BleepingComputer.com: Whitesmoke Toolbar

My pc is at a crawl. I have Whitesmoke toolbar showing up in add and remove programs but can't remove it, not even in safe mode. My virus protection software and malwarebytes isn't picking anthing up either. Please help. I'm sure this is why my pc is lagging so terribly. Thanks in advance and I am posting my mbam log below.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7988

Windows 5.0.2195 Service Pack 4 (Safe Mode)
Internet Explorer 5.00.3700.1000

10/27/2011 9:26:42 PM
mbam-log-2011-10-27 (21-26-42).txt

Scan type: Full scan (C:\|)
Objects scanned: 238992
Time elapsed: 32 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hello,

Please follow the instructions in ==>This Guide<== starting at step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then post them in a reply to this topic by using the Add Reply button.

If you can produce at least some of the logs, then please create the post and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the reply and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

Please note that I am not a member of the Malware Removal Team and will not be assisting you in removing the infection. I'm simply helping you to post the information they need in order to assist you.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

Orange Blossom

I believe I am infected with a virus. My pc is running very slow and I have a program called Whitesmoke Toolbar appearing in ADD & Remove programs list and I can't remove it even in safe mode. Please help. My log files are as follows:

DDS Log:
.
DDS (Ver_2011-08-26.01) - FAT32x86
Internet Explorer: 5.00.3700.1000 BrowserJavaVersion: 1.6.0_29
Run by Tammy at 12:16:08 on 2011-10-28
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.256.9 [GMT -5:00]
.
.
============== Running Processes ===============
.
C:\WINNT\system32\spoolsv.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\WINNT\system32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINNT\explorer.exe
C:\Program Files\AVG\AVG9\avgscanx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Opera\opera.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3007394
mDefault_Page_URL = hxxp://www.msn.com
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: {167d9323-f7cc-48f5-948a-6f012831a69f} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {167d9323-f7cc-48f5-948a-6f012831a69f} - No File
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\system32\browseui.dll
mRun: [Synchronization Manager] mobsync.exe /logon
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
dRunOnce: [^SetupICWDesktop] c:\program files\internet explorer\connection wizard\icwconn1.exe /desktop
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
TCP: DhcpNameServer = 68.87.68.166 68.87.74.166
TCP: Interfaces\{6FF2B123-73F4-4773-94DB-D3F6EC6E7416} : DhcpNameServer = 68.87.68.166 68.87.74.166
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: nwprovau - nwprovau.dll
LSA: Authentication Packages = msv1_0 nwprovau
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\tammy howard\application data\mozilla\firefox\profiles\zi7oro3z.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3007394&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - WhiteSmoke Bar Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3007394&SearchSource=13
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSP;aswSP;c:\winnt\system32\drivers\aswSP.sys [2011-10-24 320856]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winnt\system32\drivers\avgldx86.sys [2011-10-25 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\winnt\system32\drivers\avgmfx86.sys [2011-10-25 29712]
R1 AvgTdiX;AVG Free Network Redirector;c:\winnt\system32\drivers\avgtdix.sys [2011-10-25 243152]
R2 aswFsBlk;aswFsBlk;c:\winnt\system32\drivers\aswFsBlk.sys [2011-10-24 20568]
R2 aswMon;aswMon;c:\winnt\system32\drivers\aswmon.sys [2011-10-24 104536]
S1 aswSnx;aswSnx;c:\winnt\system32\drivers\aswSnx.sys [2011-10-24 442200]
.
=============== Created Last 30 ================
.
2014-06-16 18:15:10 924632 ----a-w- c:\program files\mozilla firefox\firefox.exe
2014-06-16 18:15:10 715736 ----a-w- c:\program files\mozilla firefox\mozcrt19.dll
2014-06-16 18:15:10 269272 ----a-w- c:\program files\mozilla firefox\updater.exe
2014-06-16 18:15:10 269272 ----a-w- c:\program files\mozilla firefox\freebl3.dll
2014-06-16 18:15:10 19416 ----a-w- c:\program files\mozilla firefox\AccessibleMarshal.dll
2014-06-16 18:15:10 125912 ----a-w- c:\program files\mozilla firefox\crashreporter.exe
2014-06-16 17:36:12 71680 ------r- c:\program files\Setup.exe
2014-06-16 17:36:09 6758912 ------r- c:\program files\ps601up.exe
2014-06-16 17:36:09 652 ------r- c:\program files\layout.bin
2014-06-16 17:35:19 34816 ------r- c:\program files\_Setup.dll
2014-06-16 17:35:19 27648 ------r- c:\program files\_ISDel_old.exe
2014-06-16 17:35:19 27648 ------r- c:\program files\_ISDel.exe
2014-06-16 17:33:35 -------- d-sh--w- C:\Recycled
2014-06-16 17:19:05 -------- d-----w- c:\program files\common files\L&H
2014-06-16 17:18:05 -------- d-----w- c:\program files\Microsoft ActiveSync
2014-06-16 14:25:05 -------- d-----w- C:\SIERRA
2014-06-16 14:25:05 -------- d-----w- c:\program files\Sierra On-Line
2014-06-16 01:00:49 -------- d-----w- c:\program files\NetZero
2014-06-16 01:00:43 -------- d-----w- c:\program files\NetZeroInstaller
2014-06-16 01:00:40 -------- d-----w- c:\program files\Connection Wizard
2014-06-16 00:14:54 -------- d-----w- C:\DELL
2014-06-15 23:42:57 157696 ----a-w- c:\program files\windows media player\npdrmv2.dll
2014-06-15 23:42:47 196608 ----a-w- c:\program files\common files\system\ole db\sqlxmlx.dll
2014-06-15 23:42:46 86016 ----a-w- c:\program files\common files\system\ole db\msdatl3.dll
2014-06-15 23:39:06 36864 ----a-w- c:\program files\msn\msncorefiles\setup\msnunin.exe
2014-06-15 23:39:06 28672 ----a-w- c:\program files\msn\msncorefiles\setup\migrate.dll
2014-06-15 23:39:02 978944 ----a-w- c:\program files\msn\msncorefiles\msnmetal.dll
2014-06-15 23:39:02 94208 ----a-w- c:\program files\msn\msncorefiles\popc.dll
2014-06-15 23:39:02 94208 ----a-w- c:\program files\msn\msncorefiles\msnspell.dll
2014-06-15 23:39:02 77824 ----a-w- c:\program files\msn\msncorefiles\msnmtllc.dll
2014-06-15 23:39:02 57344 ----a-w- c:\program files\msn\msncorefiles\migrate.dll
2014-06-15 23:39:01 94208 ----a-w- c:\program files\msn\msncorefiles\msn6.exe
2014-06-15 23:39:01 61440 ----a-w- c:\program files\msn\msncorefiles\msdbx.dll
2014-06-15 23:39:01 360448 ----a-w- c:\program files\msn\msncorefiles\msmom.dll
2014-06-15 23:39:00 245760 ----a-w- c:\program files\msn\msncorefiles\logonmgr.dll
2014-06-15 23:39:00 162120 ----a-w- c:\program files\msn\msncorefiles\dw.exe
2014-06-15 23:38:59 77824 ----a-w- c:\program files\msn\msncorefiles\update.exe
2014-06-15 23:38:59 77824 ----a-w- c:\program files\msn\msncorefiles\copymar.exe
2014-06-15 23:38:59 24576 ----a-w- c:\program files\msn\msncorefiles\custdial.dll
2014-06-15 23:38:59 -------- d-----w- c:\program files\Windows NT
2014-06-15 23:30:59 -------- d-----w- c:\program files\common files\ODBC
2014-06-15 23:30:57 61440 ----a-w- c:\program files\common files\microsoft shared\speech\1033\spcplui.dll
2014-06-15 23:30:50 36864 ----a-w- c:\program files\common files\microsoft shared\speech\sapisvr.exe
2014-06-15 23:30:50 -------- d-----w- c:\program files\common files\SpeechEngines
2014-06-15 23:30:49 696320 ----a-w- c:\program files\common files\microsoft shared\speech\sapi.dll
2014-06-15 23:29:02 -------- d-----w- C:\Documents and Settings
2014-06-15 23:02:42 -------- d-----w- C:\$WIN_NT$.~LS
2014-06-15 23:02:41 -------- d-----w- C:\$WIN_NT$.~BT
2014-06-15 22:49:12 -------- d-----w- C:\NCDTREE
2014-06-15 01:07:42 -------- d-----w- C:\My Documents
2014-06-15 01:02:14 -------- d-----w- c:\program files\DirectX
2011-10-28 06:40:01 -------- d--h--w- C:\$AVG
2011-10-27 21:13:04 -------- d-----w- c:\documents and settings\tammy howard\application data\AVG9
2011-10-27 20:40:04 -------- d-----w- C:\FOUND.000
2011-10-25 11:27:14 12536 ----a-w- c:\winnt\system32\avgrsstx.dll
2011-10-25 11:27:13 243152 ----a-w- c:\winnt\system32\drivers\avgtdix.sys
2011-10-25 11:26:42 216400 ----a-w- c:\winnt\system32\drivers\avgldx86.sys
2011-10-25 11:26:28 -------- d-----w- c:\winnt\system32\drivers\Avg
2011-10-25 11:26:25 -------- d-----w- c:\documents and settings\all users.winnt\application data\AVG Security Toolbar
2011-10-25 11:25:47 -------- d-----w- c:\program files\AVG
2011-10-25 11:25:47 -------- d-----w- c:\documents and settings\all users.winnt\application data\avg9
2011-10-25 10:14:29 -------- d-----w- c:\documents and settings\all users.winnt\application data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
2011-10-25 09:07:26 499712 ----a-w- c:\winnt\system32\msvcp71.dll
2011-10-25 09:07:26 348160 ----a-w- c:\winnt\system32\msvcr71.dll
2011-10-25 09:02:35 -------- d-----w- c:\documents and settings\tammy howard\application data\GetRightToGo
2011-10-25 04:40:31 442200 ----a-w- c:\winnt\system32\drivers\aswSnx.sys
2011-10-25 04:38:46 41184 ----a-w- c:\winnt\avastSS.scr
2011-10-25 04:36:46 -------- d-----w- c:\program files\AVAST Software
2011-10-25 04:36:46 -------- d-----w- c:\documents and settings\all users.winnt\application data\AVAST Software
2011-10-25 03:32:19 -------- d-----w- c:\winnt\system32\Windows Media
2011-10-25 03:31:00 -------- d--h--w- c:\winnt\$NtUpdateRollupPackUninstall$
2011-10-25 03:30:55 -------- d-----w- c:\winnt\msiinst.tmp
2011-10-25 03:18:58 -------- d-----w- c:\documents and settings\tammy howard\local settings\application data\PackageAware
2011-10-25 02:47:15 -------- d-----w- c:\documents and settings\tammy howard\local settings\application data\Adobe
2011-10-25 02:42:55 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-10-25 01:53:39 -------- d-----w- c:\program files\Conduit
2011-10-25 01:53:30 -------- d-----w- c:\documents and settings\tammy howard\local settings\application data\WhiteSmoke_Bar
2011-10-25 01:53:25 -------- d-----w- c:\documents and settings\tammy howard\local settings\application data\Conduit
2011-10-25 01:53:20 -------- d-----w- c:\program files\WhiteSmoke_Bar
2011-10-25 01:18:11 17280 ----a-w- c:\winnt\system32\roboot.exe
2011-10-25 00:52:15 -------- d--h--w- c:\documents and settings\all users.winnt\application data\Common Files
2011-10-25 00:52:04 -------- d-----w- c:\documents and settings\all users.winnt\application data\MFAData
2011-10-23 21:13:59 40448 ----a-w- c:\winnt\system32\dllcache\mwmmw32.dll
2011-10-23 21:12:59 77072 ----a-w- c:\winnt\system32\dllcache\iislog.dll
2011-10-23 21:11:59 7440 ----a-w- c:\winnt\system32\dllcache\fs2.dll
2011-10-23 21:11:59 36112 ----a-w- c:\winnt\system32\dllcache\controt.dll
2011-10-23 21:11:58 52496 ----a-w- c:\winnt\system32\dllcache\adrot.dll
2011-10-23 21:09:59 69708 ----a-w- c:\winnt\system32\wbem\provthrd.dll
2011-10-23 21:04:11 61712 ----a-w- c:\winnt\system32\drivers\el90xbc5.sys
2011-10-23 21:02:53 148992 ----a-w- c:\winnt\system32\spxcoins.dll
2011-10-23 21:02:47 1167584 ----a-r- c:\winnt\SET52.tmp
2011-10-23 21:02:43 13785 ----a-r- c:\winnt\SET2A.tmp
2011-10-23 20:46:50 -------- d-----w- c:\program files\PopCap Games
2011-10-23 20:40:24 -------- d-----w- c:\documents and settings\tammy howard\local settings\application data\Help
2011-10-23 19:49:30 -------- d-----w- c:\program files\MagicISO
2011-10-23 18:56:27 -------- d-----w- c:\winnt\DrWatson
2011-10-21 22:43:34 73728 ----a-w- c:\winnt\system32\javacpl.cpl
2011-10-21 22:43:34 472808 ----a-w- c:\winnt\system32\deployJava1.dll
2011-10-20 16:58:07 -------- d-----w- c:\documents and settings\tammy howard\application data\Malwarebytes
2011-10-20 16:57:56 -------- d-----w- c:\documents and settings\all users.winnt\application data\Malwarebytes
2011-10-20 16:57:47 20552 ----a-w- c:\winnt\system32\drivers\mbam.sys
2011-10-20 16:57:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-10-18 23:36:31 -------- d-----w- c:\winnt\winsxs
2011-10-18 02:09:49 -------- d-----w- c:\documents and settings\tammy howard\local settings\application data\Opera
2011-10-18 02:02:28 -------- d-----w- c:\documents and settings\tammy howard\local settings\application data\Mozilla
2011-10-18 02:02:18 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-10-18 02:02:18 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-10-18 00:34:00 -------- d-----w- c:\program files\Yahoo!
2011-10-18 00:19:59 491768 ----a-w- c:\program files\internet explorer\ie6setup.exe
2011-10-18 00:19:37 -------- d-----w- c:\winnt\RegisteredPackages
2011-10-18 00:15:09 -------- d--h--w- c:\winnt\msdownld.tmp
2011-10-18 00:15:05 -------- d-----w- c:\winnt\Windows Update Setup Files
2011-10-17 21:16:05 5359888 ----a-w- c:\winnt\uninst.exe
2011-10-17 21:16:01 -------- d-----w- c:\documents and settings\all users.winnt\application data\PC1Data
2011-10-17 21:12:11 222080 ------w- c:\winnt\system32\MpSigStub.exe
.
==================== Find3M ====================
.
.
============= FINISH: 12:25:10.22 ===============

 ark.txt (5.78K)
Number of downloads: 0
 Attach.txt (1.5K)
Number of downloads: 1

This post has been edited by Orange Blossom: 29 October 2011 - 09:36 AM
Reason for edit: Merged topics. ~ OB

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

• Do not run any other tool untill instructed to do so!
  
• Please Do not Attach logs or put in code boxes.
  
• Tell me about any problems that have occurred during the fix.
  
• Tell me of any other symptoms you may be having as these can help also.
  
• Do not run anything while running a fix.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

In order for me to see the status of the infection I will need a new set of logs to start with.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

DeFogger:

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

• The application window will appear
  
• Click the Disable button to disable your CD Emulation drivers
  
• Click Yes to continue
  
• A 'Finished!' message will appear
  
• Click OK
  
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.

Download DDS:

Please download DDS by sUBs from one of the links below and save it to your desktop:


Download DDS and save it to your desktop

Link1
Link2
Link3

Please disable any anti-malware program that will block scripts from running before running DDS.


• Double-Click on dds.scr and a command window will appear. This is normal.
  
• Shortly after two logs will appear:
  
  • DDS.txt
    
  • Attach.txt
  
  
• A window will open instructing you save & post the logs
  
• Save the logs to a convenient place such as your desktop
  
• Copy the contents of both logs & post in your next reply

Scan With RKUnHooker

• Please Download Rootkit Unhooker Save it to your desktop.
  
• Now double-click on RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan.
  
• Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
  
• Wait till the scanner has finished and then click File, Save Report.
  
• Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

"just click on Cancel, then Accept".

information and logs:

In your next post I need the following


• .logs from DDS
  
• log from RKUnHooker
  
• let me know of any problems you may have had

Gringo

Hello

48 Hour bump

It has been more than 48 hours since my last post.

• do you still need help with this?
  
• do you need more time?
  
• are you having problems following my instructions?
  
• if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.