[Resolved] paladium security has taken over. cant update windows...

[32skidoo]

here is the combofix log;


ComboFix 11-02-09.05 - Alex & Debbie 10/02/2011  17:47:51.4.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.1014.426 [GMT -6:00]
Running from: c:\documents and settings\Alex & Debbie\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Alex & Debbie\Desktop\CFScript.txt

FILE ::
"c:\progra~1\dellsu~1\hwdiag\bin\PCD5SRVC.pkms"
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\progra~1\dellsu~1\hwdiag\bin\PCD5SRVC.pkms

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_PCD5SRVC{3F6A8B78-EC003E00-05040000}


(((((((((((((((((((((((((   Files Created from 2011-01-10 to 2011-02-10  )))))))))))))))))))))))))))))))
.

2011-02-10 22:07 . 2010-10-19 20:51   222080   ------w-   c:\windows\system32\MpSigStub.exe
2011-02-10 01:36 . 2011-02-10 01:36   --------   d-sh--w-   c:\documents and settings\Administrator\IETldCache
2011-02-09 20:51 . 2009-08-07 01:23   274288   ----a-w-   c:\windows\system32\mucltui.dll
2011-02-09 18:08 . 2011-02-09 18:08   --------   d-----w-   c:\program files\Trend Micro
2011-02-09 17:30 . 2011-02-09 17:30   --------   d-----w-   c:\documents and settings\Alex & Debbie\Local Settings\Application Data\Temp
2011-02-09 01:44 . 2011-02-09 01:44   --------   d-sh--w-   c:\documents and settings\NetworkService\IETldCache
2011-02-09 00:37 . 2011-02-09 00:37   --------   d-sh--w-   c:\documents and settings\Alex & Debbie\IECompatCache
2011-02-09 00:33 . 2011-02-09 00:33   --------   d-sh--w-   c:\documents and settings\Alex & Debbie\PrivacIE
2011-02-09 00:30 . 2011-02-09 00:30   --------   d-sh--w-   c:\documents and settings\LocalService\IETldCache
2011-02-09 00:29 . 2011-02-09 00:29   --------   d-sh--w-   c:\documents and settings\Alex & Debbie\IETldCache
2011-02-09 00:24 . 2010-10-18 11:10   7680   -c----w-   c:\windows\system32\dllcache\iecompat.dll
2011-02-09 00:22 . 2010-12-20 23:59   12800   -c----w-   c:\windows\system32\dllcache\xpshims.dll
2011-02-09 00:22 . 2010-12-20 23:59   247808   -c----w-   c:\windows\system32\dllcache\ieproxy.dll
2011-02-09 00:22 . 2010-12-20 23:59   743424   -c----w-   c:\windows\system32\dllcache\iedvtool.dll
2011-02-09 00:19 . 2011-02-09 00:22   --------   dc-h--w-   c:\windows\ie8
2011-02-08 23:57 . 2011-02-08 23:57   --------   d-----w-   c:\program files\Common Files\Java
2011-02-08 23:56 . 2010-11-13 00:53   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2011-01-21 14:44 . 2011-01-21 14:44   439296   -c----w-   c:\windows\system32\dllcache\shimgvw.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2008-04-25 20:33   439296   ----a-w-   c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2008-04-25 20:33   290048   ----a-w-   c:\windows\system32\atmfd.dll
2010-12-31 13:14 . 2008-04-25 20:33   1864064   ----a-w-   c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2008-04-25 20:33   301568   ----a-w-   c:\windows\system32\kerberos.dll
2010-12-20 23:59 . 2008-04-25 20:33   916480   ----a-w-   c:\windows\system32\wininet.dll
2010-12-20 23:59 . 2008-04-25 20:33   43520   ----a-w-   c:\windows\system32\licmgr10.dll
2010-12-20 23:59 . 2008-04-25 20:33   1469440   ------w-   c:\windows\system32\inetcpl.cpl
2010-12-20 17:26 . 2008-04-25 20:33   730112   ----a-w-   c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2008-04-25 20:33   385024   ----a-w-   c:\windows\system32\html.iec
2010-12-09 15:15 . 2008-04-25 20:33   718336   ----a-w-   c:\windows\system32\ntdll.dll
2010-12-09 14:30 . 2008-04-25 20:33   33280   ----a-w-   c:\windows\system32\csrsrv.dll
2010-12-09 13:42 . 2008-04-25 20:33   2148864   ----a-w-   c:\windows\system32\ntoskrnl.exe
2010-12-09 13:07 . 2008-04-14 00:01   2027008   ----a-w-   c:\windows\system32\ntkrnlpa.exe
2010-11-18 18:12 . 2008-04-26 01:44   81920   ----a-w-   c:\windows\system32\isign32.dll
.

(((((((((((((((((((((((((((((   SnapShot_2011-02-10_21.21.52   )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-02-10 23:55 . 2011-02-10 23:55   16384              c:\windows\temp\Perflib_Perfdata_80.dat
- 2008-04-25 20:33 . 2011-02-10 18:29   79188              c:\windows\system32\perfc009.dat
+ 2008-04-25 20:33 . 2011-02-10 21:45   79188              c:\windows\system32\perfc009.dat
- 2011-02-10 18:07 . 2011-02-10 18:07   49152              c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
+ 2011-02-10 18:07 . 2011-02-10 21:38   49152              c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
- 2008-04-25 20:33 . 2011-02-10 18:29   464078              c:\windows\system32\perfh009.dat
+ 2008-04-25 20:33 . 2011-02-10 21:45   464078              c:\windows\system32\perfh009.dat
+ 2011-02-10 22:00 . 2011-02-10 22:00   301056              c:\windows\Installer\bf845.msi
+ 2011-02-10 21:37 . 2011-02-10 21:37   20304384              c:\windows\Installer\b08f41.msp
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SightSpeed"="c:\program files\Dell Video Chat\DellVideoChat.exe" [2008-08-15 4812664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-11-11 1347584]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-11 16859648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-12-23 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-12-23 354840]
"PersistenceThread"="c:\windows\system32\PersistenceThread.exe" [2008-12-23 92696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"BTMeter"="c:\program files\Battery Meter\BTMeter.exe" [2008-11-05 623912]
"WLSS"="c:\program files\Wireless Select Switch\WLSS.exe" [2008-09-18 546088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-06-03 446635]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-7-30 604776]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2004-6-16 28672]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Dell Video Chat\\DellVideoChat.exe"=

R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [06/03/2009 1:18 AM 14248]
R3 igd;igd;c:\windows\system32\drivers\igxpmp32.sys [06/03/2009 2:56 AM 5088480]
R3 OA004Afx;Provides a software interface to control audio effects of OA004 camera.;c:\windows\system32\drivers\OA004Afx.sys [06/03/2009 2:55 AM 148056]
R3 OA004Ufd;Creative Camera OA004 Upper Filter Driver;c:\windows\system32\drivers\OA004Ufd.sys [06/03/2009 2:55 AM 144672]
R3 OA004Vid;Creative Camera OA004 Function Driver;c:\windows\system32\drivers\OA004Vid.sys [06/03/2009 2:55 AM 269760]
R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [06/03/2009 2:56 AM 158720]
.
Contents of the 'Scheduled Tasks' folder

2010-04-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2009-11-21 c:\windows\Tasks\FRU Task 2004-06-17 01:06ewlett-Packard2004-06-17 01:06p officejet 6100 seriesD66655067F78228D3716D2BFC2C61DA319188DBF244477626.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2004-06-17 00:06]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-10 17:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2972)
c:\windows\system32\WININET.dll
c:\windows\system32\btmmhook.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\NMSAccess.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-02-10  18:01:13 - machine was rebooted
ComboFix-quarantined-files.txt  2011-02-11 00:01
ComboFix2.txt  2011-02-10 21:24
ComboFix3.txt  2011-02-10 17:19

Pre-Run: 56,428,969,984 bytes free
Post-Run: 56,431,083,520 bytes free

- - End Of File - - 32CC006BE2066105A57F9B524BE5CBA9

[1972vet]

OK, install MSE now. Run a full system scan and let me know the results. Thanks!

[32skidoo]

ok i installed MSE and ran a full scan and i clicked on the history and then clicked all detected items and a bunch of trojans etc. showed up. should i go ahead and remove them?

[1972vet]

If the findings are not in a folder called qoobox, then yes, delete them. Let me know when you finish.

[32skidoo]

ok i checked them all and removed them. whats next?

[1972vet]

How many were in the qoobox folder?

[32skidoo]

i looked thru the description and there were none that said qoobox

[1972vet]

...but we removed some using combofix. Since combofix will most assuredly find, remove, or at least flag for my attention most every single trojan known to man, I'd really like to have known what MSE found that combofix missed. It would have helped us (the community of malware warriors) to help the developer with updating the combofix utility. Without that information, untold numbers of other users could become infected with exactly what you were troubled with.

Oh well, next time...

Any other issues troubling you?

[32skidoo]

nope. all appears to be fine. thanks again.

[32skidoo]

i was looking thru the removed items and there is

containerfile:C:\Qoobox\Quarantine\C\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-OC94C42D59OD}\chrome\content\timer.xul.vir



and

file:C:\Qoobox\Quarantine\C\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-OC94C42D59OD}\chrome\content\timer.xul.vir->(SCRIPTOOOO)

and

file:C:Qoobox\Quarantine\C\WINDOWS\system32\sshnas21.dll.vir

and

file:C:Qoobox\Quarantine\C\WINDOWS\efujasuqeboqut.dll.vir

and

file:C:Qoobox\Quarantine\C\WINDOWS\xmslav.dll.vir

and

file:C:Qoobox\Quarantine\C\documents and settings\alex & debbie\local~1\temp\winbdm.dll.vir

and

file:C:Qoobox\Quarantine\C\WINDOWS\system32\winphost.dll.vir

and

containerfile:C:Qoobox\Quarantine\C\documents and settings\alex & debbie\application data\palladium.exe.vir

and

file:C:Qoobox\Quarantine\C\documents and settings\alex & debbie\application data\microsoft\conhost.exe.vir

and

thats it for qoobox files. the rest said java exploits or had java in the title

[1972vet]

You can delete these now:
TDSSKiller
DDS.scr
DDS.txt
Attach.txt
RKU


Next, please click start-->run...then copy and paste the Bold text below into the run box and click "OK":

ComboFix /Uninstall

Performing this function will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again for you automatically.

To assist in the prevention of malicious software intrusion and infections:

Please remember to keep antivirus software on board and always use it's real time protection feature. Run a complete system scan at least once a week...preferably in Safe mode.

If your antivirus program is a licensed version that is about to expire, you can consider using one of these available free on the public domain:

Microsoft Security Essentials
AntiVir Personal Edition Classic
Avast! 4 Home Edition

Those of us in the online safety/security community have tried and tested these programs to determine their abilities. Having in mind, nothing is ever a guarantee regarding computer security, these programs nevertheless, combined with the rest of these recommendations are certain to have an impact in helping to keep your system running free and clear. I personally have been completely satisfied from having tested and used each one of those at one time or another.

Immunize your browser by installing Spywareblaster. What does it do?

• Prevents the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
• Blocks spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
• Restricts the actions of potentially unwanted sites in Internet Explorer.

Keep your anti-virus and spyware definitions up to date. Be sure to scan often.

Web of Trust, (WOT,) warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
• Yellow for caution
• Red to stop

WOT has an add-on available for both Firefox and IE.

Install the Winpatrol security monitor utility. WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. What I hear most from users is how much they like the startup control feature and it's ease of use. Need help understanding something about Winpatol? Here it is.

Below you can choose from several of the freeware Firewalls available on the public domain. Even though you may have a Firewall already installed, keep this list handy should you choose not to renew your subscription for whatever reason.

You should always have at least (but not more than ) one of these types of third party firewalls running on board:
Sunbelt Personal Firewall

Zone Alarm Beware This download includes the Ask Toolbar...The ZoneAlarm Spy Blocker toolbar is powered by "Ask.com". The "Ask" search engine will cause "targeted" ads to be presented to you based upon the content of the web pages you visit, any personally identifiable information you have provided to "Ask.com", or keywords appearing in your search queries. Many security experts consider this type of behavior offensive...Windows 2k/XP/Vista

Outpost Free

Comodo...I highly recommend this firewall, but it may just be best suited for advanced users.

Keep your software updated...make it easier on yourself and install the free security tool "Secunia PSI"

It helps in the background to protect your system against software vulnerabilities. The free utility scans your system's software applications and offers a one button "Download "Solution" feature that updates the exploited software that it finds AND provides other related information/patching if warranted.

Stay updated with the most recent Windows patches as well...using Microsoft's Windows Update. Make it easy on yourself, and set this feature to Automatic.

Using an alternate browser can reduce your chance of certain infections installing themselves. I recommend installing Mozilla Firefox. If you don't already have "Firefox", please consider installing and using this browser for surfing.

If you still wish to use Internet Explorer, please make sure you install SpywareBlaster (from above) to protect you from most ActiveX infections.

Run CCleaner often. The Yahoo Toolbar is included by default during the installation...if you DO NOT WANT IT, be sure to remove the check from the "Add CCleaner Yahoo! Toolbar and use CCleaner from  your browser" option during installation setup or else just download the Slim version (no toolbar...last download link at the bottom of that page)...

Or if you just want to run your on board Disk Cleanup:
("Start--> Programs-->Accessories-->System Tools-->Disk Cleanup" ), just open the utility and check off the following:
Downloaded Program Files, Temporary Internet Files, Recycle Bin, and Temporary Files. Don't forget to defrag the system.

So how did I get infected in the first place?
Regards, and Happy Surfing!

[1972vet]

This thread is now closed as the issue appears to be resolved.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.