Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with Personal Guard and Total Security


  • This topic is locked This topic is locked
3 replies to this topic

#1 advrider

advrider

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:24 AM

Posted 25 September 2009 - 03:56 AM

Hello,

I have really started to learn alot here and what you all are doing for others is really great.

About a week or so ago Personal Guard showed up and was removed with Malware Bytes and AVG. Shortly thereafter Total Security comes along and I have to use iexplore.exe to stop it. Again using Malware Bytes and AVG everthing looked good, however it keeps coming back. Two things that run on the computer that seem to be around the same time as the infection is iphone syncing and remote access using Team Viewer.

I look forward to going through the process with you.

Thank You !

DDS (Ver_09-07-30.01) - NTFSx86
Run by GAS at 2:36:07.29 on Fri 09/25/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.488 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\BrmfBAgS.exe
C:\Program Files\Canon\DIAS\CnxDIAS.exe
C:\WINDOWS\System32\hpb2ksrv.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\FaxTalk FaxCenter Pro 7.5\FTMSGSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\Program Files\FaxTalk FaxCenter Pro 7.5\FAPIEXE.EXE
C:\Program Files\FaxTalk FaxCenter Pro 7.5\FTClCtrl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Cobian Backup 9\Cobian.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Cobian Backup 9\cbInterface.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AVG\AVG8\avgscanx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Documents and Settings\GAS\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
TB: AOL Toolbar: {4982d40a-c53b-4615-b15b-b5b5e98d167c} - c:\program files\aol toolbar\toolbar.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [FaxTalk FaxCenter Pro 7.5] "c:\program files\faxtalk faxcenter pro 7.5\FTClCtrl.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Cobian Backup 9] "c:\program files\cobian backup 9\Cobian.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
StartupFolder: c:\docume~1\gas\startm~1\programs\startup\Outlook.lnk -
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_04\bin\npjpi150_04.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll
IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - c:\program files\aol toolbar\toolbar.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: washingtonpost.com
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxps://objects.aol.com/mcafee/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxps://objects.aol.com/mcafee/molbin/shared/mcgdmgr/en-us/1,0,0,20/McGDMgr.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: lbxfile - {56831180-F115-11d2-B6AA-00104B2B9943} - c:\program files\libronix dls\system\FileProt.dll
Handler: lbxres - {24508F1B-9E94-40EE-9759-9AF5795ADF52} - c:\program files\libronix dls\system\ResProt.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} -
WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\windows\system32\zowudije.dll ,wolekojo.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: pijayobol - {365a2bb3-5b4f-485c-8796-36672ff6fa84} - c:\windows\system32\zowudije.dll
STS: gahurihor: {365a2bb3-5b4f-485c-8796-36672ff6fa84} - c:\windows\system32\zowudije.dll
LSA: Notification Packages = scecli higomeme.dll

============= SERVICES / DRIVERS ===============

R0 viaraid;viaraid;c:\windows\system32\drivers\viaraid.sys [2004-1-31 70272]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-29 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-8-29 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-8-29 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-29 297752]
R2 FaxTalk FaxCenter Pro 7.5;FaxTalk FaxCenter Pro 7.5;c:\program files\faxtalk faxcenter pro 7.5\FTMSGSVC.exe [2008-6-16 38400]
R2 TeamViewer4;TeamViewer 4;c:\program files\teamviewer\version4\TeamViewer_Service.exe [2009-5-27 185640]
S3 brfilt;Brother MFC Filter Driver;c:\windows\system32\drivers\BrFilt.sys [2006-7-5 2944]
S3 brparimg;Brother Multi Function Parallel Image driver;c:\windows\system32\drivers\BrParImg.sys [2006-7-5 3168]
S3 BrParWdm;Brother WDM Parallel Driver;c:\windows\system32\drivers\BrParwdm.sys [2006-7-5 39552]
S3 BrSerWDM;Brother WDM Serial driver;c:\windows\system32\drivers\BrSerWdm.sys [2006-7-5 61440]
S3 epstw2k;SCM Parallel Port SCSI Driver;c:\windows\system32\drivers\epstw2k.sys [2004-2-14 114944]
S3 ITE;ITE;c:\windows\system32\drivers\ITE.SYS [2004-3-22 37264]
S3 scsiscan;SCSI Scanner Driver;c:\windows\system32\drivers\scsiscan.sys [2004-2-14 11520]
S3 VisorUsb;Handspring USB;c:\windows\system32\drivers\VisorUsb.sys [2004-3-15 19968]
S4 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [2004-6-11 8768]
S4 FaxTalk Modem Dr.;FaxTalk Modem Dr.;c:\program files\faxtalk faxcenter pro 7.5\FTMDMDR.EXE [2008-6-16 172032]
S4 TivoBeacon2;TiVo Beacon;c:\program files\common files\tivo shared\beacon\TiVoBeacon.exe [2006-7-11 857088]

============== File Associations ===============

scrfile="%1" /S "%3"

=============== Created Last 30 ================

2009-09-22 04:38 <DIR> --d----- c:\program files\Cobian Backup 9
2009-09-22 03:19 <DIR> --d----- c:\windows\system32\scripting
2009-09-22 03:19 <DIR> --d----- c:\windows\system32\en
2009-09-22 03:19 <DIR> --d----- c:\windows\l2schemas
2009-09-22 03:13 <DIR> --d----- c:\windows\network diagnostic
2009-09-22 02:57 397,312 -------- c:\windows\system32\mmcex.dll
2009-09-22 02:16 <DIR> --d----- c:\windows\system32\PreInstall
2009-08-30 01:18 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-08-29 20:39 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-08-29 20:39 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-29 20:39 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
2009-08-29 20:38 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-08-29 20:38 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-08-29 20:38 <DIR> --d----- c:\program files\AVG
2009-08-29 20:38 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-08-29 20:32 <DIR> --d----- c:\docume~1\gas\applic~1\AVG8
2009-08-29 18:22 848,712 a------- c:\documents and settings\all users\avg_free_stb_all_8_32_cnet.exe
2009-08-29 18:02 <DIR> --d----- c:\windows\system32\wbem\Repository

==================== Find3M ====================

2009-09-24 21:20 1,082,404 a--sh--- c:\windows\system32\ginameye.exe
2009-09-24 21:20 39,424 a--sh--- c:\windows\system32\lonafaze.dll
2009-09-24 20:29 2,241 a------- c:\windows\panose.bin
2009-09-24 09:19 1,081,892 a--sh--- c:\windows\system32\tomebiha.exe
2009-09-23 17:18 1,082,404 a--sh--- c:\windows\system32\zesupoma.exe
2009-09-23 17:18 39,424 a--sh--- c:\windows\system32\tusubiku.dll
2009-09-23 05:17 39,424 a--sh--- c:\windows\system32\wujuleza.dll
2009-09-22 03:22 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-09-10 14:54 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 14:53 19,160 a------- c:\windows\system32\drivers\mbam.sys
2006-02-06 10:12 33,408 -------- c:\documents and settings\gas\g2mdlhlpx.exe
2003-07-16 22:26 448,640 a------- c:\windows\inf\EL2K_N64.sys
2003-07-16 22:22 147,328 a------- c:\windows\inf\EL2K_XP.sys
2003-06-03 03:47 147,328 a------- c:\windows\inf\EL2K_2K.sys
2009-06-20 05:16 50,176 a--sh--- c:\windows\system32\gomevibi.exe
2009-06-24 21:20 52,736 a--sh--- c:\windows\system32\higomeme.dll
2009-06-24 21:20 52,736 a--sh--- c:\windows\system32\wolekojo.dll
2009-06-24 21:20 52,736 a--sh--- c:\windows\system32\wukapoki.dll

============= FINISH: 2:36:28.81 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 advrider

advrider
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:24 AM

Posted 25 September 2009 - 10:22 AM

Hello again,

More info - After infection and cleaning system w/AVG & Malwarebytes XP Service pack 3 was installed. Also this morning AVG caught some trojans and they were taken care of by the daily scan. Have not done anything to system since posting logs. Here is todays DDS also uploaded 090925 Attach, 090925 Ark and an AVG log. Also getting alot of popups now. I will be out of the office till Oct. 2nd but will be checking email.

Thanks


DDS (Ver_09-07-30.01) - NTFSx86
Run by GAS at 10:28:01.45 on Fri 09/25/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.462 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\BrmfBAgS.exe
C:\Program Files\Canon\DIAS\CnxDIAS.exe
C:\WINDOWS\System32\hpb2ksrv.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\Program Files\FaxTalk FaxCenter Pro 7.5\FTMSGSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\Program Files\FaxTalk FaxCenter Pro 7.5\FAPIEXE.EXE
C:\Program Files\FaxTalk FaxCenter Pro 7.5\FTClCtrl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Cobian Backup 9\Cobian.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Cobian Backup 9\cbInterface.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\Adobe\PageMaker 7.0\Pm70.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Documents and Settings\GAS\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
TB: AOL Toolbar: {4982d40a-c53b-4615-b15b-b5b5e98d167c} - c:\program files\aol toolbar\toolbar.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [FaxTalk FaxCenter Pro 7.5] "c:\program files\faxtalk faxcenter pro 7.5\FTClCtrl.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Cobian Backup 9] "c:\program files\cobian backup 9\Cobian.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [hanogabow] Rundll32.exe "c:\windows\system32\lurujoda.dll",a
dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
StartupFolder: c:\docume~1\gas\startm~1\programs\startup\Outlook.lnk -
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_04\bin\npjpi150_04.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll
IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - c:\program files\aol toolbar\toolbar.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: washingtonpost.com
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxps://objects.aol.com/mcafee/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxps://objects.aol.com/mcafee/molbin/shared/mcgdmgr/en-us/1,0,0,20/McGDMgr.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: lbxfile - {56831180-F115-11d2-B6AA-00104B2B9943} - c:\program files\libronix dls\system\FileProt.dll
Handler: lbxres - {24508F1B-9E94-40EE-9759-9AF5795ADF52} - c:\program files\libronix dls\system\ResProt.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} -
WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} -
WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} -
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\windows\system32\zowudije.dll wolekojo.dll c:\windows\system32\lurujoda.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: pijayobol - {365a2bb3-5b4f-485c-8796-36672ff6fa84} - c:\windows\system32\zowudije.dll
SSODL: bajimumog - {990ac0d9-1f21-4422-a6e4-22350f6e1bda} - c:\windows\system32\lurujoda.dll
STS: gahurihor: {365a2bb3-5b4f-485c-8796-36672ff6fa84} - c:\windows\system32\zowudije.dll
STS: tokatiluy: {990ac0d9-1f21-4422-a6e4-22350f6e1bda} - c:\windows\system32\lurujoda.dll
LSA: Notification Packages = scecli higomeme.dll

============= SERVICES / DRIVERS ===============

R0 viaraid;viaraid;c:\windows\system32\drivers\viaraid.sys [2004-1-31 70272]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-29 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-8-29 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-8-29 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-29 297752]
R2 FaxTalk FaxCenter Pro 7.5;FaxTalk FaxCenter Pro 7.5;c:\program files\faxtalk faxcenter pro 7.5\FTMSGSVC.exe [2008-6-16 38400]
R2 TeamViewer4;TeamViewer 4;c:\program files\teamviewer\version4\TeamViewer_Service.exe [2009-5-27 185640]
S3 brfilt;Brother MFC Filter Driver;c:\windows\system32\drivers\BrFilt.sys [2006-7-5 2944]
S3 brparimg;Brother Multi Function Parallel Image driver;c:\windows\system32\drivers\BrParImg.sys [2006-7-5 3168]
S3 BrParWdm;Brother WDM Parallel Driver;c:\windows\system32\drivers\BrParwdm.sys [2006-7-5 39552]
S3 BrSerWDM;Brother WDM Serial driver;c:\windows\system32\drivers\BrSerWdm.sys [2006-7-5 61440]
S3 epstw2k;SCM Parallel Port SCSI Driver;c:\windows\system32\drivers\epstw2k.sys [2004-2-14 114944]
S3 ITE;ITE;c:\windows\system32\drivers\ITE.SYS [2004-3-22 37264]
S3 scsiscan;SCSI Scanner Driver;c:\windows\system32\drivers\scsiscan.sys [2004-2-14 11520]
S3 VisorUsb;Handspring USB;c:\windows\system32\drivers\VisorUsb.sys [2004-3-15 19968]
S4 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [2004-6-11 8768]
S4 FaxTalk Modem Dr.;FaxTalk Modem Dr.;c:\program files\faxtalk faxcenter pro 7.5\FTMDMDR.EXE [2008-6-16 172032]
S4 TivoBeacon2;TiVo Beacon;c:\program files\common files\tivo shared\beacon\TiVoBeacon.exe [2006-7-11 857088]

============== File Associations ===============

scrfile="%1" /S "%3"

=============== Created Last 30 ================

2009-09-25 05:05 <DIR> --d----- c:\documents and settings\all users\Registry Backups
2009-09-22 04:38 <DIR> --d----- c:\program files\Cobian Backup 9
2009-09-22 03:19 <DIR> --d----- c:\windows\system32\scripting
2009-09-22 03:19 <DIR> --d----- c:\windows\system32\en
2009-09-22 03:19 <DIR> --d----- c:\windows\l2schemas
2009-09-22 03:13 <DIR> --d----- c:\windows\network diagnostic
2009-09-22 02:57 397,312 -------- c:\windows\system32\mmcex.dll
2009-09-22 02:16 <DIR> --d----- c:\windows\system32\PreInstall
2009-08-30 01:18 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-08-29 20:39 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-08-29 20:39 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-08-29 20:39 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
2009-08-29 20:38 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-08-29 20:38 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-08-29 20:38 <DIR> --d----- c:\program files\AVG
2009-08-29 20:38 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-08-29 20:32 <DIR> --d----- c:\docume~1\gas\applic~1\AVG8
2009-08-29 18:22 848,712 -------- c:\documents and settings\all users\avg_free_stb_all_8_32_cnet.exe
2009-08-29 18:02 <DIR> --d----- c:\windows\system32\wbem\Repository

==================== Find3M ====================

2009-09-25 09:20 91,136 a--sh--- c:\windows\system32\lurujoda.dll
2009-09-25 09:20 39,424 a--sh--- c:\windows\system32\zilabivi.dll
2009-09-25 07:55 2,241 a------- c:\windows\panose.bin
2009-09-24 21:20 1,082,404 a--sh--- c:\windows\system32\ginameye.exe
2009-09-24 21:20 39,424 a--sh--- c:\windows\system32\lonafaze.dll
2009-09-24 09:19 1,081,892 a--sh--- c:\windows\system32\tomebiha.exe
2009-09-23 17:18 1,082,404 a--sh--- c:\windows\system32\zesupoma.exe
2009-09-23 17:18 39,424 a--sh--- c:\windows\system32\tusubiku.dll
2009-09-23 05:17 39,424 a--sh--- c:\windows\system32\wujuleza.dll
2009-09-22 03:22 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-09-10 14:54 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 14:53 19,160 a------- c:\windows\system32\drivers\mbam.sys
2006-02-06 10:12 33,408 -------- c:\documents and settings\gas\g2mdlhlpx.exe
2003-07-16 22:26 448,640 a------- c:\windows\inf\EL2K_N64.sys
2003-07-16 22:22 147,328 a------- c:\windows\inf\EL2K_XP.sys
2003-06-03 03:47 147,328 a------- c:\windows\inf\EL2K_2K.sys
2009-06-20 05:16 50,176 a--sh--- c:\windows\system32\gomevibi.exe
2009-06-24 21:20 52,736 a--sh--- c:\windows\system32\higomeme.dll
2009-06-24 21:20 52,736 a--sh--- c:\windows\system32\wolekojo.dll
2009-06-24 21:20 52,736 a--sh--- c:\windows\system32\wukapoki.dll

============= FINISH: 10:28:32.29 ===============
Attached File  090925_Ark.txt   2.27KB   2 downloads

Attached Files



#3 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:12:24 PM

Posted 11 October 2009 - 06:03 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Pleaseinclude a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.
  • Please download OTL from following mirror:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized
In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. I suggest you do this and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#4 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:12:24 PM

Posted 18 October 2009 - 12:47 PM

Due to lack of feedback, this topic is now Closed

If you need this topic reopened, please send me a PM.
Please include the address of this thread in your request.
This applies only to the original topic starter.

Everyone else please start a new topic.

With Regards,
_temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users