PLS HELP~CANT REMOVE VIRUSES & NO SOUND IN IE7 (VISTA)

BullGuard Antivirus Forum > Virus Removal > Removal Help > PLS HELP~CANT REMOVE VIRUSES & NO SOUND IN IE7 (VISTA)

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

Priincessloren
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-19-2008 2:55 (GMT +1)

So many problems not too sure were to begin ...

Main problem is there is no sound in Internet Explorer (7)

i am running windows vista, and the sound stopped about 2 months after i had bought the laptop.

i have been trying to fix it for weeks so have tried all the obvious things so no need to tell me to check sound settings or MUTE!!! hehe

I have run a fair few anti-virus programs and have found LOTS of viruses and got rid of what i could.

there were trojans and adware stuff and tracking cookies ( which wont go away! lol)

What i cannot seem to get rid of either is Smitfraud-c which i have found all through different folders.

Also there is quite a few folders or items that i am pretty sure are components of the viruses or spyware or whatever it is, and it will not let me delete them!!

Also have found twain32 folders ect ect.

Any help you could give me i would reeaally apprieciate because i have been trying and not getting anywhere....

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13594

Posted 7-19-2008 5:57 (GMT +1)

Hello

Please download Malwarebytes' Anti-Malware:

http://www.besttechie.net/tools/mbam-setup.exe

to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.

At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch

Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded, select Perform full scan, then click Scan.

When the scan is complete, click OK, then Show Results to view the results.

Be sure that everything is checked, and click Remove Selected.

When completed, a log will open in Notepad. Please save it to a convenient location.

------------------------------------------------

Please download Combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

And save to the desktop.

Close all other browser windows.

Important-> Temporarily disable your anti-virus, real-time protection before performing a scan. They can interfere with combofix or remove some of its embedded files which may cause "unpredictable results".

Go to Start->Run and copy/paste: ComboFix /snapshot and hit OK. It should run Combofix.

Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

When finished, it will produce a logfile located at C:\combofix.txt.

Post the contents of that log in your next reply, with Malwarebytes' Anti-Malware log.

Please copy and paste your log files. DO NOT add it as an attachment

NB. If you are using any P2P (file sharing) programs, please remove them before we clean your computer.

We do not clean logs that have P2P applications installed as this can cause reinfection during your cleaning.

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Priincessloren
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-19-2008 8:18 (GMT +1)

is there another free program i can use instead of Malwarebytes because when i start the scan after a few minutes the whole thing freezes up and i have to retart the computer....

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13594

Posted 7-19-2008 9:23 (GMT +1)

Ok. Leave it for now, and post combofix log

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Priincessloren
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-19-2008 9:46 (GMT +1)

ComboFix 08-07-18.1 - lauren 2008-07-19 18:35:36.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1113 [GMT 10:00]
Running from: C:\Users\lauren\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active

((((((((((((((((((((((((( Files Created from 2008-06-19 to 2008-07-19 )))))))))))))))))))))))))))))))
.

2008-07-19 16:25 . 2008-07-19 16:25 <DIR> d-------- C:\Users\lauren\AppData\Roaming\Malwarebytes
2008-07-19 16:25 . 2008-07-19 16:25 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-07-19 16:25 . 2008-07-19 16:25 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-07-19 14:36 . 2008-07-19 15:25 <DIR> d-------- C:\Windows\System32\NtmsData
2008-07-19 11:22 . 2008-07-19 11:57 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-07-19 10:44 . 2008-07-19 16:47 <DIR> d-------- C:\Program Files\a-squared Free
2008-07-19 08:09 . 2008-07-19 08:09 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-07-19 08:09 . 2008-07-19 08:09 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com
2008-07-19 08:08 . 2008-07-19 08:08 <DIR> d-------- C:\Users\lauren\AppData\Roaming\SUPERAntiSpyware.com
2008-07-19 08:08 . 2008-07-19 08:08 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-07-19 08:07 . 2008-07-19 08:07 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-14 22:42 . 2008-07-14 23:01 <DIR> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-07-14 22:42 . 2008-07-14 23:01 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-07-14 22:42 . 2008-07-14 22:42 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-14 00:42 . 2008-07-14 00:42 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-07-13 19:23 . 2008-07-13 19:23 <DIR> d-------- C:\PerfLogs
2008-07-13 10:16 . 2008-07-13 10:16 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-07-12 12:42 . 2008-01-19 17:38 4,595,712 --a------ C:\Windows\System32\AuthFWSnapin.dll
2008-07-12 12:41 . 2008-01-19 17:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr
2008-07-12 12:40 . 2008-01-19 17:33 2,515,968 --a------ C:\Windows\System32\accessibilitycpl.dll
2008-07-12 12:39 . 2008-01-19 17:35 3,072,000 --a------ C:\Windows\System32\networkmap.dll
2008-07-12 12:38 . 2008-01-19 17:32 5,714,432 --a------ C:\Windows\System32\logon.scr
2008-07-12 12:37 . 2008-01-19 17:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-07-12 12:36 . 2008-01-19 16:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-07-12 12:31 . 2008-07-19 10:02 <DIR> d-------- C:\inetpub
2008-07-12 12:31 . 2008-01-19 17:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll
2008-07-12 12:30 . 2008-01-19 17:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll
2008-07-12 12:30 . 2008-01-19 17:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll
2008-07-12 12:29 . 2008-01-19 17:36 218,624 --a------ C:\Windows\System32\wdscore.dll
2008-07-12 12:29 . 2008-01-19 17:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe
2008-07-12 12:27 . 2008-01-19 17:34 305,152 --a------ C:\Windows\System32\msdelta.dll
2008-07-12 12:27 . 2008-01-19 17:34 258,560 --a------ C:\Windows\System32\dpx.dll
2008-07-12 12:27 . 2008-01-19 17:34 246,784 --a------ C:\Windows\System32\drvstore.dll
2008-07-12 12:27 . 2008-01-19 17:35 35,328 --a------ C:\Windows\System32\mspatcha.dll
2008-07-12 11:57 . 2008-07-12 12:11 <DIR> d-------- C:\Users\All Users\Apple Computer
2008-07-12 11:57 . 2008-07-12 12:11 <DIR> d-------- C:\ProgramData\Apple Computer
2008-07-12 11:57 . 2008-07-12 11:58 <DIR> d-------- C:\Program Files\QuickTime
2008-07-12 08:30 . 2008-07-12 08:44 <DIR> d-a------ C:\Users\All Users\TEMP
2008-07-12 08:30 . 2008-07-12 08:44 <DIR> d-a------ C:\ProgramData\TEMP
2008-07-12 08:30 . 2008-07-12 08:44 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-07-12 05:33 . 2008-07-13 05:03 <DIR> d-------- C:\d683ad99ec67326f197e32e116e9e7
2008-07-11 20:08 . 2008-07-11 20:08 <DIR> d-------- C:\Users\All Users\PC Drivers HeadQuarters
2008-07-11 20:08 . 2008-07-11 20:08 <DIR> d-------- C:\ProgramData\PC Drivers HeadQuarters
2008-07-02 05:28 . 2008-07-02 05:28 <DIR> d-------- C:\Users\lauren\AppData\Roaming\tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-19 06:46 --------- d-----w C:\Program Files\Roxio
2008-07-19 06:44 --------- d-----w C:\ProgramData\Roxio
2008-07-14 01:22 41,478 ----a-w C:\Users\lauren\AppData\Roaming\nvModes.dat
2008-07-13 09:41 --------- d-----w C:\ProgramData\NVIDIA
2008-07-13 09:39 174 --sha-w C:\Program Files\desktop.ini
2008-07-13 09:30 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-13 09:30 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-07-13 09:30 --------- d-----w C:\Program Files\Windows Mail
2008-07-13 09:30 --------- d-----w C:\Program Files\Windows Journal
2008-07-13 09:30 --------- d-----w C:\Program Files\Windows Collaboration
2008-07-13 09:30 --------- d-----w C:\Program Files\Windows Calendar
2008-07-13 09:29 --------- d-----w C:\Program Files\Windows Defender
2008-07-13 08:51 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-07-13 08:51 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-07-13 07:51 --------- d-----w C:\Program Files\CyberLink
2008-07-11 20:37 2,132 ----a-w C:\Users\lauren\AppData\Roaming\wklnhst.dat
2008-07-11 17:00 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-11 17:00 --------- d-----w C:\Program Files\Microsoft Works
2008-07-11 16:54 --------- d-----w C:\ProgramData\WLInstaller
2008-07-11 16:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-01 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-20 14:57 --------- d-----w C:\Program Files\McAfee
2008-05-28 06:34 --------- d-----w C:\Users\lauren\AppData\Roaming\DivX
2008-05-23 12:01 --------- d-----w C:\Program Files\LG PC Suite 2
2008-05-23 12:00 --------- d-----w C:\Users\lauren\AppData\Roaming\InstallShield
2008-05-23 11:53 --------- d-----w C:\Program Files\DivX
2008-05-23 11:53 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-05-23 11:47 --------- d-----w C:\Program Files\LG Electronics
2008-05-21 20:16 --------- d-----w C:\Program Files\Google
2008-05-21 19:08 --------- d-----w C:\Users\lauren\AppData\Roaming\PeerNetworking
2008-05-10 03:35 564,736 ----a-w C:\Windows\System32\emdmgmt.dll
2008-05-08 21:59 90,112 ----a-w C:\Windows\System32\wshext.dll
2008-05-08 21:59 430,080 ----a-w C:\Windows\System32\vbscript.dll
2008-05-08 21:59 180,224 ----a-w C:\Windows\System32\scrobj.dll
2008-05-08 21:59 172,032 ----a-w C:\Windows\System32\scrrun.dll
2008-05-08 21:59 155,648 ----a-w C:\Windows\System32\wscript.exe
2008-05-08 21:58 135,168 ----a-w C:\Windows\System32\cscript.exe
2008-04-29 03:54 181,760 ----a-w C:\Windows\System32\fsquirt.exe
2008-04-26 08:25 3,600,952 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-04-26 08:25 3,549,240 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-04-26 08:08 1,314,816 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:35 826,880 ----a-w C:\Windows\System32\wininet.dll
2008-04-23 04:42 428,544 ----a-w C:\Windows\System32\EncDec.dll
2008-04-23 04:42 293,376 ----a-w C:\Windows\System32\psisdecd.dll
2008-02-15 07:29 76 --sh--r C:\Windows\CT4CET.bin
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 17:33 125952]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 10:35 857648]
"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-12-03 15:58 36864]
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2008-02-15 17:21 77824]
"DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 18:43 118784]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 13:37 81920]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 13:22 221184]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-11-01 17:39 189736]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 11:24 16384]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 21:24 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 21:24 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 21:24 81920]
"NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2007-10-04 21:24 86016]
"PMX Daemon"="ICO.EXE" [2006-11-08 17:01 49152 C:\Windows\System32\ico.exe]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-03 19:55:50 703280]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-02-15 17:23:26 50688]
QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [2007-07-20 20:13:26 1180952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2B432BC6-B6CC-485F-A93F-796550789EA3}"= Profile=Private|Profile=Public|C:\Program Files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{4BA697C9-A723-44D1-AF26-A756AF70A7B7}"= C:\Program Files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect
"{539ED654-3D3A-4B7A-8FCB-92431B8F1F08}"= C:\Program Files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{8AA78A79-DD25-422F-A456-5F3C9B4DE90F}"= C:\Program Files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{97EA5DB8-517C-4E12-A5D4-223350AF59DC}"= C:\Program Files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{BD779145-8317-453F-AA33-F7F43E6AAA5C}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{69CD6F80-1064-4978-8EA1-67AB1DCF251D}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{DD5EDFFC-7EF5-4454-B174-FF98D4C7DEF8}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{CB060796-AC6B-4EF7-953C-A591851F2085}"= UDP:C:\Program Files\ACSPMonitor\ASMonitor.exe:System
"{837DBE92-0725-4ADC-AB82-FF45593EF6D6}"= TCP:C:\Program Files\ACSPMonitor\ASMonitor.exe:System
"{10F985A6-40BC-47D5-AADA-C0D9C5F53C34}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{DDAAF779-477C-4EA2-93A2-5160B8304DFE}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{A36ED743-0630-40DA-B84C-7E416F9AB485}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{45A1C5D8-7FD7-4369-9F70-653627441D48}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{004B9420-81BB-4FA5-AF5E-27CC577DBE3C}C:\\program files\\worldpokertour\\ua.exe"= UDP:C:\program files\worldpokertour\ua.exe:UA Application
"UDP Query User{190D157B-3391-49FC-9D9C-F142B6D13F9E}C:\\program files\\worldpokertour\\ua.exe"= TCP:C:\program files\worldpokertour\ua.exe:UA Application
"TCP Query User{0A111145-9AB6-4471-B93D-5541A625FEC4}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B5AD5804-6FF7-4FC3-BF3D-6418D745BC2B}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{E8A86FBE-EDEB-4C6C-9616-130AC310E3C9}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

R2 AESTFilters;Andrea ST Filters Service;C:\Windows\system32\aestsrv.exe [2007-08-30 07:25]
R3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2006-11-07 11:37]
R3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2006-11-07 09:13]
R3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2006-11-07 09:13]
R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-12-03 15:58]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-12-03 15:59]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
rsmsvcs REG_MULTI_SZ ntmssvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9bfc74cb-50be-11dd-aaa4-001d09c5b049}]
\shell\AutoRun\command - F:\Secret_Party_Bris.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dad1cfcf-2d5a-11dd-b36f-001d09c5b049}]
\shell\AutoRun\command - F:\no.com
\shell\explore\Command - F:\no.com
\shell\open\Command - F:\no.com

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2008-07-14 15:00:00 C:\Windows\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-06-30 15:00:00 C:\Windows\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
"2008-07-19 07:14:43 C:\Windows\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Ad-Watch - C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
HKLM-Run-AAWTray - C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
HKLM-Explorer_Run-application - C:\Program Files\ACSPMonitor\ASMonitor.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-19 18:39:45
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2008-07-19 18:42:18
ComboFix-quarantined-files.txt 2008-07-19 08:41:13

Pre-Run: 174,615,781,376 bytes free
Post-Run: 174,614,605,824 bytes free

208 --- E O F --- 2008-07-18 08:59:47

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13594

Posted 7-19-2008 10:40 (GMT +1)

Looks clean. How are things running ?

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Priincessloren
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-19-2008 11:02 (GMT +1)

NOT GOOD!!

stil no sound in internet explorer, although it plays just fine in media player ect.

there is smitfraud-c virus files all through the computer, when i do a random search, for example, in the drivers folder they are scattered all through! how do i get rid of them. and only other problem is internet explorer freezes up and takes a minute or so to go back to normal!!!!!!!!!

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13594

Posted 7-19-2008 11:15 (GMT +1)

Ok. You´ll need to scan for smitfraud infection then ;-)

Please download http://siri.urz.free.fr/Fix/SmitfraudFix.exe (by S!Ri)

If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (normally C:), and launch from there.

Please print out or copy this page to Notepad as you will be in Safe Mode and unable to refer to this page.

Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)

Double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, normally C:\rapport.txt

Post a fresh hijackthis log with rapport txt, and tell how your computer are behaving

+++++++++++++++++++++++++++++++++++++++++++++++++++++++

process.exe is detected by some antivirus programs as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert .

NB. If you can run Malwarebytes' Anti-Malware from safe mode, please do, and post that log as well

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Priincessloren
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-20-2008 7:33 (GMT +1)

SmitFraudFix v2.329

Scan done at 20:39:38.32, Sat 19/07/2008
Run from C:\Users\lauren\SmitfraudFix
OS: Microsoft Windows [Version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
::1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{16C5F245-FC87-4415-8BB5-257D67D90D1A}: DhcpNameServer=10.1.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{2DDA6F50-D8C4-44AD-8DBE-DCBD6B3D4DCD}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{16C5F245-FC87-4415-8BB5-257D67D90D1A}: DhcpNameServer=10.1.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2DDA6F50-D8C4-44AD-8DBE-DCBD6B3D4DCD}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{16C5F245-FC87-4415-8BB5-257D67D90D1A}: DhcpNameServer=10.1.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{2DDA6F50-D8C4-44AD-8DBE-DCBD6B3D4DCD}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning not selected.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Priincessloren
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-20-2008 7:39 (GMT +1)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:38:45, on 20/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Windows\System32\ico.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\ehome\ehmsas.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.myspace.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (file missing)
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: WPT Casino - {AEA41B74-B7C9-42B7-A684-4CE687B6BA76} - http://online.worldpokertour.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: WPT Casino - {AEA41B74-B7C9-42B7-A684-4CE687B6BA76} - http://online.worldpokertour.com (file missing) (HKCU)
O13 - Gopher Prefix:
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUplden-au.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9422 bytes

Priincessloren
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-21-2008 9:16 (GMT +1)

could you please tell me what i should do now?
thankyou

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13594

Posted 7-21-2008 1:48 (GMT +1)

I´m waiting for response on this - "and tell how your computer are behaving" ;-)

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Priincessloren
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-31-2008 9:53 (GMT +1)

did u get the results?

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13594

Posted 7-31-2008 10:48 (GMT +1)

I did, but I still need feedback on - "and tell how your computer are behaving" ?

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Forum Information

Currently it is Thursday, November 20, 2008 3:43 PM (GMT +1)
There are a total of 63.932 posts in 15.821 threads.
In the last 3 days there were 33 new threads and 156 reply posts. View Active Threads