[icaro1]

Well I've tried ComboFix and Malwarebytes, but no luck. I appear to need some hand holding. Please help me remove this nasty virus.

This is what ComboFix said:


ComboFix 09-09-28.01 - User 09/28/2009 21:12.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.52.1033.18.503.132 [GMT -7:00]
Running from: c:\documents and settings\User\Desktop\fu456.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-27 20:31 . 2009-09-27 20:31 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes
2009-09-27 20:31 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-27 20:31 . 2009-09-27 20:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-27 20:31 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-27 20:31 . 2009-09-27 20:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-27 19:58 . 2009-09-27 21:29 -------- d-sh--w- c:\documents and settings\All Users\Application Data\93a8c3e
2009-09-17 02:40 . 2008-10-16 21:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-09-17 02:40 . 2008-10-16 21:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-09-16 04:01 . 2009-09-29 03:58 -------- d-----w- c:\documents and settings\User\Tracing
2009-09-16 03:45 . 2009-09-16 03:45 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-09-16 03:44 . 2006-11-29 20:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-09-16 03:44 . 2009-09-16 03:44 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-09-16 03:42 . 2009-09-16 03:42 -------- d-----w- c:\program files\Microsoft
2009-09-16 03:42 . 2009-09-16 03:42 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-16 03:41 . 2009-09-16 03:46 -------- d-----w- c:\program files\Windows Live
2009-09-16 03:37 . 2009-09-16 03:37 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-10 04:57 . 2009-06-21 22:04 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2009-09-10 01:42 . 2009-09-10 01:42 -------- d-----w- c:\program files\iPod
2009-09-10 01:42 . 2009-09-10 01:43 -------- d-----w- c:\program files\iTunes
2009-09-10 01:42 . 2009-09-10 01:43 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-10 01:32 . 2009-09-10 01:33 -------- d-----w- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 03:44 . 2006-04-20 01:44 -------- d-----w- c:\program files\CCleaner
2009-09-29 02:57 . 2006-04-20 01:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-29 02:33 . 2008-12-27 18:27 -------- d-----w- c:\documents and settings\User\Application Data\skypePM
2009-09-19 08:17 . 2008-12-27 18:22 -------- d-----w- c:\documents and settings\User\Application Data\Skype
2009-09-16 04:01 . 2006-04-20 01:57 23192 ----a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-10 03:56 . 2007-08-10 05:13 -------- d-----w- c:\documents and settings\User\Application Data\Apple Computer
2009-09-10 01:42 . 2007-08-10 05:10 -------- d-----w- c:\program files\Common Files\Apple
2009-09-09 03:19 . 2006-04-12 14:42 -------- d-----w- c:\program files\Common Files\Real
2009-08-29 02:42 . 2009-07-10 00:44 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-29 02:42 . 2008-12-26 15:31 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-05 09:11 . 2004-08-10 17:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-02 08:37 . 2006-04-12 14:34 -------- d-----w- c:\program files\Dell
2009-07-26 23:44 . 2009-07-26 23:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-17 18:55 . 2004-08-10 17:50 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 06:43 . 2004-08-10 17:51 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 19:15 . 2009-07-10 19:15 306544 ----a-w- c:\windows\WLXPGSS.SCR
2008-12-24 20:02 . 2006-04-20 23:08 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-12-24 20:02 . 2006-04-20 23:08 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-24 20:02 . 2008-06-11 15:48 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-12-24 20:02 . 2008-06-11 15:48 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-12-24 20:02 . 2006-04-20 23:08 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2006-04-20 01:58 . 2006-04-20 01:57 56 --sh--r- c:\windows\system32\B97063234C.sys
2006-04-20 01:58 . 2006-04-20 01:56 4704 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-09-10 393216]
"Run StartupMonitor"="StartupMonitor.exe" - c:\windows\StartupMonitor.exe [2000-05-21 86016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [8/10/2004 10:51 AM 14336]
.
Contents of the 'Scheduled Tasks' folder

2009-04-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2008-07-01 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2006-04-20 08:04]
.
.
------- Supplementary Scan -------
.
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\3cfxor3h.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - mail.yahoo.com
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[email protected]\components\qfaservices.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-28 21:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1476)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-09-29 21:19
ComboFix-quarantined-files.txt 2009-09-29 04:19
ComboFix2.txt 2009-09-29 03:56
ComboFix3.txt 2009-09-29 02:46

Pre-Run: 17,548,480,512 bytes free
Post-Run: 17,517,588,480 bytes free

128 --- E O F --- 2009-09-18 19:30

Edited by icaro1, 29 September 2009 - 02:49 PM.