Hi Tony,

Yep this is a real nasty piece of work, it does bring in a considerable amount of malware. Delete the re-named version of CF from the Desktop. Reboot into Safemode with Networking.

To do this, re-boot and continuously tap the F8 key until you see the Advanced Windows menu screen. You will see several options, select Safe mode with networking. Follow the prompts, when you have a stable Desktop download Combofix from any of the following links:

Link 1
Link 2

Don`t forget Combofix must be saved to your desktop. <--Very important

Ensure you have disabled your Firewall and all anti virus and anti malware programs so they do not interfere with the running of ComboFix. <---Very important

Please include the C:\ComboFix.txt in your next reply for further review.

Examples of how to disable realtime protection available at the following link :-

Disable realtime protection

Note:  Do not click combofix's window with your mouse while it's running. That action may cause it to stall.

*EXTRA NOTES*

• 
     
• If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
     
• If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
     
• If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)
  

Be aware, because you are running in Safe mode if CF forces a re-boot you must be there to tap F8 key to get into Safe mode again, bit of a pain but necessary.

Post the log in your reply

Kevin

Kevin

Hi Kevin,

I have to go now - been up since 6am. We'll pick this up again in the morning.

Thanks again for all your help.

Tony

Hi Kevin,

I booted into safe mode and Combofix started up immediately, ran and produced the report below. I let it run even though it's not a new downloaded copy as you instructed. Should I start over and run a completely new copy or is this one OK?

Tony

ComboFix 10-09-30.05 - Administrator 01/10/2010 22:09:11.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2573 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\zfh.exe
AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Application Data\Idan
c:\documents and settings\Administrator\Application Data\Idan\mokul.exe
c:\documents and settings\Administrator\Application Data\Ynylet
c:\documents and settings\Administrator\Application Data\Ynylet\xafo.exe
c:\documents and settings\Administrator\GoToAssistDownloadHelper.exe
C:\Thumbs.db
c:\windows\run.log
c:\windows\system32\sfcfiles.dat

.
((((((((((((((((((((((((( Files Created from 2010-09-02 to 2010-10-02 )))))))))))))))))))))))))))))))
.

2010-10-01 20:42 . 2010-10-01 20:43 -------- d-----w- C:\Gotcha
2010-10-01 20:27 . 2010-10-01 20:33 -------- d-----w- C:\32788R22FWJFW.1.tmp
2010-10-01 18:44 . 2010-10-01 18:46 -------- d-----w- C:\32788R22FWJFW.0.tmp
2010-10-01 16:46 . 2010-10-01 16:46 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\MicroVision Applications
2010-09-29 10:43 . 2010-09-29 10:43 2206006444 ----a-w- C:\Ingela.zip
2010-09-27 21:28 . 2010-09-27 21:28 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help
2010-09-27 21:28 . 2010-09-27 21:28 24416 ----a-w- c:\windows\system32\drivers\regguard.sys
2010-09-27 21:25 . 2010-09-27 21:25 2 --shatr- c:\windows\winstart.bat
2010-09-27 21:24 . 2010-09-27 21:24 37600 ----a-w- c:\windows\system32\Partizan.exe
2010-09-27 21:24 . 2010-09-27 21:24 35816 ----a-w- c:\windows\system32\drivers\Partizan.sys
2010-09-24 20:31 . 2010-09-24 20:32 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-09-20 16:21 . 2010-09-20 16:21 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-09-18 10:30 . 2010-09-18 10:30 57940 ---ha-w- c:\windows\system32\mlfcache.dat
2010-09-16 07:47 . 2010-09-16 07:49 -------- d-----w- c:\program files\QuickTime
2010-09-16 07:46 . 2010-09-16 07:46 -------- d-----w- c:\program files\Safari
2010-09-16 07:44 . 2010-09-16 07:44 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.18.5\SetupAdmin.exe
2010-09-16 07:43 . 2010-09-16 07:44 -------- d-----w- c:\program files\iTunes
2010-09-16 07:43 . 2010-09-16 07:44 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-09-16 07:38 . 2010-09-16 07:38 -------- d-----w- c:\program files\Bonjour
2010-09-16 07:36 . 2010-09-16 07:36 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-01 12:02 . 2009-08-08 15:54 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-10-01 11:58 . 2006-05-27 10:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\Cyiq
2010-09-29 16:19 . 2008-03-28 09:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\Afkuc
2010-09-18 10:28 . 2008-08-16 11:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\Apple Computer
2010-09-16 07:55 . 2008-09-07 07:50 -------- d-----w- c:\program files\Apple Software Update
2010-09-16 07:43 . 2008-08-16 10:58 -------- d-----w- c:\program files\iPod
2010-09-16 07:43 . 2008-09-07 07:50 -------- d-----w- c:\program files\Common Files\Apple
2010-09-14 17:23 . 2010-04-21 16:56 -------- d-----w- c:\program files\Common Files\TerraTec
2010-09-12 07:24 . 2009-06-22 19:57 -------- d-----w- c:\program files\Opera 10 Beta
2010-09-05 13:32 . 2008-08-28 13:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\ZoomBrowser EX
2010-09-05 13:32 . 2008-08-28 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\ZoomBrowser
2010-09-05 13:14 . 2008-08-06 21:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Dell
2010-08-24 13:58 . 2008-08-06 20:58 -------- d-----w- c:\program files\McAfee.com
2010-08-24 13:57 . 2010-08-23 17:24 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-08-24 13:57 . 2010-08-23 17:24 95600 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-08-24 13:57 . 2010-08-23 17:24 88544 ----a-w- c:\windows\system32\drivers\mfendisk.sys
2010-08-24 13:57 . 2010-08-23 17:24 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2010-08-24 13:57 . 2010-08-23 17:24 84072 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys
2010-08-24 13:57 . 2010-08-23 17:24 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys
2010-08-24 13:57 . 2010-08-23 17:24 312904 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2010-08-24 13:57 . 2008-08-06 20:58 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2010-08-24 13:57 . 2008-08-06 20:58 152992 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-08-24 13:57 . 2008-08-06 20:58 386712 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2010-08-23 21:54 . 2008-08-06 20:57 -------- d-----w- c:\program files\McAfee
2010-08-23 21:54 . 2008-08-06 20:58 -------- d-----w- c:\program files\Common Files\McAfee
2010-08-17 18:10 . 2010-09-01 02:37 372736 ------w- c:\documents and settings\All Users\Application Data\Dell\DSL\DSLCheck.exe
2010-08-17 13:17 . 2004-08-11 16:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-05 21:12 . 2008-08-06 20:51 -------- d-----w- c:\program files\Common Files\Java
2010-08-05 21:12 . 2008-08-06 20:51 -------- d-----w- c:\program files\Java
2010-08-04 13:52 . 2010-08-04 13:52 61440 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4f257f6f-n\decora-sse.dll
2010-08-04 13:52 . 2010-08-04 13:52 503808 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5f7810d4-n\msvcp71.dll
2010-08-04 13:52 . 2010-08-04 13:52 499712 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5f7810d4-n\jmc.dll
2010-08-04 13:52 . 2010-08-04 13:52 348160 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-5f7810d4-n\msvcr71.dll
2010-08-04 13:52 . 2010-08-04 13:52 12800 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4f257f6f-n\decora-d3d.dll
2010-07-27 17:44 . 2010-07-27 17:44 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 17:44 . 2010-07-27 17:44 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-07-27 17:44 . 2010-07-27 17:44 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-07-22 15:49 . 2004-08-11 16:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-05-30 18:26 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-17 04:00 . 2010-05-06 22:03 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-09 14:26 . 2010-09-01 02:38 475136 ----a-w- c:\documents and settings\All Users\Application Data\Dell\RMC\RMCCreationInfo.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-06 68856]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-02-25 135664]
"Remote Control Editor"="c:\program files\Common Files\TerraTec\Remote\TTTVRC.exe" [2010-06-09 1689088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-09 8523776]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-31 16860672]
"PMX Daemon"="ICO.EXE" [2006-11-08 49152]
"8169Diag"="c:\program files\Realtek\Diagnostics Utility\8169Diag.exe" [2008-02-26 909312]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-20 30192]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-28 17920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-15 524632]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-06-30 1193848]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-4-14 596584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-08-21 14:21 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0Partizan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera 10 Beta\\opera.exe"=
"c:\\Program Files\\TerraTec\\TerraTec Home Cinema\\tvtvSetup\\tvtv_Wizard.exe"=
"c:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvr.exe"=
"c:\\Program Files\\TerraTec\\TerraTec Home Cinema\\VersionCheck\\VersionCheck.exe"=
"c:\\Program Files\\TerraTec\\TerraTec Home Cinema\\ChannelEditor\\CinergyDvrChannelEditor.exe"=
"c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
"c:\\Program Files\\TerraTec\\TerraTec Home Cinema\\InstTool.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [30/05/2009 20:37 64160]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [23/08/2010 18:24 84072]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [23/08/2010 18:24 271480]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [23/08/2010 18:24 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [23/08/2010 18:24 141792]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [23/08/2010 18:24 312904]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [23/08/2010 18:24 88544]
S2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\drivers\LANPkt.sys [06/08/2008 21:55 8960]
S2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [23/08/2010 18:24 271480]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [23/08/2010 18:24 55840]
S3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [06/08/2008 21:55 11264]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [06/08/2008 21:56 30192]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 1029456]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [23/08/2010 18:24 88544]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [23/08/2010 18:24 84264]
S3 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [27/09/2010 22:24 35816]
S3 pmxmouse;PMXMOUSE;c:\windows\system32\drivers\pmxmouse.sys [11/08/2008 14:23 18432]
S3 pmxusblf;PMXUSBLF;c:\windows\system32\drivers\pmxusblf.sys [11/08/2008 14:23 14336]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [27/09/2010 22:28 24416]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [06/08/2008 21:55 16640]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [07/03/2010 17:26 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [07/03/2010 17:26 85696]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [06/01/2010 20:42 135664]
.
Contents of the 'Scheduled Tasks' folder

2010-09-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 20:37]

2010-09-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 11:34]

2010-10-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-06 17:34]

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 19:42]

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 19:42]

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4154240400-2109932074-3037798612-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-11 19:47]

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4154240400-2109932074-3037798612-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-11 19:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://195.196.36.242/activex/AMC.cab
DPF: {FD0EBBED-0C42-4D0F-82DA-44399B5C420A} - hxxp://downloads.virginmedia.com/CST/ver1/xp_mail.cab
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-{A1EF8499-9AC3-D799-3D5C-89C1B5EEB649} - c:\documents and settings\Administrator\Application Data\Ynylet\xafo.exe
HKCU-Run-{AAFDDB40-E13D-5DD1-732D-41B4478CA122} - c:\documents and settings\Administrator\Application Data\Idan\mokul.exe
SafeBoot-klmdb.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-02 08:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8AD27C76]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74a0852
\Driver\iaStor -> iaStor.sys @ 0xf7b52002
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a
ParseProcedure -> ntoskrnl.exe @ 0x80578f7a
NDIS: Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xba75bbb0
PacketIndicateHandler -> NDIS.sys @ 0xba768a21
SendHandler -> NDIS.sys @ 0xba74687b
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-4154240400-2109932074-3037798612-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a6,ca,2f,51,18,8d,dd,49,96,3c,55,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a6,ca,2f,51,18,8d,dd,49,96,3c,55,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(976)
c:\windows\system32\WININET.dll
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll

- - - - - - - > 'lsass.exe'(1036)
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(1816)
c:\windows\system32\WININET.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\mcafee.com\agent\mcagent.exe
.
**************************************************************************
.
Completion time: 2010-10-02 09:02:30 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-02 08:02

Pre-Run: 294,111,879,168 bytes free
Post-Run: 298,456,702,976 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 21BF8B7DAFD886EBFDC9B23687EAED52

Hi Kevin,

That did take some time. Here are the logs:

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

 Saturday, October 2, 2010

 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)

 Kaspersky Online Scanner version: 7.0.26.13

 Last database update: Saturday, October 02, 2010 04:29:38

 Records in database: 4274019

--------------------------------------------------------------------------------

Scan settings:

scan using the following database: extended

Scan archives: yes

Scan e-mail databases: yes

Scan area - My Computer:

C:\

D:\

E:\

F:\

G:\

H:\

Scan statistics:

Objects scanned: 114896

Threats found: 6

Infected objects found: 12

Suspicious objects found: 0

Scan duration: 03:21:40

File name / Threat / Threats count

C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\0\10923d80-4f3c8d5c Infected: Exploit.Java.CVE-2008-5353.c 2

C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\26\41ede39a-4db7a13b Infected: Exploit.Java.CVE-2008-5353.e 4

C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\44\6751d9ec-5a961ce5 Infected: Exploit.Java.CVE-2008-5353.d 1

C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Idan\mokul.exe.vir Infected: Trojan-Spy.Win32.Zbot.apxr 1

C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\Ynylet\xafo.exe.vir Infected: Packed.Win32.Krap.ao 1

C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP620\A0089049.exe Infected: Trojan-Spy.Win32.Zbot.apxr 1

C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP620\A0089050.exe Infected: Packed.Win32.Krap.ao 1

C:\Tony\DVD region free stuff\DVD region killer v2.7.0.2.exe Infected: not-a-virus:AdWare.Win32.CommonName.af 1

Selected area has been scanned.

 Results of screen317's Security Check version 0.99.5  

 Windows XP Service Pack 3  

 Internet Explorer 8  

`````````````````````````````` 

Antivirus/Firewall Check: 

 Windows Firewall Disabled!  

 McAfee SecurityCenter     

 Antivirus up to date! (On Access scanning disabled!) 

``````````````````````````````` 

Anti-malware/Other Utilities Check: 

 Ad-Aware 

 Java(TM) 6 Update 21  

 Java(TM) 6 Update 5  

 Java(TM) 6 Update 7  

 Out of date Java installed! 

 Adobe Flash Player 10.1.82.76  

Adobe Reader 8.1.2 

Adobe Reader 8.1.2 Security Update 1 (KB403742) 

Out of date Adobe Reader installed! 

```````````````````````````````` 

Process Check:  

objlist.exe by Laurent 

 Ad-Aware AAWService.exe is disabled! 

 Ad-Aware AAWTray.exe is disabled! 

````````````````````````````````

DNS Vulnerability Check:

 GREAT! (Not vulnerable to DNS cache poisoning) 

``````````End of Log```````````` 

Tony

Hiya Tony,

Kaspersky online scan is very thorough and can take a considerable time to complete. I prefer it because it only identifies and doesn`t fix issues, that allows us to decide if an item is really malicious.Only one item to deal with from the log, the rest will go with our clean up procedure.

Proceed as follows please :-

Step 1

Please download OTM by OldTimer.
Alternative Mirror
Save it to your desktop.
Double click OTM.exe to start the tool.

• Copy the text between the dotted lines below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  -------------------------------------------------------------------
  
  :Processes
  
  :Files
  C:\Tony\DVD region free stuff\DVD region killer v2.7.0.2.exe
  ipconfig /flushdns /c
  :Commands
  [CreateRestorePoint]
  [EmptyFlash]
  [EmptyTemp]
  [Purity]
  [ResetHosts]
  [Reboot]
  
  ---------------------------------------------------------------------
  
• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

Step 2

Uninstall the following from Add/Remove Programs via the Control Panel

Java(TM) 6 Update 5
Java(TM) 6 Update 7
Adobe Reader 8.1.2 } If you need this version of Adobe reader do not uninstall
Adobe Reader 8.1.2 Security Update 1 (KB403742)

Step 3

Your Adobe Acrobat Reader is out of date. Older versions are vulnerable to attack.

Please go to the link below to update.

Adobe Reader Untick the Free McAfee® Security Scan Plus (optional) unless you want it.

Post log from OTM, also system review, improvements? issues?

Kevin

Sorry Kevin - didn't see your reply.

I'm going to delete Adobe Acrobat and replace it with Foxit. I've got Foxit on my PC and it's way faster. 

Regarding the "C:\Tony\DVD region free stuff\DVD region killer v2.7.0.2.exe" you are looking at. I downloaded it  years ago but never ran it. The DVD in our living room is multiregion so we never bothered. I really should have deleted it, which I'm happy to do now. Do you want me to still proceed with OTM?

BTW - when do you sleep?

Tony

Hi Kevin,

Just a quick system update, which I forgot to include in the last post:

PC shut down and started up normally for a change, - could be a lucky one off - but Kaspersky's TDSSKiller still finds the rootkit in the MBA. Also, still getting google redirects. McAffee update seems to work, although if it is - how come it's not finding anything on its scans?. Attempts to get to windows update fail - connection closed by remote server or can't open the page depending on which browser you use.  

Few of other issues that may, or may not be related:

Message window on windows start about Sony Ericsson suite failing to initialize.

Just before windows starts to boot a light blue screen flashes past with "regrun greatis antirootkit" splashed across the screen. It's been there before but has always flashed past too quick for me to see what it was saying. This time it was slow enough for me to catch some of it. 

There were no programs propagating in the "add/remove programs" window. I brought them back with REGSVR32 APPWIZ.CPL. Had this earlier in the week when I tried to remove some of those applications I had tried over the last week to clean up the infection.  Ran REGSVR32 APPWIZ.CPL to get them back but something hid them again. I think the "regrun greatis antirootkit" message may be a leftover from one of the applications I had to try and remove manually then.

Tony

Hiya Tony dont run anything for now, I need to go back over your thread. I did see something related to to a registry program, but thought it was something you had installed.  Uninstall the old Java and Adobe entries also delete that DVD file, it is infected.

I`ll give you a fix to run shortly..

Kevin.