Internet Explorer Virus

ComboFix 09-01-06.01 - Michael MacMahon 2009-01-07 16:43:47.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2038.1686 [GMT 11:00]
Running from: c:\documents and settings\Michael MacMahon\Desktop\Solution.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)
 
[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\recycler\ADAPT_Installer.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\drivers\TDSSmhct.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSfxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.dll
c:\windows\system32\TDSStkdv.log
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\w40cqsmQ.exe.a_a
c:\windows\system32\winsrc.dll.tmp
c:\windows\system32\WS2Fix.exe
c:\windows\system32\x64
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys
 
 
(((((((((((((((((((((((((   Files Created from 2008-12-07 to 2009-01-07  )))))))))))))))))))))))))))))))
.
 
2009-01-07 15:32 . 2009-01-07 15:32	<DIR>	d--------	c:\program files\Trend Micro
2009-01-07 15:27 . 2009-01-07 15:27	<DIR>	d--------	c:\program files\getsome
2009-01-07 15:27 . 2009-01-07 15:27	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-07 15:27 . 2009-01-04 18:38	38,496	--a------	c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-07 15:27 . 2009-01-04 18:38	15,504	--a------	c:\windows\system32\drivers\mbam.sys
2009-01-07 12:59 . 2009-01-07 12:59	0	--a------	c:\windows\system32\null
2008-12-16 07:56 . 2008-11-07 16:45	2,174,976	-----c---	c:\windows\system32\dllcache\WMVCore.dll
2008-12-16 07:56 . 2008-06-10 06:11	1,053,696	-----c---	c:\windows\system32\dllcache\WMNetmgr.dll
2008-12-16 07:56 . 2008-06-10 03:11	103,936	-----c---	c:\windows\system32\dllcache\logagent.exe
2008-12-15 10:25 . 2008-12-15 10:25	<DIR>	d--------	c:\program files\Avira
2008-12-15 10:25 . 2008-12-15 10:25	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Avira
2008-12-15 10:18 . 2008-10-03 21:02	247,326	-----c---	c:\windows\system32\dllcache\strmdll.dll
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-07 02:10	---------	d-----w	c:\program files\Google
2009-01-07 02:05	---------	d-----w	c:\documents and settings\All Users\Application Data\Dell
2008-12-05 23:23	---------	d-----w	c:\program files\Common Files\Symantec Shared
2008-12-05 00:39	---------	d-----w	c:\program files\Silvan
2008-12-04 23:35	1,996	----a-w	c:\documents and settings\Michael MacMahon\Application Data\wklnhst.dat
2008-11-25 02:22	---------	d-----w	c:\program files\Norton PC Checkup
2008-11-23 21:57	---------	d-----w	c:\documents and settings\Michael MacMahon\Application Data\Template
2008-11-23 21:43	---------	d-----w	c:\program files\Common Files\Adobe
2008-11-19 04:31	---------	d-----w	c:\program files\DIFX
2008-11-19 04:30	---------	d-----w	c:\documents and settings\All Users\Application Data\Symantec
2008-11-17 02:08	---------	d-----w	c:\program files\Tractor_Parts
2008-11-17 02:07	---------	d-----w	c:\documents and settings\Michael MacMahon\Application Data\Tractor_Parts
2008-11-14 04:14	---------	d-----w	c:\program files\Taarup
2008-10-23 12:36	286,720	----a-w	c:\windows\system32\gdi32.dll
2008-10-16 03:13	202,776	----a-w	c:\windows\system32\wuweb.dll
2008-10-16 03:13	1,809,944	----a-w	c:\windows\system32\wuaueng.dll
2008-10-16 03:12	561,688	----a-w	c:\windows\system32\wuapi.dll
2008-10-16 03:12	323,608	----a-w	c:\windows\system32\wucltui.dll
2008-10-16 03:09	92,696	----a-w	c:\windows\system32\cdm.dll
2008-10-16 03:09	51,224	----a-w	c:\windows\system32\wuauclt.exe
2008-10-16 03:09	43,544	----a-w	c:\windows\system32\wups2.dll
2008-10-16 03:08	34,328	----a-w	c:\windows\system32\wups.dll
2008-10-16 03:06	268,648	----a-w	c:\windows\system32\mucltui.dll
2008-10-16 03:06	208,744	----a-w	c:\windows\system32\muweb.dll
2008-10-16 01:00	666,112	----a-w	c:\windows\system32\wininet.dll
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-15 1695232]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-02-22 159744]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-22 137752]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-06-30 2220032]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2008-02-22 1245184]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-22 c:\windows\RTHDCPL.EXE]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
 
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Canon PC1200 iC D600 iR1200G Status Window.LNK - c:\windows\system32\spool\drivers\w32x86\3\CAPM1LAK.EXE [2001-12-07 30208]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\UltraVNC\\winvnc.exe"=
 
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2008-10-24 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2008-10-24 43608]
R4 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2008-10-30 6016]
S4 RapidPortM1;RapidPortM1;c:\windows\system32\drivers\CAPM1LP.SYS [2008-11-20 22912]
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95c6056c-aeab-11dd-8409-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95c6056e-aeab-11dd-8409-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95c6056f-aeab-11dd-8409-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfc4b948-a972-11dd-8405-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfc4b949-a972-11dd-8405-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfc4b94b-a972-11dd-8405-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfc4b94e-a972-11dd-8405-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7ac2b8e-a60b-11dd-8403-002170bd4a6c}]
\Shell\AutoRun\command - E:\setupSNK.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e859331e-a94d-11dd-8404-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8593321-a94d-11dd-8404-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
.
- - - - ORPHANS REMOVED - - - -
 
HKLM-RunOnce-<NO NAME> - (no file)
 
 
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.au/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com.au/ig/dell?hl=en&client=dell-row&channel=au&ibd=6081024
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.
 
**************************************************************************
 
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-07 16:45:50
Windows 5.1.2600 Service Pack 3 NTFS
 
scanning hidden processes ... 
 
scanning hidden autostart entries ...
 
scanning hidden files ... 
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'winlogon.exe'(1000)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2009-01-07 16:46:33
ComboFix-quarantined-files.txt  2009-01-07 05:46:29
 
Pre-Run: 145,888,927,744 bytes free
Post-Run: 145,953,009,664 bytes free
 
174	--- E O F ---	2009-01-07 00:13:12
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217: