[ogam5]

I'm no longer sure WHAT I mean by that - if I ever truly was; all I know is that thousands of people buy secondhand CPUs and they have MS as their operating system, doubt they've ever paid a dime to renew the license (as it SHOULD be for a version now over a decade old in XP - if MS wants such people to ever purchase their products in the future when they might be in a much better position to do so, then they better NOT cripple them when they're really down - of course, as I alluded to before, these people think nothing of making their OSs obsolete with nary a care for the economic viability of people who depend upon this staple of modern society).....I've been out of work for 3.5 years now and rely heavily upon this computer.....I do appreciate all your considerable effort but, if there's a moral conflict emerging, at the very least, help me restore my ability to, again, download/save and let me know where things stand otherwise.....

[Advertisements]

Did the PC come with XP already installed on it and does it have a MS sticker on it with a product key?

Please rerun combofix.

[CompCav]

Did the PC come with XP already installed on it and does it have a MS sticker on it with a product key?

Please rerun combofix.

[ogam5]

Yes, and yes - will do.....BTW, ran Malwarebytes and came up with what was characterized as some sort of rogue heuristic.....so THAT's working, at least! Will disable for new ComboFix run, of course.....

Edited by ogam5, 15 June 2012 - 06:39 AM.

[ogam5]

.....running ComboFix, quickly became clear that the first attempt was interrupted; absolutely don't remember there being 50 stages the first time! Report follows.....


ComboFix 12-06-14.01 - User 06/15/2012 8:48.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.204 [GMT -4:00]
Running from: c:\documents and settings\User\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\User\Local Settings\Application Data\{F4F28AD4-EEC3-4B37-B43A-85D30883BB35}
c:\documents and settings\User\Local Settings\Application Data\{F4F28AD4-EEC3-4B37-B43A-85D30883BB35}\chrome\content\_cfg.js
c:\documents and settings\User\Local Settings\Application Data\{F4F28AD4-EEC3-4B37-B43A-85D30883BB35}\chrome\content\overlay.xul
c:\documents and settings\User\Local Settings\Application Data\{F4F28AD4-EEC3-4B37-B43A-85D30883BB35}\install.rdf
.
.
((((((((((((((((((((((((( Files Created from 2012-05-15 to 2012-06-15 )))))))))))))))))))))))))))))))
.
.
2012-06-14 00:27 . 2012-06-14 00:27 -------- dc----w- C:\_OTL
2012-06-02 05:28 . 2012-06-04 19:34 -------- d-----w- c:\documents and settings\All Users\Application Data\boost_interprocess
2012-06-02 05:26 . 2012-06-04 19:35 -------- d-----w- c:\documents and settings\User\Application Data\Skype
2012-06-02 05:17 . 2012-06-04 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2012-05-29 11:26 . 2012-06-04 19:28 -------- d-----w- c:\documents and settings\All Users\Application Data\SecTaskMan
2012-05-29 09:19 . 2012-05-29 09:20 -------- d-----w- c:\documents and settings\User\Application Data\IObit
2012-05-29 09:18 . 2012-05-29 09:18 -------- d-----w- c:\program files\IObit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-04 19:56 . 2011-05-20 00:25 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-05-02 13:58 . 2012-02-24 03:41 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 -c--a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 07:56 15360 -c--a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-07 19:33 421160 -c--a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2012-04-04 19:56 462408 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 21:38 421888 -c--a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-01-18 19:02 254696 -c--a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MBAMService"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Rhapsody\\rhapsody.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"50000:UDP"= 50000:UDP:IHA_MessageCenter
.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5/19/2011 8:25 PM 654408]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [5/19/2011 8:25 PM 22344]
S1 tdx;@%SystemRoot%\system32\tcpipcfg.dll,-50004;c:\windows\system32\DRIVERS\tdx.sys --> c:\windows\system32\DRIVERS\tdx.sys [?]
S2 iphlpsvc;@%SystemRoot%\system32\iphlpsvc.dll,-200;c:\windows\System32\svchost.exe -k NetSvcs [3/31/2003 8:00 AM 14336]
S3 WinDefend;Windows Defender;c:\windows\System32\svchost.exe -k secsvcs [3/31/2003 8:00 AM 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
.
------- Supplementary Scan -------
.
uStart Page =
mStart Page =
uInternet Settings,ProxyOverride = <local>;*.local
Trusted Zone: streamwrhu.net\live
TCP: DhcpNameServer = 66.189.0.100 24.159.64.23 24.247.24.53
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\2dx88my5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - user.js: extensions.zonealarm.rvrtMsg - Click Yes to keep current home page and default search settings, Click No to restore original settings
FF - user.js: extensions.zonealarm.autoRvrt - true
FF - user.js: extensions.zonealarm_i.newTab - false
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?Source=ToolBar&oemCode=ZLN112918528683978-1001&toolbarId=base&affiliateId=1001&Lan={dfltLng}&utid=7897c3fd0000000000000030bd2b8e4d&q=
FF - user.js: extensions.zonealarm.id - 7897c3fd0000000000000030bd2b8e4d
FF - user.js: extensions.zonealarm.instlDay - 15468
FF - user.js: extensions.zonealarm.vrsn - 1.5.23.8
FF - user.js: extensions.zonealarm.vrsni - 1.5.23.8
FF - user.js: extensions.zonealarm_i.vrsnTs - 1.5.23.83:14
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1001
FF - user.js: extensions.zonealarm_i.smplGrp - none
FF - user.js: extensions.zonealarm.tlbrId - base
FF - user.js: extensions.zonealarm.instlRef - ZLN112918528683978-1001
FF - user.js: extensions.zonealarm.dfltLng - en
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.admin - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-15 09:04
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-06-15 09:09:44
ComboFix-quarantined-files.txt 2012-06-15 13:09
ComboFix2.txt 2012-06-15 00:48
.
Pre-Run: 2,718,822,400 bytes free
Post-Run: 2,728,759,296 bytes free
.
- - End Of File - - 6C12DB0A4D1B7D5588413821C7EA7567

[CompCav]

Try internet now, Combofix found malware in Firefox.

Here is another link to Avast, if it does not download then right click on it and then click save download as....

There is no initial fee and no renewal fee for the free Avast or MS Security Essentials.

[ogam5]

.....not sure what's going on, but can't even open that new Avast! link you posted - despite having re-booted; in general getting permanently hung up until I attempt to close the browser entirely.....is there some rogue fighting back as a result of all the antiviral operations we've run?

[CompCav]

The links are working let's try to start FireFox in safemode.
With FireFox open click Help the select Restart with Add-ons Disabled...
Then try to download the file!

[ogam5]

.....went into SafeMode and didn't get very far; hit 'Open With' window when attempting to access FireFox - except for one interesting new development: had a prompt to disable an add-on, the microsoft.NET.assistant or something with a similar filepath which, upon doing so, DID allow for opening a browser window but, got hung up again with hourglass and no resolution - closed much faster than in regular mode even with 'No Response' notice, though.....tried opening both CCleaner and Malwarebytes, but was again stymied by 'Open With' window in both cases.....am contemplating a Disk Cleanup to see how much additional space on the C drive I might get from having deleted all those bad files.....

[CompCav]

Disk clean up would be good we need to have 20-25% free space so we can update to SP3 and update Internet Explorer to 8.0

[CompCav]

Also try running exehelper and RogueKiller in safe mode. Post logs.

[ogam5]

.....20-25% free space???? That's absolutely IMPOSSIBLE.....what, exactly, is 'SP 3'? Will do the cleanup and defrag - but how am I gonna transfer exehelper and/or RogueKiller if I can't open FireFox or any other browser (haven't tried Safari, I admit) in SafeMode? Is there a way of transfering it there from normal mode I'm not aware of? And, really not sure what the point is of updating to IE 8 since I never use it anyhow.....

[ogam5]

.....best I could do was 17% of C drive being used; did both the cleanup and defrag but could only get to the 25% mark before it finished - a lot of files are fragmented and I'm hoping to send a list of those over; not sure it saved to my Desktop.....understand, with it being only 18.64 GBs I have to be very frugal about space - and STILL have yet to reinstall SuperAntiSpyware.....here's the aforementioned Report; do realize it's less than an ideal thing to have 4.5 GBs/25% of files fragmented but reinstalling the drive is, as you might've guessed, ALSO not an option at this time.....


Volume (C:)
Volume size = 18.64 GB
Cluster size = 4 KB
Used space = 15.41 GB
Free space = 3.22 GB
Percent free space = 17 %

Volume fragmentation
Total fragmentation = 33 %
File fragmentation = 61 %
Free space fragmentation = 6 %

File fragmentation
Total files = 45,515
Average file size = 1 MB
Total fragmented files = 963
Total excess fragments = 47,680
Average fragments per file = 2.04

Pagefile fragmentation
Pagefile size = 192 MB
Total fragments = 262

Folder fragmentation
Total folders = 8,624
Fragmented folders = 1
Excess folder fragments = 0

Master File Table (MFT) fragmentation
Total MFT size = 73 MB
MFT record count = 54,798
Percent MFT in use = 73 %
Total MFT fragments = 9

--------------------------------------------------------------------------------
Fragments File Size Files that cannot be defragmented
239 15 MB \WINDOWS\Installer\{26A24AE4-039D-4CA4-87B4-2F83216031FF}\sp1033.MST
242 15 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1592\A0445065.dll
265 17 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1640\A0467979.rbf
277 17 MB \Documents and Settings\User\Desktop\Desktop tunes\Song For The Muses - Ernie Isley.mp3
300 19 MB \WINDOWS\system32\config\software.rhk
299 19 MB \Program Files\iTunes\iTunes.dll
306 19 MB \WINDOWS\Installer\15032c3.msp
345 22 MB \Documents and Settings\test\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.BIN
360 23 MB \WINDOWS\Installer\bd9ad18.msp
245 23 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1640\snapshot\_REGISTRY_MACHINE_SOFTWARE
264 23 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1641\snapshot\_REGISTRY_MACHINE_SOFTWARE
265 23 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1636\snapshot\_REGISTRY_MACHINE_SOFTWARE
244 24 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1645\snapshot\_REGISTRY_MACHINE_SOFTWARE
305 24 MB \WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AcroRd32.dll
368 24 MB \WINDOWS\system32\config\software.bak
311 24 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1608\A0449248.rbf
308 24 MB \Program Files\Adobe\Reader 10.0\Reader\AcroRd32.dll
592 38 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1644\A0469301.exe
627 39 MB \Documents and Settings\User\Local Settings\Application Data\Apple Computer\Safari\SafeBrowsing.db
692 43 MB \Program Files\Java\jre6\lib\rt.jar
746 47 MB \Documents and Settings\test\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.DB
296 48 MB \Documents and Settings\User\Desktop\Flashlight.mp3
819 53 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1649\A0471383.exe
695 54 MB \WINDOWS\system32\MRT.exe
1,428 90 MB \WINDOWS\SoftwareDistribution\DataStore\DataStore.edb
535 113 MB \Documents and Settings\User\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb
1,852 116 MB \Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AA1000000001}\Data1.cab
1,822 123 MB \Documents and Settings\User\Local Settings\Application Data\Apple Computer\iTunes\Cache.db
1,176 126 MB \Documents and Settings\User\Desktop\OpenOffice.org 3.3 (en-US) Installation Files\openofficeorg1.cab
2,120 151 MB \Documents and Settings\User\Desktop\OOo_3.3.0_Win_x86_install-wJRE_en-US.exe

[CompCav]

Let's run check disk now.
Dakeyras has a nice little tutorial on it here

Use the Graphical Mode: instructions.



Once it reboots go here to retrieve the check disk report:

• Go to Start and type in eventvwr.msc...press Enter
• Expand the Windows logs heading, then select the Application log file entry.
• Double click on the Source column header.
• Scroll down the list until you find the Chkdsk entry (winlogon for XP).
• Copy/paste the results into your next post.

[ogam5]

Went ahead and triggered the CheckDisk function as directed - took at least an hour if not more - then re-ran the Defrag program - can't be sure, but doesn't appear to have had much of an effect - correct me if I'm wrong, but the bad sectors are automatically repaired unless otherwise commanded (?).....didn't know where I could access the CheckDisk report either or if you were requesting that.....


Volume (C:)
Volume size = 18.64 GB
Cluster size = 4 KB
Used space = 15.42 GB
Free space = 3.22 GB
Percent free space = 17 %

Volume fragmentation
Total fragmentation = 33 %
File fragmentation = 61 %
Free space fragmentation = 6 %

File fragmentation
Total files = 45,593
Average file size = 1 MB
Total fragmented files = 961
Total excess fragments = 47,614
Average fragments per file = 2.04

Pagefile fragmentation
Pagefile size = 192 MB
Total fragments = 262

Folder fragmentation
Total folders = 8,691
Fragmented folders = 1
Excess folder fragments = 0

Master File Table (MFT) fragmentation
Total MFT size = 73 MB
MFT record count = 54,943
Percent MFT in use = 73 %
Total MFT fragments = 9

--------------------------------------------------------------------------------
Fragments File Size Files that cannot be defragmented
239 15 MB \WINDOWS\Installer\{26A24AE4-039D-4CA4-87B4-2F83216031FF}\sp1033.MST
242 15 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1592\A0445065.dll
265 17 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1640\A0467979.rbf
277 17 MB \Documents and Settings\User\Desktop\Desktop tunes\Song For The Muses - Ernie Isley.mp3
300 19 MB \WINDOWS\system32\config\software.rhk
299 19 MB \Program Files\iTunes\iTunes.dll
306 19 MB \WINDOWS\Installer\15032c3.msp
345 22 MB \Documents and Settings\test\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.BIN
360 23 MB \WINDOWS\Installer\bd9ad18.msp
245 23 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1640\snapshot\_REGISTRY_MACHINE_SOFTWARE
264 23 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1641\snapshot\_REGISTRY_MACHINE_SOFTWARE
265 23 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1636\snapshot\_REGISTRY_MACHINE_SOFTWARE
244 24 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1645\snapshot\_REGISTRY_MACHINE_SOFTWARE
305 24 MB \WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744AA0100000010\10.1.0\AcroRd32.dll
368 24 MB \WINDOWS\system32\config\software.bak
311 24 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1608\A0449248.rbf
308 24 MB \Program Files\Adobe\Reader 10.0\Reader\AcroRd32.dll
592 38 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1644\A0469301.exe
627 39 MB \Documents and Settings\User\Local Settings\Application Data\Apple Computer\Safari\SafeBrowsing.db
692 43 MB \Program Files\Java\jre6\lib\rt.jar
746 47 MB \Documents and Settings\test\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.DB
296 48 MB \Documents and Settings\User\Desktop\Flashlight.mp3
819 53 MB \System Volume Information\_restore{D79813A2-D918-4CD4-901D-59C2E738ECD1}\RP1649\A0471383.exe
695 54 MB \WINDOWS\system32\MRT.exe
1,428 90 MB \WINDOWS\SoftwareDistribution\DataStore\DataStore.edb
535 113 MB \Documents and Settings\User\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb
1,852 116 MB \Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AA1000000001}\Data1.cab
1,822 123 MB \Documents and Settings\User\Local Settings\Application Data\Apple Computer\iTunes\Cache.db
1,176 126 MB \Documents and Settings\User\Desktop\OpenOffice.org 3.3 (en-US) Installation Files\openofficeorg1.cab
2,120 151 MB \Documents and Settings\User\Desktop\OOo_3.3.0_Win_x86_install-wJRE_en-US.exe

[CompCav]

The bottom of post #43 has the instructions for getting the check disk log. It is in the event log and named winlogon.