Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser Hijack When clicking on Google results


  • This topic is locked This topic is locked
11 replies to this topic

#1 rsowen

rsowen

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Location:Toronto
  • Local time:08:16 PM

Posted 28 February 2009 - 06:00 PM

Hi Everyone,

Thanks in advance. I have run the usual scans, ran atf-cleaner, and attempted my own amateur hjt analysis, but I can't figure this one out. I get redirected to an unrelated site after I click thru a google search result. I had attempted to run the dds file, as per the site recommendation, but I would just get a black box pop up for a flash, and then nothing...so not sure what's going on there. The following is my HijackThis log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:47:13 PM, on 28/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\Program Files\Rogers\SelfHealing\RogersSelfHelpService.exe
C:\Program Files\Rogers\Update Manager\RogersUpdateManager.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\HPQ\IAM\bin\asghost.exe
C:\Program Files\ProtectTools\Embedded Security Software\PSDrt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ProtectTools\Embedded Security Software\SpTna.exe
C:\Program Files\HPQ\HP ProtectTools Security Manager\PTServs.exe
C:\WINDOWS\system32\AccelerometerSt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1195162506765
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Update Service (gupdate1c913c3c8f01ee0) (gupdate1c913c3c8f01ee0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
O23 - Service: Rogers SHS Service (RogersSelfHelpService) - Rogers Cable Communications - C:\Program Files\Rogers\SelfHealing\RogersSelfHelpService.exe
O23 - Service: Rogers Update Manager (RogersUpdateManager) - Rogers Cable Communications - C:\Program Files\Rogers\Update Manager\RogersUpdateManager.exe

--
End of file - 14940 bytes

BC AdBot (Login to Remove)

 


#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:16 AM

Posted 28 February 2009 - 10:30 PM

Hi,

Thanks in advance. I have run the usual scans, ran atf-cleaner, and attempted my own amateur hjt analysis, but I can't figure this one out. I get redirected to an unrelated site after I click thru a google search result. I had attempted to run the dds file, as per the site recommendation, but I would just get a black box pop up for a flash, and then nothing...so not sure what's going on there. The following is my HijackThis log.

This smells like you're dealing with the latest Win32:Daonol variant, because it crashes many tools including Combofix, regedit etc etc.. Not sure if this is by design or because it's buggy. Also, it's loaded in a few processes such as explorer.exe, winlogon.exe, your browser etc..

Do next please..

Open HijackThis and click Config below > Misc Tools button on top. (or "Open the Misc Tools section" via the main screen)
There, click the "Open Process Manager" button.
On top, on the right, select "Show DDLs"
Then highlight the process Winlogon.exe
Then click the "copy list to clipboard" button or "save list to file" button on top.

Posted Image

This will create a log with the Winlogon.exe handles below. Please copy and paste the contents of this log in your next reply. I actually only need the part under: "DLLs loaded by process C:\WINDOWS\system32\winlogon.exe:"
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 rsowen

rsowen
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Location:Toronto
  • Local time:08:16 PM

Posted 01 March 2009 - 12:40 PM

miekiemoes, thanks for the help. Attached is the relevant section of the log as per your request:

DLLs loaded by process C:\WINDOWS\system32\winlogon.exe:

[full path to filename] [file version] [company name]
C:\WINDOWS\system32\ntdll.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\kernel32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\ADVAPI32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\RPCRT4.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\Secur32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\AUTHZ.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\msvcrt.dll 7.0.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\CRYPT32.dll 5.131.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MSASN1.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\USER32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\GDI32.dll 5.1.2600.5698 Microsoft Corporation
C:\WINDOWS\system32\NDdeApi.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\PROFMAP.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\NETAPI32.dll 5.1.2600.5694 Microsoft Corporation
C:\WINDOWS\system32\USERENV.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\PSAPI.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\REGAPI.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\SETUPAPI.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\VERSION.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINSTA.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINTRUST.dll 5.131.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\IMAGEHLP.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WS2_32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WS2HELP.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\IMM32.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\LPK.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\USP10.dll 1.420.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MSGINA.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\COMCTL32.dll 5.82.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\ODBC32.dll 3.525.1132.0 Microsoft Corporation
C:\WINDOWS\system32\comdlg32.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\SHELL32.dll 6.0.2900.5622 Microsoft Corporation
C:\WINDOWS\system32\SHLWAPI.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\odbcint.dll 3.525.1132.0 Microsoft Corporation
C:\WINDOWS\system32\SHSVCS.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\sfc.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\sfc_os.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\ole32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\Apphelp.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\msctfime.ime 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\sxs.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINSCARD.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WTSAPI32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINMM.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\wininet.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\Normaliz.dll 6.0.5441.0 Microsoft Corporation
C:\WINDOWS\system32\iertutil.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\uxtheme.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\avgrsstx.dll 8.0.0.223 AVG Technologies CZ, s.r.o.
C:\WINDOWS\system32\cscdll.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\dimsntfy.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\rsaenh.dll 5.1.2600.5507 Microsoft Corporation
C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll 1.5.0.37 Cognizance Corporation
C:\WINDOWS\system32\OLEAUT32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MSVCR70.dll 7.0.9466.0 Microsoft Corporation
C:\WINDOWS\system32\WlNotify.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MPR.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINSPOOL.DRV 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WgaLogon.dll 1.8.31.9 Microsoft Corporation
C:\WINDOWS\system32\NTMARTA.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\SAMLIB.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WLDAP32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\CLBCATQ.DLL 2001.12.4414.700 Microsoft Corporation
C:\WINDOWS\system32\COMRes.dll 2001.12.4414.700 Microsoft Corporation
C:\WINDOWS\system32\msxml3.dll 8.100.1048.0 Microsoft Corporation
C:\Program Files\IBM\Client Access\Shared\Cwbnetnt.dll 9.0.0.0 IBM Corporation
C:\WINDOWS\system32\cscui.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\xpsp2res.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\drprov.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\ntlanman.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\NETUI0.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\NETUI1.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\NETRAP.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\davclnt.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MPRUI.dll 5.1.2600.0 Microsoft Corporation
C:\WINDOWS\system32\NETUI2.dll 5.1.2600.0 Microsoft Corporation
C:\WINDOWS\system32\netmsg.dll 5.1.2600.0 Microsoft Corporation
C:\WINDOWS\system32\msi.dll 3.1.4001.5512 Microsoft Corporation
C:\WINDOWS\system32\msv1_0.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\iphlpapi.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\wdmaud.drv 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\msacm32.drv 5.1.2600.0 Microsoft Corporation
C:\WINDOWS\system32\MSACM32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\midimap.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\IfxWlxEN.dll 2.1.593.0 Infineon Technologies AG
C:\WINDOWS\system32\OLEACC.dll 4.2.5406.0 Microsoft Corporation
C:\WINDOWS\system32\MSVCP60.dll 6.2.3104.0 Microsoft Corporation
C:\WINDOWS\system32\ES.DLL 2001.12.4414.706 Microsoft Corporation

#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:16 AM

Posted 01 March 2009 - 12:57 PM

Hi,

Hi, I see it's not showing here under the winlogon.exe (I supposed it was loaded under there as well since wdmaud.drv is loaded under it, but it must be from another reference in the registry instead of "aux*"). So let's use another process instead where I'm sure it will be loaded. So can you do the same and highlight the process iexplore.exe instead and create a log from it? Your internet explorer should be launched to find the process. Or if you use firefox, use the process firefox instead.

Edited by miekiemoes, 01 March 2009 - 01:15 PM.

AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:16 AM

Posted 01 March 2009 - 02:06 PM

Hi,

Ignore my previous steps, I'm helping someone else with this as well and the Hijackthis exports won't show anything.

Please do next... Navigate to your C:\Windows folder and search for the file regedit.exe
Rightclick it and select to rename the file. Rename it to reg3dit.exe
Then launch the reg3dit.exe in order to open your Registry Editor.

There, browse to the following key:

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32

You'll see on the left that you can expand the keys (they will look like folders). So expand them until you get drivers32
Rightclick the drivers32 key (folder) and select to export:

Posted Image

Give it a name and export it as a txtfile on your desktop.


Then copy and paste the contents of it in your next reply.

If confused, please ask first.

Edited by miekiemoes, 01 March 2009 - 02:07 PM.

AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#6 rsowen

rsowen
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Location:Toronto
  • Local time:08:16 PM

Posted 01 March 2009 - 02:08 PM

Sincerely appreciate this. Also actually enjoying the process! I have included the firefox & iexplore logs:

DLLs loaded by process C:\Program Files\Mozilla Firefox\firefox.exe:

[full path to filename] [file version] [company name]
C:\WINDOWS\system32\ntdll.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\kernel32.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Mozilla Firefox\xul.dll 1.9.0.3306 Mozilla Foundation
C:\Program Files\Mozilla Firefox\sqlite3.dll 3.5.9.0 sqlite.org
C:\Program Files\Mozilla Firefox\MOZCRT19.dll 8.0.0.0 Mozilla Foundation
C:\WINDOWS\system32\msvcrt.dll 7.0.2600.5512 Microsoft Corporation
C:\Program Files\Mozilla Firefox\js3250.dll 4.0.0.0 Netscape Communications Corporation
C:\Program Files\Mozilla Firefox\nspr4.dll 4.7.3.0 Mozilla Foundation
C:\WINDOWS\system32\ADVAPI32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\RPCRT4.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\Secur32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WSOCK32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WS2_32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WS2HELP.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINMM.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\GDI32.dll 5.1.2600.5698 Microsoft Corporation
C:\WINDOWS\system32\USER32.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Mozilla Firefox\smime3.dll 3.12.2.0 Mozilla Foundation
C:\Program Files\Mozilla Firefox\nss3.dll 3.12.2.0 Mozilla Foundation
C:\Program Files\Mozilla Firefox\nssutil3.dll 3.12.2.0 Mozilla Foundation
C:\Program Files\Mozilla Firefox\plc4.dll 4.7.3.0 Mozilla Foundation
C:\Program Files\Mozilla Firefox\plds4.dll 4.7.3.0 Mozilla Foundation
C:\Program Files\Mozilla Firefox\ssl3.dll 3.12.2.0 Mozilla Foundation
C:\WINDOWS\system32\SHELL32.dll 6.0.2900.5622 Microsoft Corporation
C:\WINDOWS\system32\SHLWAPI.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\ole32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\VERSION.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINSPOOL.DRV 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\COMDLG32.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\IMM32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MSIMG32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\USP10.dll 1.420.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\OLEAUT32.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Mozilla Firefox\xpcom.dll 1.9.0.3306 Mozilla Foundation
C:\WINDOWS\system32\LPK.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\wininet.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\Normaliz.dll 6.0.5441.0 Microsoft Corporation
C:\WINDOWS\system32\iertutil.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\dbghelp.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\uxtheme.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\MSCTF.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\SETUPAPI.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\msctfime.ime 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\CLBCATQ.DLL 2001.12.4414.700 Microsoft Corporation
C:\WINDOWS\system32\COMRes.dll 2001.12.4414.700 Microsoft Corporation
C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll 1.9.0.3306 Mozilla Foundation
C:\Program Files\Google\Google Gears\Firefox\components\gears.dll
C:\WINDOWS\system32\mswsock.dll 5.1.2600.5625 Microsoft Corporation
C:\WINDOWS\system32\hnetcfg.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\wshtcpip.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\iphlpapi.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\DNSAPI.dll 5.1.2600.5625 Microsoft Corporation
C:\WINDOWS\System32\winrnr.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WLDAP32.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Bonjour\mdnsNSP.dll 1.0.5.11 Apple Inc.
C:\WINDOWS\system32\xpsp2res.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll 1.9.0.3306 Mozilla Foundation
C:\WINDOWS\system32\netapi32.dll 5.1.2600.5694 Microsoft Corporation
C:\WINDOWS\system32\appHelp.dll 5.1.2600.5512 Microsoft Corporation
C:\PROGRA~1\WIFD1F~1\MpShHook.dll 1.1.1593.0 Microsoft Corporation
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll 8.0.-14809.1433 Microsoft Corporation
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCP80.dll 8.0.-14809.1433 Microsoft Corporation
C:\WINDOWS\system32\rsaenh.dll 5.1.2600.5507 Microsoft Corporation
C:\WINDOWS\system32\urlmon.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\rasadhlp.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Mozilla Firefox\softokn3.dll 3.12.2.0 Mozilla Foundation
C:\Program Files\Mozilla Firefox\nssdbm3.dll 3.12.2.0 Mozilla Foundation
C:\Program Files\Mozilla Firefox\freebl3.dll 3.12.2.0 Mozilla Foundation
C:\Program Files\Mozilla Firefox\nssckbi.dll 1.73.0.0 Mozilla Foundation
C:\Program Files\AVG\AVG8\Firefox\components\avgssff.dll 8.0.0.223 AVG Technologies CZ, s.r.o.
C:\Program Files\AVG\AVG8\avgxpl.dll 8.0.0.223 AVG Technologies CZ, s.r.o.
C:\Program Files\AVG\AVG8\avgapix.dll 8.0.0.237 AVG Technologies CZ, s.r.o.
C:\Program Files\AVG\AVG8\avgcfgx.dll 8.0.0.223 AVG Technologies CZ, s.r.o.
C:\Program Files\AVG\AVG8\avglogx.dll 8.0.0.224 AVG Technologies CZ, s.r.o.
C:\Program Files\AVG\AVG8\avglngx.dll 8.0.0.237 AVG Technologies CZ, s.r.o.
C:\WINDOWS\system32\mslbui.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\shdocvw.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\CRYPT32.dll 5.131.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MSASN1.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\CRYPTUI.dll 5.131.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINTRUST.dll 5.131.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\IMAGEHLP.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\mlang.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\wdmaud.drv 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\msacm32.drv 5.1.2600.0 Microsoft Corporation
C:\WINDOWS\system32\MSACM32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\midimap.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\schannel.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\USERENV.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\HPQ\IAM\Bin\SFSShell.dll 1.21.0.143 Cognizance Corporation
C:\WINDOWS\system32\MSVCR70.dll 7.0.9466.0 Microsoft Corporation
C:\Program Files\HPQ\IAM\bin\ItMsg.dll 1.18.0.305 Cognizance Corporation
C:\WINDOWS\System32\cscui.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\CSCDLL.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\browseui.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\ntshrui.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\ATL.DLL 3.5.2284.1 Microsoft Corporation
C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\PDFShell.dll 7.0.0.0 Adobe Systems, Inc.
C:\WINDOWS\system32\RASAPI32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\rasman.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\TAPI32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\rtutils.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\msv1_0.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\sensapi.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\ieframe.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\PSAPI.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll 10.0.12.36
C:\WINDOWS\system32\mscms.dll 5.1.2600.5627 Microsoft Corporation
C:\WINDOWS\system32\netman.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MPRAPI.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\ACTIVEDS.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\adsldpc.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\SAMLIB.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\netshell.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\credui.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\dot3api.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\dot3dlg.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\OneX.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WTSAPI32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINSTA.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\eappcfg.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MSVCP60.dll 6.2.3104.0 Microsoft Corporation
C:\WINDOWS\system32\eappprxy.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WZCSAPI.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WZCSvc.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WMI.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\DHCPCSVC.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\EapolQec.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\QUtil.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\ESENT.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\icm32.dll 5.1.2600.5512 Microsoft Corporation



***********************************************************************

DLLs loaded by process C:\Program Files\Internet Explorer\iexplore.exe:

[full path to filename] [file version] [company name]
C:\WINDOWS\system32\ntdll.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\kernel32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\ADVAPI32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\RPCRT4.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\Secur32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\GDI32.dll 5.1.2600.5698 Microsoft Corporation
C:\WINDOWS\system32\USER32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\msvcrt.dll 7.0.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\SHLWAPI.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\SHELL32.dll 6.0.2900.5622 Microsoft Corporation
C:\WINDOWS\system32\ole32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\urlmon.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\OLEAUT32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\iertutil.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\VERSION.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\IMM32.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\LPK.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\USP10.dll 1.420.2600.5512 Microsoft Corporation
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\comctl32.dll 5.82.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\IEFRAME.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\PSAPI.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\UxTheme.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\MSCTF.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\xpsp2res.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\msctfime.ime 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\IEUI.dll 7.0.5730.13 Microsoft Corporation
C:\WINDOWS\system32\MSIMG32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4\gdiplus.dll 5.1.3102.5581 Microsoft Corporation
C:\WINDOWS\system32\xmllite.dll 1.0.1018.0 Microsoft Corporation
C:\WINDOWS\system32\apphelp.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\CLBCATQ.DLL 2001.12.4414.700 Microsoft Corporation
C:\WINDOWS\system32\COMRes.dll 2001.12.4414.700 Microsoft Corporation
C:\WINDOWS\system32\msimtf.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\mslbui.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\HPQ\IAM\Bin\SFSShell.dll 1.21.0.143 Cognizance Corporation
C:\WINDOWS\system32\MSVCR70.dll 7.0.9466.0 Microsoft Corporation
C:\Program Files\HPQ\IAM\bin\ItMsg.dll 1.18.0.305 Cognizance Corporation
C:\WINDOWS\System32\cscui.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\CSCDLL.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\SETUPAPI.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Microsoft Office\Office12\msohevi.dll 12.0.4518.1014 Microsoft Corporation
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll 8.0.-14809.1433 Microsoft Corporation
C:\Program Files\Internet Explorer\ieproxy.dll 7.0.5730.13 Microsoft Corporation
C:\WINDOWS\system32\msi.dll 3.1.4001.5512 Microsoft Corporation
C:\WINDOWS\system32\SXS.DLL 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WININET.dll 7.0.6000.16791 Microsoft Corporation
C:\WINDOWS\system32\Normaliz.dll 6.0.5441.0 Microsoft Corporation
C:\WINDOWS\system32\MLANG.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\ws2_32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WS2HELP.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll 7.0.9.50 Adobe Systems Incorporated
C:\WINDOWS\system32\MSVCR71.dll 7.10.3052.4 Microsoft Corporation
C:\Program Files\AVG\AVG8\avgssie.dll 8.0.0.223 AVG Technologies CZ, s.r.o.
C:\Program Files\AVG\AVG8\avgapix.dll 8.0.0.237 AVG Technologies CZ, s.r.o.
C:\WINDOWS\system32\USERENV.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\AVG\AVG8\avgxpl.dll 8.0.0.223 AVG Technologies CZ, s.r.o.
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCP80.dll 8.0.-14809.1433 Microsoft Corporation
C:\WINDOWS\system32\WINMM.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\AVG\AVG8\avgcfgx.dll 8.0.0.223 AVG Technologies CZ, s.r.o.
C:\Program Files\AVG\AVG8\avglogx.dll 8.0.0.224 AVG Technologies CZ, s.r.o.
C:\Program Files\AVG\AVG8\avglngx.dll 8.0.0.237 AVG Technologies CZ, s.r.o.
C:\WINDOWS\System32\DLA\DLASHX_W.DLL 5.20.23.0 Sonic Solutions
C:\WINDOWS\system32\DLAAPI_W.DLL 5.20.23.0 Sonic Solutions
C:\WINDOWS\System32\DLA\DLACResW.dll 5.20.23.0 Sonic Solutions
C:\Program Files\Java\jre6\bin\ssv.dll 6.0.110.3 Sun Microsystems, Inc.
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 4.200.520.1 Microsoft Corporation
C:\WINDOWS\system32\rsaenh.dll 5.1.2600.5507 Microsoft Corporation
C:\Program Files\Common Files\Microsoft Shared\Windows Live\msidcrl40.dll 4.200.520.1 Microsoft Corporation
C:\WINDOWS\system32\CRYPT32.dll 5.131.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\MSASN1.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\OLEACC.dll 4.2.5406.0 Microsoft Corporation
C:\WINDOWS\system32\MSVCP60.dll 6.2.3104.0 Microsoft Corporation
C:\WINDOWS\system32\SensApi.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINTRUST.dll 5.131.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\IMAGEHLP.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\netapi32.dll 5.1.2600.5694 Microsoft Corporation
C:\WINDOWS\system32\cryptnet.dll 5.131.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WINHTTP.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\WLDAP32.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll 7.0.9.50 Adobe Systems Incorporated
C:\WINDOWS\system32\ATL71.DLL 7.10.3077.0 Microsoft Corporation
C:\WINDOWS\system32\MSVCP71.dll 7.10.3077.0 Microsoft Corporation
C:\Program Files\Java\jre6\bin\jp2ssv.dll 6.0.110.3 Sun Microsystems, Inc.
C:\WINDOWS\system32\msxml3.dll 8.100.1048.0 Microsoft Corporation
C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll 1.1.0.69 Infineon Technologies AG
C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll 0.5.4.2 Google Inc.
C:\WINDOWS\system32\comdlg32.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\dbghelp.dll 5.1.2600.5512 Microsoft Corporation
C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 6.0.110.3 Sun Microsystems, Inc.
C:\WINDOWS\system32\mswsock.dll 5.1.2600.5625 Microsoft Corporation
C:\WINDOWS\system32\hnetcfg.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\System32\wshtcpip.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\RASAPI32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\rasman.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\TAPI32.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\rtutils.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\msv1_0.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\iphlpapi.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\rasadhlp.dll 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\DNSAPI.dll 5.1.2600.5625 Microsoft Corporation
C:\Program Files\Bonjour\mdnsNSP.dll 1.0.5.11 Apple Inc.
C:\WINDOWS\system32\actxprxy.dll 6.0.2900.5512 Microsoft Corporation
C:\WINDOWS\system32\mshtml.dll 7.0.6000.16809 Microsoft Corporation
C:\WINDOWS\system32\msls31.dll 3.10.349.0 Microsoft Corporation
C:\Program Files\HPQ\IAM\Bin\ItSSO.dll 1.5.3.319 Cognizance Corporation
C:\WINDOWS\system32\jscript.dll 5.7.0.18066 Microsoft Corporation
C:\WINDOWS\system32\iepeers.dll 7.0.5730.13 Microsoft Corporation
C:\WINDOWS\system32\WINSPOOL.DRV 5.1.2600.5512 Microsoft Corporation
C:\WINDOWS\system32\mshtmled.dll 7.0.6000.16791 Microsoft Corporation
C:\Program Files\HPQ\IAM\Bin\Aswallet.dll 1.9.0.79 Cognizance Corporation
C:\WINDOWS\system32\ImgUtil.dll 7.0.5730.13 Microsoft Corporation
C:\WINDOWS\system32\pngfilt.dll 7.0.6000.16791 Microsoft Corporation

#7 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:16 AM

Posted 01 March 2009 - 02:10 PM

Hi,

I have posted a new set instructions right before you posted, so please scroll up and read them :thumbup2:
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#8 rsowen

rsowen
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Location:Toronto
  • Local time:08:16 PM

Posted 01 March 2009 - 02:16 PM

Hi,

Ignore my previous steps, I'm helping someone else with this as well and the Hijackthis exports won't show anything.

Please do next... Navigate to your C:\Windows folder and search for the file regedit.exe
Rightclick it and select to rename the file. Rename it to reg3dit.exe
Then launch the reg3dit.exe in order to open your Registry Editor.


Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
Class Name: <NO CLASS>
Last Write Time: 2/19/2009 - 6:53 PM
Value 0
Name: midimapper
Type: REG_SZ
Data: midimap.dll

Value 1
Name: msacm.imaadpcm
Type: REG_SZ
Data: imaadp32.acm

Value 2
Name: msacm.msadpcm
Type: REG_SZ
Data: msadp32.acm

Value 3
Name: msacm.msg711
Type: REG_SZ
Data: msg711.acm

Value 4
Name: msacm.msgsm610
Type: REG_SZ
Data: msgsm32.acm

Value 5
Name: msacm.trspch
Type: REG_SZ
Data: tssoft32.acm

Value 6
Name: vidc.cvid
Type: REG_SZ
Data: iccvid.dll

Value 7
Name: VIDC.I420
Type: REG_SZ
Data: msh263.drv

Value 8
Name: vidc.iv31
Type: REG_SZ
Data: ir32_32.dll

Value 9
Name: vidc.iv32
Type: REG_SZ
Data: ir32_32.dll

Value 10
Name: vidc.iv41
Type: REG_SZ
Data: ir41_32.ax

Value 11
Name: VIDC.IYUV
Type: REG_SZ
Data: iyuv_32.dll

Value 12
Name: vidc.mrle
Type: REG_SZ
Data: msrle32.dll

Value 13
Name: vidc.msvc
Type: REG_SZ
Data: msvidc32.dll

Value 14
Name: VIDC.UYVY
Type: REG_SZ
Data: msyuv.dll

Value 15
Name: VIDC.YUY2
Type: REG_SZ
Data: msyuv.dll

Value 16
Name: VIDC.YVU9
Type: REG_SZ
Data: tsbyuv.dll

Value 17
Name: VIDC.YVYU
Type: REG_SZ
Data: msyuv.dll

Value 18
Name: wavemapper
Type: REG_SZ
Data: msacm32.drv

Value 19
Name: msacm.msg723
Type: REG_SZ
Data: msg723.acm

Value 20
Name: vidc.M263
Type: REG_SZ
Data: msh263.drv

Value 21
Name: vidc.M261
Type: REG_SZ
Data: msh261.drv

Value 22
Name: msacm.msaudio1
Type: REG_SZ
Data: msaud32.acm

Value 23
Name: msacm.sl_anet
Type: REG_SZ
Data: sl_anet.acm

Value 24
Name: msacm.iac2
Type: REG_SZ
Data: C:\WINDOWS\system32\iac25_32.ax

Value 25
Name: vidc.iv50
Type: REG_SZ
Data: ir50_32.dll

Value 26
Name: msacm.l3acm
Type: REG_SZ
Data: C:\WINDOWS\system32\l3codeca.acm

Value 27
Name: wave1
Type: REG_SZ
Data: wdmaud.drv

Value 28
Name: midi1
Type: REG_SZ
Data: wdmaud.drv

Value 29
Name: mixer1
Type: REG_SZ
Data: wdmaud.drv

Value 30
Name: wave2
Type: REG_SZ
Data: wdmaud.drv

Value 31
Name: midi2
Type: REG_SZ
Data: wdmaud.drv

Value 32
Name: mixer2
Type: REG_SZ
Data: wdmaud.drv

Value 33
Name: wave
Type: REG_SZ
Data: wdmaud.drv

Value 34
Name: midi
Type: REG_SZ
Data: wdmaud.drv

Value 35
Name: mixer
Type: REG_SZ
Data: wdmaud.drv

Value 36
Name: aux
Type: REG_SZ
Data: wdmaud.drv

Value 37
Name: msacm.siren
Type: REG_SZ
Data: sirenacm.dll

Value 38
Name: MSVideo8
Type: REG_SZ
Data: VfWWDM32.dll

Value 39
Name: wave3
Type: REG_SZ
Data: wdmaud.drv

Value 40
Name: mixer3
Type: REG_SZ
Data: wdmaud.drv

Value 41
Name: wave4
Type: REG_SZ
Data: wdmaud.drv

Value 42
Name: mixer4
Type: REG_SZ
Data: wdmaud.drv

Value 43
Name: msacm.ac3filter
Type: REG_SZ
Data: ac3filter.acm

Value 44
Name: vidc.DIVX
Type: REG_SZ
Data: DivX.dll

Value 45
Name: vidc.yv12
Type: REG_SZ
Data: DivX.dll

Value 46
Name: aux2
Type: REG_SZ
Data: C:\WINDOWS\system32\..\infj.jsn


Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\Terminal Server
Class Name: <NO CLASS>
Last Write Time: 8/7/2004 - 12:59 PM

Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\Terminal Server\RDP
Class Name: <NO CLASS>
Last Write Time: 8/7/2004 - 12:59 PM
Value 0
Name: wave
Type: REG_SZ
Data: rdpsnd.dll

Value 1
Name: mixer
Type: REG_SZ
Data: rdpsnd.dll

Value 2
Name: MaxBandwidth
Type: REG_DWORD
Data: 0x56b9

Value 3
Name: wavemapper
Type: REG_SZ
Data: msacm32.drv

Value 4
Name: EnableMP3Codec
Type: REG_DWORD
Data: 0x1

Value 5
Name: midimapper
Type: REG_SZ
Data: midimap.dll

#9 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:16 AM

Posted 01 March 2009 - 02:21 PM

* Open hijackthis, click 'config' (bottom right)
Choose the tab 'misc Tools' on top.
Choose 'delete a file on reboot'
In the field, copy and paste next:

C:\WINDOWS\infj.jsn

Click open.
Hijackthis will tell you that this file will be deleted on next reboot and if you want to reboot now. Click Yes/ok
Your system should reboot now.

After reboot,

Open notepad and copy and paste next present in the quotebox below in it:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"aux2"="wdmaud.drv"

Save this as fix.reg Choose to save as *all files and place it on your desktop.
It should look like this: Posted Image
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Let me know if that solved your redirect problem.

Extra note, please rename reg3dit.exe back to regedit.exe as well. :thumbup2:
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#10 rsowen

rsowen
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Location:Toronto
  • Local time:08:16 PM

Posted 01 March 2009 - 03:11 PM

miekiemoes, this worked! you are truly an expert and your instructions are nothing short of perfect. This was actually a pleasure for me, and your willingness to help me, a complete stranger, is an inspiration.

best,
rs

and note that the dds scan now executes properly.

Edited by rsowen, 01 March 2009 - 03:21 PM.


#11 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:16 AM

Posted 01 March 2009 - 03:44 PM

Glad I could help. :thumbup2:

Please read my Prevention page with lots of info and tips how to prevent this in the future.
And if you want to improve speed/system performance after malware removal, take a look here.
Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!

Edited by miekiemoes, 01 March 2009 - 03:44 PM.

AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#12 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:16 AM

Posted 06 March 2009 - 07:49 AM

Since this issue appears resolved ... this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users