Posted 01 April 2009 - 12:25 AM
I am in the process of cleaning off various malware from my sister-in-laws computer. She was having problems redirectors. She could not get to a web sight without IE loading up a different website. I ran SuperAntiSpyware, AdAware, Spybot S&D, and Malwarebytes' AntiMalware. All were ran under safemode. Spybot was also ran during startup. I was able to remove most items that came across. Some of the malwares that were removed or attempted to remove include, Trojan.Agent, Trojan.BHO, Trojan.Downloader, Trojan.Vundo, Trojan.Vundo.H, Worm.Autorun among others. When ever I run Malwarebytes' it will find something even after I removed it. I need a second pair of eyes or more over, a primary pair of expert eyes to see what else I need to do. Below is a copy of the DDS.txt file.
Thanks,
David
DDS (Ver_09-03-16.01) - NTFSx86
Run by Sandy Fisher at 0:58:06.95 on Wed 04/01/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.72 [GMT -4:00]
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\system32\dla\DLACTRLW.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sandy Fisher\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://my.att.net/
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://search.alot.com/sidebar?pr=asst&client_id=1E8A534001C8C46200129F26&install_time=01-06-2008:20:39&src_id=11082&camp_id=-6&tb_version=1.2.5.255&&url=http%3A%2F%2Fhome%2Ealot%2Ecom%3Fclient%5Fid%3D1E8A534001C8C46200129F26%26install%5Ftime%3D01%2D06%2D2008%3A20%3A39%26src%5Fid%3D11082%26camp%5Fid%3D%2D6%26tb%5Fversion%3D1%2E2%2E5%2E255
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\toscdspd.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [reader_s] c:\documents and settings\sandy fisher\reader_s.exe
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [THotkey] c:\program files\toshiba\toshiba applet\thotkey.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [NDSTray.exe] NDSTray.exe
mRun: [TPSMain] TPSMain.exe
mRun: [PadTouch] c:\program files\toshiba\touch and launch\PadExe.exe
mRun: [SmoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe
mRun: [dla] c:\windows\system32\dla\DLACTRLW.exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [Tvs] c:\program files\toshiba\tvs\TvsTray.exe
mRun: [TFncKy] TFncKy.exe
mRun: [TDispVol] TDispVol.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\paige fisher\start menu\programs\imvu\Run IMVU.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LMIinit - LMIinit.dll
AppInit_DLLs: wqvfwc.dll rgvxyr.dll c:\windows\system32\fapawozi.dll,c:\windows\system32\dutudari.dll c:\windows\system32\mizuyoha.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli c:\windows\system32\dutudari.dll
============= SERVICES / DRIVERS ===============
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-3-31 64160]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 72944]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 951632]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2007-8-3 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-4-2 47640]
R3 botdrv;botdrv;\??\c:\windows\system32\driver.sys --> c:\windows\system32\driver.sys [?]
S1 808e4e3e;808e4e3e;c:\windows\system32\drivers\808e4e3e.sys --> c:\windows\system32\drivers\808e4e3e.sys [?]
S3 restore;restore;\??\c:\windows\system32\drivers\restore.sys --> c:\windows\system32\drivers\restore.sys [?]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
=============== Created Last 30 ================
2009-04-01 00:45 <DIR> --d----- c:\program files\Trend Micro
2009-03-31 22:59 4,447 a------- c:\windows\wininit.ini
2009-03-31 22:30 15,688 a------- c:\windows\system32\lsdelete.exe
2009-03-31 21:52 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-03-31 21:47 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-03-31 21:47 <DIR> --d----- c:\program files\Lavasoft
2009-03-31 20:54 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-03-31 20:54 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-03-31 09:27 446 a------- c:\windows\system32\win32hlp.cnf
2009-03-31 01:28 <DIR> --d----- c:\windows\pss
2009-03-31 01:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-03-31 01:04 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-03-31 01:04 <DIR> --d----- c:\docume~1\sandyf~1\applic~1\SUPERAntiSpyware.com
2009-03-31 01:00 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-03-30 22:45 <DIR> --d----- c:\docume~1\sandyf~1\applic~1\Malwarebytes
2009-03-30 21:52 2 a------- c:\windows\msoffice.ini
2009-03-27 18:08 62,976 a------- C:\tqaau.exe
2009-03-27 18:07 182,656 ac------ c:\windows\system32\dllcache\ndis.sys
2009-03-27 18:05 2 a------- C:\-328425222
2009-03-27 18:05 62,976 a------- C:\uldwlib.exe
2009-03-24 16:58 124,928 a--sh--- c:\windows\system32\eiauqi.dll
2009-03-17 22:31 124,928 a--sh--- c:\windows\system32\jpbnhm.dll
2009-03-16 01:13 124,928 a--sh--- c:\windows\system32\rxmine.dll
2009-03-14 23:30 124,928 a--sh--- c:\windows\system32\onrulw.dll
2009-03-14 08:18 <DIR> --d----- c:\program files\Common
2009-03-13 20:13 124,928 a--sh--- c:\windows\system32\eaaeyf.dll
2009-03-03 20:37 129,024 a--sh--- c:\windows\system32\wanqui.dll
2009-03-02 18:19 129,024 a--sh--- c:\windows\system32\rglzlw.dll
==================== Find3M ====================
2009-03-27 18:08 104,960 a------- c:\windows\system32\userinit.exe
2009-03-27 18:07 182,656 a------- c:\windows\system32\drivers\ndis.sys
2009-03-27 06:04 61,440 a--sh--- c:\windows\system32\vugivodi.exe
2009-03-26 18:05 61,440 a--sh--- c:\windows\system32\majudohi.exe
2009-03-26 16:49 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 16:49 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-25 04:58 84,992 a--sh--- c:\windows\system32\kadopuwe.dll
2009-03-24 16:58 124,928 a--sh--- c:\windows\system32\jinuyeju.dll
2009-03-17 22:31 124,928 a--sh--- c:\windows\system32\papororo.dll
2009-03-16 01:13 124,928 a--sh--- c:\windows\system32\rokewezi.dll
2009-03-16 01:13 79,872 a--sh--- c:\windows\system32\lugofetu.dll
2009-03-14 23:30 124,928 a--sh--- c:\windows\system32\yosutihe.dll
2009-03-14 23:30 84,992 a--sh--- c:\windows\system32\gitadodi.dll
2009-03-14 08:14 84,992 a--sh--- c:\windows\system32\viyiyini.dll
2009-03-13 20:13 124,928 a--sh--- c:\windows\system32\tebihoti.dll
2009-03-13 20:13 84,992 a--sh--- c:\windows\system32\yidehuyu.dll
2009-03-11 13:01 84,992 a--sh--- c:\windows\system32\nepivoyi.dll
2009-03-03 20:37 129,024 a--sh--- c:\windows\system32\wayebomi.dll
2009-03-03 20:37 84,992 a--sh--- c:\windows\system32\paweharo.dll
2009-02-28 23:22 129,024 a--sh--- c:\windows\system32\zpetbf.dll
2009-02-28 23:22 84,992 a--sh--- c:\windows\system32\mizifaru.dll
2009-02-27 01:22 77,607 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-02-17 20:07 129,024 a------- c:\windows\system32\gjsymres.dll
2009-02-17 20:07 129,024 a------- c:\windows\system32\dltbko.dll
2009-02-16 22:58 213,029 a------- c:\windows\system32\vpimqlic.exe
0000-00-00 00:00 79,872 a--sh--- c:\windows\system32\kizoraju.dll
0000-00-00 00:00 124,928 a--sh--- c:\windows\system32\migisibi.dll
============= FINISH: 0:58:15.32 ===============