/10/2011 6:43:02 PM - System Checkpoint

RP1797: 4/11/2011 7:43:01 PM - System Checkpoint

RP1798: 4/12/2011 8:43:01 PM - System Checkpoint

RP1799: 4/13/2011 9:43:01 PM - System Checkpoint

RP1800: 4/14/2011 3:00:19 AM - Software Distribution Service 3.0

RP1801: 4/15/2011 3:43:04 AM - System Checkpoint

RP1802: 4/16/2011 3:47:34 AM - System Checkpoint

RP1803: 4/17/2011 4:47:22 AM - System Checkpoint

RP1804: 4/18/2011 3:00:22 AM - Software Distribution Service 3.0

RP1805: 4/18/2011 8:04:02 PM - Software Distribution Service 3.0

RP1806: 4/19/2011 9:40:35 PM - System Checkpoint

RP1807: 4/20/2011 10:25:39 PM - System Checkpoint

RP1808: 4/21/2011 11:25:41 PM - System Checkpoint

RP1809: 4/23/2011 12:25:40 AM - System Checkpoint

RP1810: 4/24/2011 1:25:40 AM - System Checkpoint

RP1811: 4/25/2011 2:25:35 AM - System Checkpoint

RP1812: 4/26/2011 3:25:35 AM - System Checkpoint

RP1813: 4/27/2011 3:00:18 AM - Software Distribution Service 3.0

RP1814: 4/28/2011 3:25:35 AM - System Checkpoint

RP1815: 4/29/2011 4:25:35 AM - System Checkpoint

RP1816: 4/30/2011 5:25:35 AM - System Checkpoint

RP1817: 5/1/2011 6:25:35 AM - System Checkpoint

RP1818: 5/2/2011 7:25:32 AM - System Checkpoint

RP1819: 5/3/2011 8:25:28 AM - System Checkpoint

RP1820: 5/4/2011 9:25:27 AM - System Checkpoint

RP1821: 5/8/2011 3:02:08 PM - System Checkpoint

RP1822: 5/9/2011 3:50:23 PM - System Checkpoint

RP1823: 5/10/2011 4:50:24 PM - System Checkpoint

RP1824: 5/11/2011 5:50:25 PM - System Checkpoint

RP1825: 5/12/2011 3:00:19 AM - Software Distribution Service 3.0

RP1826: 5/13/2011 3:50:23 AM - System Checkpoint

RP1827: 5/14/2011 4:50:23 AM - System Checkpoint

RP1828: 5/15/2011 5:50:27 AM - System Checkpoint

RP1829: 5/17/2011 7:40:47 PM - Installed Java(TM) 6 Update 24

RP1830: 5/22/2011 2:08:02 PM - System Checkpoint

RP1831: 5/23/2011 2:23:23 PM - System Checkpoint

RP1832: 5/24/2011 2:47:12 PM - System Checkpoint

RP1833: 5/25/2011 3:47:17 PM - System Checkpoint

RP1834: 5/26/2011 4:45:35 PM - System Checkpoint

RP1835: 5/27/2011 4:47:16 PM - System Checkpoint

RP1836: 5/28/2011 5:47:17 PM - System Checkpoint

RP1837: 5/31/2011 12:55:14 PM - System Checkpoint

RP1838: 6/1/2011 1:23:31 PM - System Checkpoint

RP1839: 6/2/2011 2:23:29 PM - System Checkpoint

RP1840: 6/3/2011 3:23:29 PM - System Checkpoint

RP1841: 6/5/2011 9:10:51 PM - System Checkpoint

RP1842: 6/6/2011 5:31:55 PM - Installed HiJackThis

RP1843: 6/7/2011 6:18:09 PM - System Checkpoint

RP1844: 6/8/2011 7:18:13 PM - System Checkpoint

RP1845: 6/9/2011 8:18:15 PM - System Checkpoint

RP1846: 6/10/2011 9:18:09 PM - System Checkpoint

RP1847: 6/11/2011 10:18:10 PM - System Checkpoint

.

==== Installed Programs ======================

.

.

32 Bit HP CIO Components Installer

Ad-aware 6 Personal

Adobe Acrobat 4.0

Adobe Acrobat 6.0 Professional

Adobe AIR

Adobe Download Manager 2.0 (Remove Only)

Adobe Flash Player 10 ActiveX

Adobe Photoshop Album 2.0 Starter Edition

Adobe Reader 7.0

America Online

AOL Coach Version 1.0(Build:20011028.1)

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ATI Display Driver

ATI Multimedia Center 7.6.0.0

ATI Remote Wonder

BCM V.92 56K Modem

Bonjour

BPD_HPSU

BPD_Scan

BPDSoftware

BPDSoftware_Ini

BufferChm

Calendar Creator 10

CameraDrivers

CCleaner (remove only)

Classic PhoneTools

CP_Package_Variety1

CP_Package_Variety2

CP_Package_Variety3

CustomerResearchQFolder

Dell Modem-On-Hold

Dell Picture Studio - Dell Image Expert

Dell Solution Center

Dell Support 5.0.0 (766)

Destinations

Digital Line Detect

DocProc

DocProcQFolder

DVDSentry

Easy CD Creator 5 Basic

Fax

first tuesday Forms-on-CD

Google Earth

Google Toolbar for Internet Explorer

Google Update Helper

Google Updater

GoToMyPC

GUIDE PLUS+(TM) for Windows® System - ATI

Help and Support Customization

HiJackThis

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

HP Care Pack Core

HP Care Pack Products

HP Customer Participation Program 8.0

HP Imaging Device Functions 8.0

hp instant support

HP LaserJet P3005

HP MediaSmart Server 3.0 Update 1

HP OCR Software 8.0

HP Officejet Pro All-In-One Series

HP Photo Printing Software

HP Photosmart 330,380,420,470,7800,8000,8200 Series

HP Photosmart Essential

HP Share-to-Web

HP Solution Center 8.0

HP Update

HPProductAssistant

HPSSupply

HydraVision

ID3man 3.0

Indeo® XP Software

Intel Pocket Concert Audio Player

Intel(R) PRO Ethernet Adapter and Software

Intel(R) PROSet II

iPod for Windows 2005-10-12

iPod for Windows User Guide

iPod System Software Updater 2.0.1

iPod System Software Updater 2.1

iPod Update 2004-04-28

iPod Updater 2004-11-15

iRiver Manager

iTunes

Java Auto Updater

Java(TM) 6 Update 24

Java(TM) 6 Update 7

Kazaa Media Desktop 2.1.1

L7600

Macromedia Flash Player

Malwarebytes' Anti-Malware version 1.51.0.1200

MarketResearch

Maxtor OneTouch

Microsoft .NET Framework (English)

Microsoft .NET Framework (English) v1.0.3705

Microsoft .NET Framework 1.0 Hotfix (KB928367)

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2416447)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Interactive Training

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft Money 2002

Microsoft Money 2002 System Pack

Microsoft Office XP Media Content

Microsoft Office XP Small Business

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Web Publishing Wizard 1.52

MobileMe Control Panel

Modem Helper

MPM

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6 Service Pack 2 (KB973686)

MUSICMATCH iPod Plug-in

Musicmatch® Jukebox

MyDVD

NetDeviceManager

OpenOffice.org 3.2

Paint Shop Pro 7

PowerDVD

ProductContext

PS470

PSPrinters08

PSTAPlugin

QuickBooks Pro 2005

Quicken 2005

QuickTime

RealPlayer

Retrospect Express HD 1.0

Roxio VideoWave Movie Creator

Safari

Santa Cruz

Scan

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Step By Step Interactive Training (KB898458)

Security Update for Step By Step Interactive Training (KB923723)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player (KB979402)

Security Update for Windows Media Player 6.4 (KB925398)

Security Update for Windows Media Player 9 (KB911565)

Security Update for Windows Media Player 9 (KB917734)

Security Update for Windows Media Player 9 (KB936782)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360131)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2416400)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2482017)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923689)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950759)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951376)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953838)

Security Update for Windows XP (KB953839)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956390)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958215)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960714)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB963027)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969897)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972260)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974455)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB976325)

Security Update for Windows XP (KB977165)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981349)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982381)

Security Update for Windows XP (KB982665)

Shutterfly Express Uploader

SkyCaddie Desktop

SolutionCenter

Status

Toolbox

TrayApp

Trend Micro Titanium Internet Security

Trend Micro™ Titanium™ Internet Security

tunebite 2.1.1.3

Unload

UnloadSupport

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 8 (KB2447568)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB951072-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

Update for Windows XP (KB976749)

Update for Windows XP (KB978207)

Update for Windows XP (KB980182)

USB Storage Adapter FX (MXO)

Viewpoint Manager (Remove Only)

Viewpoint Media Player (Remove Only)

Vim 7.3 (self-installing)

WebFldrs XP

WebReg

WePrint

Windows Home Server Connector

Windows Imaging Component

Windows Internet Explorer 8

Windows Media Format Runtime

Windows XP Service Pack 3

WordPerfect Office 12

Yahoo! Detect

.

==== Event Viewer Messages From Past Week ========

.

6/8/2011 9:25:31 AM, error: DCOM [10005]  - DCOM got error "%1058" attempting to start the service HP Port Resolver with arguments "-Service" in order to run the server: {5A5AA0AA-1DEB-4683-96B0-B43301E83971}

6/8/2011 6:52:27 AM, error: Disk [11]  - The driver detected a controller error on \Device\Harddisk1\D.

.

==== End Of File ===========================

Hi,

That confirms that the system is indeed infected. Before we go any further, we need to check for Rootkits.

Please Disable all Anti-virus/Anti-Spyware/FireWall on your machine(instructions via links below)

• Anti Virus
• Anti Spyware
• Firewall

Next, download this Antirootkit Program to a folder that you create such as C:\ARK, by choosing the "Download EXE" button on the webpage.

  Then please perform a rootkit scan:

• Double-click the randomly name EXE located in the C:\ARK folder that you just downloaded to launch it
• When the program opens, it will automatically initiate a very fast scan of common rootkit hiding places.
• When the "quick" scan is finished (a few seconds), click the Rootkit/Malware tab,and then select the Scan button.
• Leave your system completely idle while this longer scan is in progress.
• When the scan is done, save the scan log to the Windows clipboard
• Open Notepad or a similar text editor
• Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
• Exit the Program
• Save the Scan log as ARK.txt and post it in your next reply.
• Now, re-enable the active protection component of any antivirus/antimalware programs you disabled before performing the scan.

If the ARK tool crashes your machine or causes a Blue Screen error, please post the log results from the first inital quick scan,this can be saved in the same way as the full scan in the above instructions.

Please post back the ARK log, if it is too long for one post, please use as many posts as needed.

Thanks.

Yes I am, sorry for the delay, I don't have a lot of time during the week. I am running the scan now.

Thanks again

Hi,

Are you still in need of assistance?

Thanks

Hi,

No, running it a third time would be futile.

Please make sure all active protection is disabled and then please run this next tool. <---NOTE: It is imperative that ALL Security is disabled for these tools to work correctly.

• Please download Rootkit Unhooker and save it to your desktop.
  
• Double-click RKUnhookerLE.exe to run it.
• Click the Report tab, then click Scan
• Check Drivers, Stealth Code, Files, and Code Hooks
• Uncheck the rest, then click OK
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
• Wait till the scanner has finished then go File > Save Report
• Save the report somewhere you can find it. Click Close
• This log may be very large so use multiple posts if need be.

Note** you may get the following warning. It is ok, just ignore it.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Please post the RKU log back for review.

Thanks

This topic is Inactive.....

The fixes in this topic were written specifically for this user, following them may cause harm to your machine and render it a brick (useless)

If you are the original poster and would like further assistance please post a fresh HJT log in a NEW topic along with details of the problems you are having.

All other user's, please read THIS page and then please start a New Topic at the top of the Malware Removal Forum by clicking the button.