BleepingComputer.com: Browers (both Firefox & IE)are EXTREMELY slow & redirecting

First - I am not an expert, just a user.

Both of my browsers, Firefox and IE, are EXTREMELY slow when I am on the computer. Email, however, is either OK or only slightly slow, I can't distinguish for certain. However, when I switch users (I and my wife have access to the machine, both with full admin rights), the browsers are a little faster, but still slow.

Also, we both get an icon on my desktop named: fpfkbfxlzm.tmp If I delete the icon, it comes back when I load Firefox.

I use the most up-to-date version of Firefox, but an older version of IE (I very rarely use IE).

I have an older machine running XP SP3 on a Pentium 4 processor.

I have run both my AVIRA anti-virus (the premium version) and Malwarbytes anti-malware (the free version) but neither has eliminated the problem.

Below are my dds and gmer scans. Also I have an OTL scan if that is helpful


Please help. Thanks much.


-----------------------------------


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_20
Run by Luli at 23:48:02 on 2011-10-01
.
============== Running Processes ===============
.
C:\WINDOW2\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOW2\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOW2\system32\wscntfy.exe
C:\WINDOW2\Explorer.EXE
C:\WINDOW2\Mixer.exe
C:\Program Files\Norton SystemWorks\NswUiTray.exe
C:\WINDOW2\system32\RUNDLL32.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOW2\system32\rundll32.exe
C:\WINDOW2\system32\rundll32.exe
C:\WINDOW2\system32\dllhost.exe
C:\WINDOW2\system32\msdtc.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\WINDOW2\system32\wscntfy.exe
C:\WINDOW2\Explorer.EXE
C:\WINDOW2\Mixer.exe
C:\Program Files\Norton SystemWorks\NswUiTray.exe
C:\WINDOW2\system32\RUNDLL32.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Luli\My Documents\Downloads\fsbl.exe
C:\WINDOW2\system32\taskmgr.exe
C:\Documents and Settings\Luli\My Documents\Downloads\dds.scr
C:\WINDOW2\system32\wbem\wmiprvse.exe
C:\Program Files\Avira\AntiVir Desktop\checkt.exe
C:\WINDOW2\System32\svchost.exe -k netsvcs
C:\WINDOW2\system32\svchost.exe -k NetworkService
C:\WINDOW2\system32\svchost.exe -k LocalService
C:\WINDOW2\system32\svchost.exe -k LocalService
C:\WINDOW2\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
BHO: {07b10fd3-694f-4b43-866d-7fef0e396525} - c:\documents and settings\baba\local settings\application data\ExplorerCodec.dll
BHO: {0e33b7f1-b674-4f8d-8e83-6e56b158a840} - c:\documents and settings\baba\local settings\application data\ExplorerCodec.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
mRun: [C-Media Mixer] Mixer.exe /startup
mRun: [NSWosCheck] "c:\program files\norton systemworks\osCheck.exe"
mRun: [NswUiTray] c:\program files\norton systemworks\NswUiTray.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\window2\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\window2\system32\NvMcTray.dll,NvTaskbarInit
mRun: [OpwareSE2] "c:\program files\scansoft\omnipagese2.0\OpwareSE2.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [Western Digital Update] c:\documents and settings\baba\local settings\application data\western digital\westernupdate\Westernupdt32.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {5E638779-1818-4754-A595-EF1C63B87A56} - c:\program files\norton systemworks\norton cleanup\WCQuick.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
LSP: c:\program files\avira\antivir desktop\avsda.dll
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://sra.dot.gov/dana-cached/sc/JuniperSetupClient.cab
TCP: DhcpNameServer = 192.168.1.1 71.242.0.12
TCP: Interfaces\{17B7A976-DB18-48C7-AD20-F583F7824731} : DhcpNameServer = 192.168.1.1 71.242.0.12
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\window2\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\luli\application data\mozilla\firefox\profiles\jb86guyn.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - plugin: c:\documents and settings\baba\application data\move networks\plugins\npqmp071502000008.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\canon\zoombrowser ex\program\NPCIG.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPMGWRAP.DLL
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npsabffx.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
.
============= SERVICES / DRIVERS ===============
.
R? ivusb;Initio Driver for USB Default Controller
R? WDC_SAM;WD SCSI Pass Thru driver
R? WDDMService;WDDMService
R? WDFME;WD File Management Engine
S? AntiVirMailService;Avira AntiVir MailGuard
S? AntiVirSchedulerService;Avira AntiVir Scheduler
S? AntiVirService;Avira AntiVir Guard
S? AntiVirWebService;Avira AntiVir WebGuard
S? avgio;avgio
S? avgntflt;avgntflt
S? d8a4fef9-85c1-448f-a6f9-2570fb195020;d8a4fef9-85c1-448f-a6f9-2570fb195020
S? MBAMSwissArmy;MBAMSwissArmy
S? NProtectService;Norton UnErase Protection
S? WDSC;WD File Management Shadow Engine
.
=============== Created Last 30 ================
.
2011-10-01 17:09:48 41272 ----a-w- c:\window2\system32\drivers\mbamswissarmy.sys
2011-10-01 16:44:22 0 ---ha-w- c:\documents and settings\luli\fpfkbfxlzm.tmp
2011-10-01 16:23:41 -------- d-----w- C:\Computer
2011-09-28 15:29:31 82432 ----a-w- c:\documents and settings\all users.window2\application data\MicrosoftBackupPolicy.dll
2011-09-15 02:21:41 -------- d-----w- C:\Car Stuff
2011-09-09 03:39:55 -------- d-----w- c:\window2\Out of the Park Baseball
2011-09-05 17:04:56 183696 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll
2011-09-05 17:04:56 183696 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll
.
==================== Find3M ====================
.
2011-09-28 15:30:25 404640 ----a-w- c:\window2\system32\FlashPlayerCPLApp.cpl
2011-08-31 21:00:50 22216 ----a-w- c:\window2\system32\drivers\mbam.sys
2011-08-01 14:15:20 23386624 ----a-w- C:\WD Software Upgrader.msi
.
============= FINISH: 23:59:59.44 ===============



-------------------------------------



GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-10-03 13:04:11
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17 WDC_WD800JB-00FMA0 rev.13.03G13
Running: gmer.exe; Driver: C:\DOCUME~1\Luli\LOCALS~1\Temp\kglyyaow.sys


---- System - GMER 1.0.15 ----

SSDT B02D0284 ZwClose
SSDT B02D023E ZwCreateKey
SSDT B02D028E ZwCreateSection
SSDT B02D0234 ZwCreateThread
SSDT B02D0243 ZwDeleteKey
SSDT B02D024D ZwDeleteValueKey
SSDT B02D027F ZwDuplicateObject
SSDT B02D026B ZwLoadDriver
SSDT B02D0252 ZwLoadKey
SSDT B02D0220 ZwOpenProcess
SSDT B02D0225 ZwOpenThread
SSDT B02D025C ZwReplaceKey
SSDT B02D0257 ZwRestoreKey
SSDT B02D0293 ZwSetContextThread
SSDT B02D0270 ZwSetSystemInformation
SSDT B02D0248 ZwSetValueKey
SSDT B02D022F ZwTerminateProcess
SSDT B02D022A ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOW2\system32\DRIVERS\nv4_mini.sys section is writeable [0xB7CAF360, 0x37388D, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Classes\CLSID\{B05324BB-0A95-9FF9-C4D1-C9C1624F83E0}\AutoConvertTo@ {00020906-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\CLSID\{B05324BB-0A95-9FF9-C4D1-C9C1624F83E0}\DefaultIcon@ C:\PROGRA~1\MICROS~2\OFFICE11\WINWORD.EXE,1
Reg HKLM\SOFTWARE\Classes\CLSID\{B05324BB-0A95-9FF9-C4D1-C9C1624F83E0}\Insertable@
Reg HKLM\SOFTWARE\Classes\CLSID\{B05324BB-0A95-9FF9-C4D1-C9C1624F83E0}\NotInsertable@
Reg HKLM\SOFTWARE\Classes\CLSID\{B05324BB-0A95-9FF9-C4D1-C9C1624F83E0}\PersistentHandler@ {98de59a0-d175-11cd-a7bd-00006b827d94}
Reg HKLM\SOFTWARE\Classes\CLSID\{B05324BB-0A95-9FF9-C4D1-C9C1624F83E0}\ProgID@ Word.Document.6
Reg HKLM\SOFTWARE\Classes\CLSID\{B05324BB-0A95-9FF9-C4D1-C9C1624F83E0}\RTFClassName@MSWord6
Reg HKLM\SOFTWARE\Classes\CLSID\{B05324BB-0A95-9FF9-C4D1-C9C1624F83E0}\TreatAs@ {00020906-0000-0000-C000-000000000046}

---- EOF - GMER 1.0.15 ----

This post has been edited by jsaklas: 03 October 2011 - 04:48 PM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.
===

The file in bold looks suspicious.
c:\documents and settings\baba\local settings\application data\ExplorerCodec.dll

Lets find out what we are dealing with.

>>> Run Jotti's malware scan: Please copy this line (in bold):
c:\documents and settings\baba\local settings\application data\ExplorerCodec.dll

• Go to Jotti's malware scan and click the Browse button,
  
• A window will open, right-click in the File name field and choose Paste.
  
• Click the Submit button and let the scan run uninterrupted.
  
• At the end right-click the Permalink button and choose "Copy the link".
  
• Open Notepad (Start => All Programs => Accessories) and click "Edition" => "Paste".

Please copy and paste these Permalink in your next reply.
If Jotti is busy, please go to http://www.virustotal.com
===

Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  
  
• Some Rookit infection may damage your boot sector. The Windows Recovery Console may be needed to restore it. Do not bypass this installation. You may regret it.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Note: If you have difficulty properly disabling your protection programs, refer to this link --> http://www.bleepingcomputer.com/forums/topic114351.html

Do not mouse click ComboFix's window while it's running. That may cause it to stall
===

Third party programs if not up to date can be the cause infiltration of an infection.

Please run this security check for my review.

Download Security Check by screen317 from here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

===

Please post the logs and let me know if the problem persists.

nasdaq,

I want to thank you very much for being willing to help me. Currently, however, I am being helped by another on-line computer tech. I would like, if possible, once my work with him/her is complete "to check things out" with you, if that is agreeable with you. If you would rather not, I fully understand and I won't bother you.

Again, thanks much.

js