1.

Solve : Re: spyware/virus problem. can't access C: drive, can't open certain programs?

Answer»

Had a very similar problem, here the log that I got after running COMBOFIX
Wonder if were downloading same thing.


ComboFix 09-03-15.01 - Stan 2009-03-18 21:22:34.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.1535.1159 [GMT -4:00]
Running from: c:\documents and settings\Stan\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)
AV: McAfee VirusScan *On-access scanning disabled* (Outdated)
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated)

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\windows\system32\drivers\fad.sys
c:\windows\system32\drivers\gaopdxaklnqqoroeeiwqmmnaijgvjngukftvxo.sys
c:\windows\system32\drivers\gaopdxrmyvymqskltenbgixudpskjwbpjovutm.sys
c:\windows\system32\drivers\gaopdxyapuxrdlvnrwkpbivaqxdoltfmrqvmph.sys
c:\windows\system32\gaopdxcounter
c:\windows\system32\gaopdxxmumdbjduxdltoirkhfrhpabrnoretfm.dll
Z:\Autorun.inf
z:\recycler\S-1-4-31-100013720-100003350-100027788-1077.com
z:\recycler\S-5-3-59-100026097-100009182-100004493-3868.com
z:\recycler\S-5-5-81-100002894-100007065-100025522-8070.com
z:\recycler\S-9-9-13-100003843-100027127-100021430-4327.com

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_gaopdxserv.sys


(((((((((((((((((((((((((   Files Created from 2009-02-19 to 2009-03-19  )))))))))))))))))))))))))))))))
.

2009-03-18 18:49 . 2009-03-18 18:49      d--------   c:\documents and settings\Stan\Application Data\TrojanHunter
2009-03-18 18:14 . 2009-03-18 18:14      d--------   c:\program files\TrojanHunter 5.0
2009-03-17 23:01 . 2009-03-17 23:01      d--------   C:\Mdtcm
2009-03-16 22:10 . 2009-03-16 22:10      d--h-----   C:\$AVG8.VAULT$
2009-03-16 22:01 . 2009-03-16 22:01      d--------   c:\windows\system32\drivers\Avg
2009-03-16 22:01 . 2009-03-16 22:01      d--------   c:\program files\AVG
2009-03-16 22:01 . 2009-03-16 22:01      d--------   c:\documents and settings\Stan\Application Data\AVGTOOLBAR
2009-03-16 22:01 . 2009-03-16 22:01      d--------   c:\documents and settings\All Users\Application Data\avg8
2009-03-16 22:01 . 2009-03-16 22:01   325,640   --a------   c:\windows\system32\drivers\avgldx86.sys
2009-03-16 22:01 . 2009-03-16 22:01   107,912   --a------   c:\windows\system32\drivers\avgtdix.sys
2009-03-16 22:01 . 2009-03-16 22:01   10,520   --a------   c:\windows\system32\avgrsstx.dll
2009-03-16 20:43 . 2009-01-26 15:31   414,552   --a------   c:\windows\system32\123.scr
2009-03-16 20:36 . 2009-03-16 21:21      d--------   c:\program files\Spybot - Search & Destroy
2009-03-16 20:36 . 2009-03-16 21:13      d--------   c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-16 20:11 . 2009-03-16 20:11      d--------   c:\documents and settings\Administrator
2009-03-16 20:00 . 2009-03-16 20:01      d--------   c:\program files\Spyware Doctor
2009-03-16 20:00 . 2009-03-16 20:00      d--------   c:\program files\Common Files\PC Tools
2009-03-16 20:00 . 2009-03-16 20:00      d--------   c:\documents and settings\Stan\Application Data\PC Tools
2009-03-16 20:00 . 2009-03-18 19:25      d-a------   c:\documents and settings\All Users\Application Data\TEMP
2009-03-16 20:00 . 2009-03-16 20:00      d--------   c:\documents and settings\All Users\Application Data\PC Tools
2009-03-16 20:00 . 2008-12-11 08:38   159,600   --a------   c:\windows\system32\drivers\pctgntdi.sys
2009-03-16 20:00 . 2009-03-06 16:45   130,424   --a------   c:\windows\system32\drivers\PCTCore.sys
2009-03-16 20:00 . 2008-12-18 12:16   73,840   --a------   c:\windows\system32\drivers\PCTAppEvent.sys
2009-03-16 20:00 . 2008-12-10 12:36   64,392   --a------   c:\windows\system32\drivers\pctplsg.sys
2009-03-16 17:44 . 2003-02-28 18:26   139,536   --a------   c:\windows\system32\javaee.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-19 01:20   ---------   d-----w   c:\documents and settings\Stan\Application Data\DNA
2009-03-18 23:25   ---------   d-----w   c:\program files\DNA
2009-03-18 23:02   ---------   d-----w   c:\program files\Common Files\Symantec Shared
2009-03-18 22:49   ---------   d-----w   c:\documents and settings\Stan\Application Data\U3
2009-03-16 11:37   ---------   d-----w   c:\program files\Norton Internet Security
2009-03-16 01:29   ---------   d-----w   c:\documents and settings\Stan\Application Data\BitTorrent
2009-02-09 10:19   1,846,272   ----a-w   c:\windows\system32\win32k.sys
2009-01-24 20:36   ---------   d-----w   c:\program files\BitTorrent
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"j2 4.4"="c:\program files\j2 Messenger 4.4\J2GDllCmd.exe" [2008-10-07 95744]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-24 342848]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2008-07-08 2828184]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 65536]
"RoxioDragToDisc"="c:\program files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-10-16 868352]
"RoxioAudioCentral"="c:\program files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-07-15 319488]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-03-23 26112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-03-23 77824]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
"VSOCheckTask"="c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" [2003-08-08 122880]
"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe"="c:\progra~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 212992]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-12-22 71280]
"URLLSTCK.exe"="c:\program files\Norton Internet Security\UrlLstCk.exe" [2003-10-22 70840]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-11-03 4800512]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"VirusScan Online"="c:\progra~1\mcafee.com\vso\mcvsshld.exe" [2003-08-17 163840]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-16 1932568]
"THGuard"="c:\program files\TrojanHunter 5.0\THGuard.exe" [2008-10-24 1056928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Warning"="c:\progra~1\SYMNET~1\SNDWarn.exe" [2004-10-29 218232]
"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2003-08-13 54472]

c:\documents and settings\Stan\Start Menu\Programs\Startup\
jConnect 4.4.lnk - c:\program files\j2 Messenger 4.4\J2GTray.exe [2008-10-07 656896]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-06 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-16 22:01 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\UltraVNC\\winvnc.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:xpsp2res.dll,-22009

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-16 130424]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-03-16 325640]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-03-16 107912]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-16 298264]
R2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2008-08-22 6016]
S3 NaiFiltr;NaiFiltr;c:\windows\system32\drivers\NaiFiltr.sys [2006-03-24 23296]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-03-16 348752]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-9-9-13-100003843-100027127-100021430-4327.com c:\
\Shell\Open\command - c:\recycler\S-9-9-13-100003843-100027127-100021430-4327.com c:\

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-9-9-13-100003843-100027127-100021430-4327.com z:\
\Shell\Open\command - z:\recycler\S-9-9-13-100003843-100027127-100021430-4327.com z:\
.
Contents of the 'Scheduled Tasks' folder

2009-03-14 c:\windows\Tasks\Norton AntiVirus - Scan my computer.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2003-12-04 18:22]

2009-03-19 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-08-13 19:38]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Sonic RecordNow! - (no file)
HKLM-Run-AVG7_RegCleaner - c:\progra~1\Grisoft\AVG7\avgregcl.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ebay.com/
uInternet Connection Wizard,ShellNext = hxxp://estore.sonic.com/upgrades/purchase.asp?srnm=C5HL2KVAEPDSS4JGR⟨=ENU&id=40
uInternet Settings,ProxyServer = 192.168.1.1
uInternet Settings,ProxyOverride =
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Stan\Application Data\Mozilla\Firefox\Profiles\x5uhg4ro.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nphssb.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-18 21:26:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-03-18 21:28:38
ComboFix-quarantined-files.txt  2009-03-19 01:28:32

Pre-Run: 101,167,312,896 bytes free
Post-Run: 101,278,400,512 bytes free

173   --- E O F ---   2009-03-16 21:46:33
i'm not an expert , but why do you have ,  AVG  / norton / mcafee / spyware

WITH antvirus, all on you pc  , harryYou have way TOO MUCH protection on this computer. It actually can offer less protection by running multiple security softwares at once.

Disable Spybot's TeaTimer

While TeaTimer is an excellent tool for the prevention of spyware, it can also interfere with our fixes. Please disable TeaTimer.

1. Right click Spybot in the System TRAY (looks like a calendar with a padlock symbol). Choose Exit Spybot S&D RESIDENT
2. Run Spybot S&D
3. Go to the Mode menu, and make sure Advanced Mode is selected.
4. On the left hand side, choose Tools > Resident
uncheck Resident TeaTimer and OK any prompt and Restart your computer.

Note:
If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

If TeaTimer will not turn off then uninstall Spybot until we are done cleaning.

----------

AVG Anti-Virus Free
McAfee VirusScan
Spyware Doctor with AntiVirus


The real-time protection of multiple antivirus programs may conflict with each other and cause the following:

1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
2) Conflicts: Your system may lock up due to both products attempting to access the same file at the same time.
3) Performance: More that one antivirus will cause your PC to become slow and it may even crash or blue screen.

Please uninstall all but ONE antivirus now.

----------

Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]KillAll::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\Z]

3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left MOUSE button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

----------

Download Malwarebytes' Anti-Malware (MBAM)

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to the following:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
    • Then click Finish.
    • If an update is FOUND, it will download and install the LATEST version.
    • Once the program has loaded, select Perform quick scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy and Paste the entire report in your next reply.
    .
    Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



    Discussion

    No Comment Found