Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

virus problems & HIJACK THIS LOGS


  • Please log in to reply
16 replies to this topic

#1 Rickphx

Rickphx

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:06:32 PM

Posted 28 October 2009 - 09:12 AM

Hi,

I have been working with Computer Pro and Boopme on the general malware forum portion of this site over the last couple of weeks trying some apparent virus/malware problems. Recently Boopme indicated that we needed to move to some higher level tools and had me down load HIJACK This. I understand that I need to post these logs to this forum in the site versus the regular forum. Therefore below please find the two HIJACK THIS logs and a log for RootRepeal. I would appreciate any assistance offered on this. Thanks in advance.

____________________________________________


LOG #1

DDS (Ver_09-10-26.01) - NTFSx86
Run by Managing System at 7:46:21.42 on Tue 10/27/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1273 [GMT -6:00]

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: PC-cillin Internet Security - Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
svchost.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
svchost.exe
C:\WINDOWS\system32\stacsv.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Broadcom\BACS\BacsTray.exe
C:\Program Files\Micro Innovations\Wireless Keyboard\KbdAp32A.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Managing System\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Connection Wizard,ShellNext = hxxp://www.google.com/search?q=work+groups&rls=com.microsoft:*:IE-Address&ie=UTF-8&oe=UTF-8&sourceid=ie7&rlz=1I7DMUS
mURLSearchHooks: H - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: {5dfe6459-1adc-416a-b988-054239706af2} - wizejimi.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ModemOnHold] c:\program files\netwaiting\netWaiting.exe
uRun: [SetDefaultMIDI] MIDIDef.exe
uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [OE_OEM] "c:\program files\trend micro\internet security 14\tmas_oe\TMAS_OEMon.exe"
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet
mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe
mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [VoiceCenter] "c:\program files\creative\voicecenter\AndreaVC.exe" /tray
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [LogitechCameraAssistant] c:\program files\logitech\video\CameraAssistant.exe
mRun: [LogitechVideo[inspector]] c:\program files\logitech\video\InstallHelper.exe /inspect
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [bacstray] c:\program files\broadcom\bacs\BacsTray.exe
mRun: [FLMK08KB] c:\program files\micro innovations\wireless keyboard\KbdAp32A.exe
mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.2\apps\apdproxy.exe"
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [Share-to-Web Namespace Daemon] c:\program files\hewlett-packard\hp share-to-web\hpgs2wnd.exe
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
mRun: [zayohopen] Rundll32.exe "c:\windows\system32\bujasojo.dll",a
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\managi~1\startm~1\programs\startup\vzacce~1.lnk - c:\program files\verizon wireless\vzaccess manager\VZAccess Manager.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hppsc2~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpobnz08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\miniey~1.lnk - c:\program files\infinite mind lc\eyeq\ARLaunch.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hposol08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
uPolicies-explorer: EditLevel = 0 (0x0)
uPolicies-explorer: NoCommonGroups = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - hxxp://h30155.www3.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://www.adobe.com/products/acrobat/nos/gp.cab
TCP: {73B30E9B-D111-4E99-9788-219135010899} = 66.174.92.14 66.174.95.44
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
AppInit_DLLs: c:\progra~1\google\google~1\goec62~1.dll c:\windows\system32\bujasojo.dll,kewevuro.dll c:\windows\system32\wedijuzo.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: beyenenuv - {8af7267f-80b9-42de-8e35-ab5cbf5d1fa1} - c:\windows\system32\wedijuzo.dll
SSODL: yiyomeros - {e5f284e7-eed0-419f-abde-c35e8a043640} - c:\windows\system32\wedijuzo.dll
SSODL: pebaniked - {e39ba52b-aee7-4dbe-bc10-b04fd13c022c} - c:\windows\system32\wedijuzo.dll
SSODL: danoyovaz - {8aec81e0-562f-4e2e-8a39-aab278786500} - c:\windows\system32\wedijuzo.dll
SSODL: fupasudum - {799f3003-40a3-4cd5-8d7e-c6faca8c921e} - c:\windows\system32\wedijuzo.dll
SSODL: jegahuwig - {d50e7d12-f705-4124-b5c9-bfe9ddb3cdb9} - c:\windows\system32\wedijuzo.dll
SSODL: lipetidoz - {b0d4d399-7624-4585-a3a8-4a320a73fdc1} - c:\windows\system32\wedijuzo.dll
STS: mujuzedij: {8af7267f-80b9-42de-8e35-ab5cbf5d1fa1} - c:\windows\system32\wedijuzo.dll
STS: gahurihor: {e5f284e7-eed0-419f-abde-c35e8a043640} - c:\windows\system32\wedijuzo.dll
STS: mujuzedij: {e39ba52b-aee7-4dbe-bc10-b04fd13c022c} - c:\windows\system32\wedijuzo.dll
STS: tokatiluy: {8aec81e0-562f-4e2e-8a39-aab278786500} - c:\windows\system32\wedijuzo.dll
STS: kupuhivus: {799f3003-40a3-4cd5-8d7e-c6faca8c921e} - c:\windows\system32\wedijuzo.dll
STS: mujuzedij: {d50e7d12-f705-4124-b5c9-bfe9ddb3cdb9} - c:\windows\system32\wedijuzo.dll
STS: gahurihor: {b0d4d399-7624-4585-a3a8-4a320a73fdc1} - c:\windows\system32\wedijuzo.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
LSA: Notification Packages = scecli gupuvefa.dll

============= SERVICES / DRIVERS ===============

R2 litsgt;litsgt;c:\windows\system32\drivers\litsgt.sys [2007-6-17 137344]
R2 tansgt;tansgt;c:\windows\system32\drivers\tansgt.sys [2007-6-17 12032]
R2 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\trendm~1\intern~1\Tmntsrv.exe [2007-8-16 345432]
R2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\trendm~1\intern~1\TmPfw.exe [2006-11-9 923216]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2007-6-12 36368]
R2 tmproxy;Trend Micro Proxy Service;c:\progra~1\trendm~1\intern~1\tmproxy.exe [2006-11-9 566872]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2006-11-9 280392]

=============== Created Last 30 ================

2009-10-26 13:00:17 2713 --sh--w- c:\windows\system32\sidejuwo.dll
2009-10-26 13:00:17 0 ---ha-w- c:\windows\system32\BITF.tmp
2009-10-26 13:00:17 0 ---ha-w- c:\windows\system32\BIT11.tmp
2009-10-26 13:00:16 2713 --sh--w- c:\windows\system32\gobekado.dll
2009-10-25 02:57:51 2713 --sh--w- c:\windows\system32\jekosefu.exe
2009-10-19 23:02:37 0 d-----w- C:\Autorun
2009-10-19 19:44:09 2713 --sh--w- c:\windows\system32\nafohata.exe
2009-10-12 19:14:05 0 d-----w- c:\program files\downloads
2009-10-12 17:50:55 0 d-----w- c:\docume~1\managi~1\applic~1\Malwarebytes
2009-10-12 17:22:08 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-12 17:22:06 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-12 17:22:06 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-12 17:22:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-12 05:23:00 2713 --sh--w- c:\windows\system32\molukoza.exe
2009-10-08 21:20:37 0 d-----w- c:\windows\system32\wbem\Repository
2009-10-02 19:55:59 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-09-30 20:25:30 153088 ------w- c:\windows\system32\dllcache\triedit.dll

==================== Find3M ====================

2009-10-27 02:46:57 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-10-26 12:12:21 4800 ----a-w- c:\windows\system32\tmp.reg
2009-10-25 16:05:57 232248 ----a-w- c:\windows\system32\nvModes.dat
2009-08-07 01:24:18 327896 ----a-w- c:\windows\system32\dllcache\wucltui.dll
2009-08-07 01:24:18 209632 ----a-w- c:\windows\system32\dllcache\wuweb.dll
2009-08-07 01:24:10 35552 ----a-w- c:\windows\system32\dllcache\wups.dll
2009-08-07 01:24:06 53472 ----a-w- c:\windows\system32\dllcache\wuauclt.exe
2009-08-07 01:24:04 96480 ----a-w- c:\windows\system32\dllcache\cdm.dll
2009-08-07 01:23:54 575704 ----a-w- c:\windows\system32\dllcache\wuapi.dll
2009-08-07 01:23:46 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 01:23:46 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 01:23:46 1929952 ----a-w- c:\windows\system32\dllcache\wuaueng.dll
2009-08-05 09:01:48 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 09:01:48 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-26 12:59:20 89088 --sha-w- c:\windows\system32\bujasojo.dll
2009-07-09 16:05:55 60416 --sha-w- c:\windows\system32\dezopiji.dll
2009-07-21 01:37:42 52224 --sha-w- c:\windows\system32\fohavato.dll
2009-07-26 12:59:56 52224 --sha-w- c:\windows\system32\gupuvefa.dll
2009-07-21 18:12:17 38912 --sha-w- c:\windows\system32\huwifolu.dll
2009-07-09 16:06:33 116736 --sha-w- c:\windows\system32\jurafisi.dll
2009-07-21 01:37:51 37888 --sha-w- c:\windows\system32\kebulovo.dll
2009-07-26 12:59:56 52224 --sha-w- c:\windows\system32\kewevuro.dll
2009-07-26 12:59:20 52224 --sha-w- c:\windows\system32\mebokewe.dll
2009-07-26 12:59:56 52224 --sha-w- c:\windows\system32\mulifadu.dll
2009-07-26 12:59:22 38912 --sha-w- c:\windows\system32\nehalofu.dll
2009-07-12 17:23:13 38400 --sha-w- c:\windows\system32\nelumoje.dll
2009-07-21 18:12:17 90112 --sha-w- c:\windows\system32\piwuporo.dll
2009-07-09 16:06:29 50688 --sha-w- c:\windows\system32\repomini.dll
2009-07-09 16:06:29 50688 --sha-w- c:\windows\system32\tirobuse.dll
2009-07-09 16:05:51 50688 --sha-w- c:\windows\system32\tuburavi.dll
2009-07-21 01:37:42 90112 --sha-w- c:\windows\system32\wedijuzo.dll
2009-07-21 18:12:19 52224 --sha-w- c:\windows\system32\zisilore.dll
2009-07-21 01:37:42 838656 --sha-w- c:\windows\system32\zopimiwo.exe
2008-10-01 14:59:53 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008100120081002\index.dat
2009-03-28 17:29:27 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009032820090329\index.dat

============= FINISH: 7:46:53.79 ===============


LOG #2

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-26.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 1/16/2007 9:57:33 AM
System Uptime: 10/27/2009 7:04:08 AM (0 hours ago)

Motherboard: Dell Inc. | | 0FP985
Processor: Intel® Core™2 CPU T7200 @ 2.00GHz | Microprocessor | 1997/166mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 87 GiB total, 15.78 GiB free.
D: is CDROM (CDFS)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1038: 7/27/2009 8:13:53 AM - System Checkpoint
RP1039: 7/27/2009 6:15:19 PM - ghgh
RP1040: 7/27/2009 7:22:23 PM - Restore Operation
RP1041: 7/27/2009 11:23:21 PM - Restore Operation
RP1042: 7/28/2009 2:15:56 AM - Software Distribution Service 3.0
RP1043: 7/29/2009 8:11:01 AM - System Checkpoint
RP1044: 7/29/2009 3:38:36 PM - Software Distribution Service 3.0
RP1045: 7/30/2009 8:21:48 AM - Avg8 Update
RP1046: 7/30/2009 8:24:36 AM - Avg8 Update
RP1047: 7/31/2009 11:56:03 AM - Software Distribution Service 3.0
RP1048: 8/1/2009 2:40:36 PM - System Checkpoint
RP1049: 8/4/2009 6:42:28 AM - Software Distribution Service 3.0
RP1050: 8/6/2009 6:43:31 AM - System Checkpoint
RP1051: 8/6/2009 8:56:11 AM - Software Distribution Service 3.0
RP1052: 8/7/2009 6:13:15 PM - System Checkpoint
RP1053: 8/10/2009 7:21:16 AM - System Checkpoint
RP1054: 8/11/2009 8:01:34 AM - System Checkpoint
RP1055: 8/12/2009 8:45:19 AM - System Checkpoint
RP1056: 8/13/2009 9:57:34 AM - System Checkpoint
RP1057: 8/13/2009 8:30:56 PM - Software Distribution Service 3.0
RP1058: 8/15/2009 6:36:39 PM - Software Distribution Service 3.0
RP1059: 8/17/2009 7:44:30 AM - System Checkpoint
RP1060: 8/17/2009 9:10:02 AM - Software Distribution Service 3.0
RP1061: 8/17/2009 5:55:06 PM - Restore Operation
RP1062: 8/17/2009 6:09:59 PM - Software Distribution Service 3.0
RP1063: 8/17/2009 6:24:19 PM - Software Distribution Service 3.0
RP1064: 8/17/2009 10:57:16 PM - Restore Operation
RP1065: 8/17/2009 11:03:22 PM - Software Distribution Service 3.0
RP1066: 8/17/2009 11:06:50 PM - Restore Operation
RP1067: 8/18/2009 4:53:48 AM - Software Distribution Service 3.0
RP1068: 8/18/2009 7:08:23 AM - Restore Operation
RP1069: 8/18/2009 7:16:37 AM - Software Distribution Service 3.0
RP1070: 8/18/2009 7:36:36 AM - Software Distribution Service 3.0
RP1071: 8/19/2009 8:41:46 AM - System Checkpoint
RP1072: 8/20/2009 9:07:28 PM - System Checkpoint
RP1073: 8/21/2009 4:18:31 AM - Software Distribution Service 3.0
RP1074: 8/22/2009 9:48:10 AM - System Checkpoint
RP1075: 8/24/2009 8:15:51 AM - Software Distribution Service 3.0
RP1076: 8/25/2009 6:34:47 PM - Software Distribution Service 3.0
RP1077: 8/25/2009 7:59:10 PM - Software Distribution Service 3.0
RP1078: 8/26/2009 8:54:15 PM - System Checkpoint
RP1079: 8/27/2009 9:37:00 PM - System Checkpoint
RP1080: 8/27/2009 9:45:11 PM - Software Distribution Service 3.0
RP1081: 8/29/2009 9:44:02 PM - Avg8 Update
RP1082: 8/29/2009 9:46:47 PM - Avg8 Update
RP1083: 8/31/2009 4:18:33 PM - System Checkpoint
RP1084: 9/1/2009 4:03:20 AM - Software Distribution Service 3.0
RP1085: 9/2/2009 4:07:44 PM - System Checkpoint
RP1086: 9/3/2009 11:36:19 PM - Software Distribution Service 3.0
RP1087: 9/5/2009 2:24:08 PM - System Checkpoint
RP1088: 9/7/2009 8:21:09 AM - Software Distribution Service 3.0
RP1089: 9/8/2009 2:26:11 PM - System Checkpoint
RP1090: 9/9/2009 2:44:00 PM - System Checkpoint
RP1091: 9/9/2009 9:08:12 PM - Software Distribution Service 3.0
RP1092: 9/10/2009 6:31:31 PM - Software Distribution Service 3.0
RP1093: 9/11/2009 6:00:38 AM - Software Distribution Service 3.0
RP1094: 9/12/2009 8:24:39 AM - System Checkpoint
RP1095: 9/14/2009 7:39:19 AM - Software Distribution Service 3.0
RP1096: 9/16/2009 5:51:56 AM - System Checkpoint
RP1097: 9/17/2009 6:20:54 AM - System Checkpoint
RP1098: 9/18/2009 7:14:23 AM - Software Distribution Service 3.0
RP1099: 9/19/2009 9:44:47 AM - System Checkpoint
RP1100: 9/20/2009 11:01:50 AM - System Checkpoint
RP1101: 9/21/2009 12:29:18 PM - System Checkpoint
RP1102: 9/22/2009 7:11:09 AM - Software Distribution Service 3.0
RP1103: 9/23/2009 9:17:18 AM - System Checkpoint
RP1104: 9/24/2009 9:23:04 AM - System Checkpoint
RP1105: 9/25/2009 10:42:02 AM - System Checkpoint
RP1106: 9/25/2009 11:23:48 AM - Software Distribution Service 3.0
RP1107: 9/27/2009 9:21:53 AM - System Checkpoint
RP1108: 9/28/2009 4:15:06 PM - System Checkpoint
RP1109: 9/29/2009 7:35:51 AM - Software Distribution Service 3.0
RP1110: 9/30/2009 10:46:10 AM - Restore Operation
RP1111: 9/30/2009 3:04:12 PM - Software Distribution Service 3.0
RP1112: 10/1/2009 3:00:20 AM - Software Distribution Service 3.0
RP1113: 10/1/2009 3:39:38 PM - Restore Operation
RP1114: 10/2/2009 3:00:21 AM - Software Distribution Service 3.0
RP1115: 10/2/2009 1:55:54 PM - Software Distribution Service 3.0
RP1116: 10/3/2009 8:57:52 PM - System Checkpoint
RP1117: 10/4/2009 7:02:20 PM - Restore Operation
RP1118: 10/5/2009 4:44:04 PM - Software Distribution Service 3.0
RP1119: 10/5/2009 7:02:43 PM - Restore Operation
RP1120: 10/6/2009 8:54:32 AM - Avg8 Update
RP1121: 10/6/2009 8:56:04 AM - Avg8 Update
RP1122: 10/6/2009 6:22:59 PM - Restore Operation
RP1123: 10/7/2009 9:11:28 AM - Avg8 Update
RP1124: 10/7/2009 9:12:32 AM - Avg8 Update
RP1125: 10/8/2009 1:58:25 PM - Software Distribution Service 3.0
RP1126: 10/8/2009 3:18:38 PM - Restore Operation
RP1127: 10/9/2009 8:09:22 AM - Avg8 Update
RP1128: 10/9/2009 8:10:07 AM - Avg8 Update
RP1129: 10/9/2009 10:07:47 AM - Windows Defender Checkpoint
RP1130: 10/10/2009 10:30:29 AM - System Checkpoint
RP1131: 10/11/2009 7:52:53 AM - Restore Operation
RP1132: 10/11/2009 7:58:42 AM - Restore Operation
RP1133: 10/11/2009 8:12:05 AM - Restore Operation
RP1134: 10/12/2009 8:06:42 AM - Removed AVG Free 8.5
RP1135: 10/12/2009 8:10:08 AM - Installed AVG Free 8.5
RP1136: 10/19/2009 7:27:25 AM - System Checkpoint
RP1137: 10/20/2009 3:07:28 PM - System Checkpoint
RP1138: 10/22/2009 11:40:39 AM - System Checkpoint
RP1139: 10/24/2009 3:53:06 PM - System Checkpoint
RP1140: 10/26/2009 6:42:14 AM - System Checkpoint

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.0.9
Adobe® Photoshop® Album Starter Edition 3.2
Advanced Decoder Patch
America Online (Choose which version to remove)
Andrea VoiceCenter
AOL Connectivity Services
AOLIcon
Avira AntiVir Personal - Free Antivirus
BioShock
Broadcom Management Programs
Conexant HDA D110 MDC V.92 Modem
Creative Audio Pack
Creative MediaSource 5
Critical Update for Windows Media Player 11 (KB959772)
Dell CinePlayer
Dell Support 3.2.1
Dell Wireless WLAN Card
Digital Content Portal
Digital Line Detect
Documentation & Support Launcher
ESPNMotion
eyeQ
Financial Accounting Research System
Full Tilt Poker
Full Tilt Poker.Net
Games, Music, & Photos Launcher
getPlus®_ocx
Google Desktop
Google Toolbar for Internet Explorer
High Definition Audio Driver Package - KB835221
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
HP Driver Diagnostics
HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet
HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet Drivers
Internet Service Offers Launcher
J2SE Runtime Environment 5.0 Update 6
Learn2 Player (Uninstall Only)
Logitech QuickCam Software
Logitech® Camera Driver
Malwarebytes' Anti-Malware
Medieval II Total War
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Age of Empires II
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
Mobile Broadband Drivers
Modem Helper
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
NetWaiting
NVIDIA Drivers
Otto
QuickBooks Pro 2006
QuickSet
QuickTime
RealPlayer Basic
Roxio DLA
Roxio Express Labeler
Roxio MyDVD Plus
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
SearchAssist
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Skype Setup
Sonic Activation Module
Sonic Encoders
Sonic Update Manager
Sound Blaster ADVANCED MB Drivers
Sound Blaster Audigy ADVANCED MB
Sound Blaster Audigy ADVANCED MB Product Registration
Star Wars Empire at War
Synaptics Pointing Device Driver
System Requirements Lab
Trend Micro PC-cillin Internet Security
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
Update Rollup 2 for Windows XP Media Center Edition 2005
URL Assistant
Viewpoint Media Player
VZAccess Manager
WebFldrs XP
WIDCOMM Bluetooth Software
Windows Defender
Windows Genuine Advantage Notifications (KB905474)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
Windows Media Player 11
Windows XP Media Center Edition 2005 KB908246
Windows XP Media Center Edition 2005 KB912067
Windows XP Media Center Edition 2005 KB973768
Windows XP Service Pack 3
Wireless Keyboard

==== Event Viewer Messages From Past Week ========

10/26/2009 6:18:53 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
10/26/2009 6:11:10 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD APPDRV avipbb Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss ssmdrv Tcpip tmtdi
10/26/2009 6:11:10 AM, error: Service Control Manager [7001] - The Trend Micro Proxy Service service depends on the Trend Micro TDI Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/26/2009 6:11:10 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
10/26/2009 6:11:10 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/26/2009 6:11:10 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
10/26/2009 6:11:10 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
10/26/2009 6:10:57 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
10/26/2009 6:10:37 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
10/24/2009 3:18:29 PM, error: Print [6161] - The document Microsoft Word - MAGGIE Report Summary.doc owned by Ricks failed to print on printer HP DeskJet 830C/832C. Data type: NT EMF 1.008. Size of the spool file in bytes: 1338480. Number of bytes printed: 0. Total number of pages in the document: 20. Number of pages printed: 0. Client machine: \\ROADRUNNER. Win32 error code returned by the print processor: 2 (0x2).
10/20/2009 3:36:21 PM, error: DCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {0C0A3666-30C9-11D0-8F20-00805F2CD064} to the user ROADRUNNER\Ricks SID (S-1-5-21-999908618-2689249281-85626951-1012). This security permission can be modified using the Component Services administrative tool.

==== End Of File ===========================

RootRepeal Log


ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/10/28 07:45
Program Version: Version 1.3.5.0
Windows Version: Windows XP Media Center Edition SP3
==================================================

Drivers
-------------------
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB2DC8000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: c:\documents and settings\managing system\local settings\temp\~df178a.tmp
Status: Allocation size mismatch (API: 458752, Raw: 16384)

Path: c:\documents and settings\managing system\local settings\temp\~df3e30.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: c:\documents and settings\managing system\local settings\temp\~dfa8f7.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: c:\documents and settings\managing system\local settings\temp\~dfcd46.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: c:\documents and settings\managing system\local settings\temp\~dfcdee.tmp
Status: Allocation size mismatch (API: 131072, Raw: 16384)

==EOF==

BC AdBot (Login to Remove)

 


#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:32 PM

Posted 28 October 2009 - 05:34 PM

Hello! :(
My name is Sam and I will be helping you.

In order to see what's going on with your computer I'll ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.



Please download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Important!
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.
Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.



Make sure that you save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#3 Rickphx

Rickphx
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:06:32 PM

Posted 28 October 2009 - 10:21 PM

Hi Buckeye Sam,

Thanks in advance for your help. Sounds like you are an Ohio State fan, both my parents are from OH.

So I download the combinedfix program to my desk top and attempted to run it, but received an error that "Avira AntiVir PersonalEdition" was running and that I should disable it before proceeding. When I was on the regular malware forum, Computer Pro indicated that I should strip off all extra virus protection but the Trend Micro, so I have already attempted to delete the Avira program, but it looks like it may not have full unistalled. Any thoughts on this or should I just continue even though the CombinedFix issues a warning.

Also when I signed on today a new program came up after my desktop appeared "SecurityTools" and started running, I had not added this program and I did a hard shut down, since I could not even bring up the task manager to end the program. I restarted and it came up again. Again I did a hard shut down. On the third start up I brought up Task Manager right away once desk top was visible and before SecurityTools took control and stopped the program using the end task control. THIS WAS NEW TODAY.

In the past I am getting these weird full page popups, even though my popup control is set to maximum security.

Thought you should know these things.

I'll look forward to your comments on what to do with the Combined Fix program and the Avira which I have unistalled as best as I can.

Thanks,

#4 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:32 PM

Posted 29 October 2009 - 08:02 AM

If you have uninstalled Avira, proceed with Combofix. Disregard any warnings it gives you about Avira.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#5 Rickphx

Rickphx
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:06:32 PM

Posted 04 November 2009 - 03:25 PM

Hi Sam,

Sorry for the delay getting back I was out of town on work travel.

Here is the report from combofix

________________

ComboFix 09-11-04.02 - Managing System 11/04/2009 12:56.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1347 [GMT -7:00]
Running from: c:\documents and settings\Managing System\Desktop\ComboFix2.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: PC-cillin Internet Security - Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\72468532
c:\documents and settings\All Users\Application Data\72468532\72468532.bat
c:\documents and settings\All Users\Application Data\72468532\72468532.exe
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Managing System\Desktop\Security Tool.lnk
c:\documents and settings\Managing System\Start Menu\Programs\Security Tool.lnk
c:\windows\kb913800.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\bszip.dll
c:\windows\system32\Data
c:\windows\system32\dezopiji.dll
c:\windows\system32\dofodiro.dll
c:\windows\system32\dumphive.exe
c:\windows\system32\fohavato.dll
c:\windows\system32\fuzadule.dll
c:\windows\system32\gamuhabo.dll
c:\windows\system32\gobekado.dll
c:\windows\system32\gomevibi.dll
c:\windows\system32\hezovetu.exe
c:\windows\system32\higesamo.dll.tmp
c:\windows\system32\huwifolu.dll
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\jekosefu.exe
c:\windows\system32\jurafisi.dll
c:\windows\system32\kebulovo.dll
c:\windows\system32\korakuma.dll
c:\windows\system32\mebokewe.dll
c:\windows\system32\molukoza.exe
c:\windows\system32\nafohata.exe
c:\windows\system32\nehalofu.dll
c:\windows\system32\nelumoje.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\pafelewa.dll.tmp
c:\windows\system32\peserodo.dll
c:\windows\system32\pijizare.dll.tmp
c:\windows\system32\piwuporo.dll
c:\windows\system32\Process.exe
c:\windows\system32\razifazi.dll.tmp
c:\windows\system32\repomini.dll
c:\windows\system32\rizewilo.dll
c:\windows\system32\rpcss(3)(2).dll
c:\windows\system32\sidejuwo.dll
c:\windows\system32\sigalesi.dll.tmp
c:\windows\system32\sodubudu.dll.tmp
c:\windows\system32\SrchSTS.exe
c:\windows\system32\sujejawo.dll.tmp
c:\windows\system32\tirobuse.dll
c:\windows\system32\tmp.reg
c:\windows\system32\toyedofi.dll
c:\windows\system32\tuburavi.dll
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\vigodite.dll.tmp
c:\windows\system32\wayapego.dll.tmp
c:\windows\system32\WS2Fix.exe
c:\windows\system32\zeladugu.dll
c:\windows\system32\zisilore.dll
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat . . . . failed to delete
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat . . . . failed to delete

----- BITS: Possible infected sites -----

hxxp://82.98.235.208
hxxp://82.98.231.100
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Ias
-------\Service_Iprip
-------\Service_NWCWorkstation


((((((((((((((((((((((((( Files Created from 2009-10-04 to 2009-11-04 )))))))))))))))))))))))))))))))
.

2009-11-04 19:50 . 2009-11-04 19:53 -------- d-----w- C:\ComboFix2
2009-10-19 23:02 . 2009-10-19 23:03 -------- d-----w- C:\Autorun
2009-10-13 11:08 . 2009-10-13 11:08 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-10-12 19:14 . 2009-10-12 20:47 -------- d-----w- c:\program files\downloads
2009-10-12 17:50 . 2009-10-12 17:50 -------- d-----w- c:\documents and settings\Managing System\Application Data\Malwarebytes
2009-10-12 17:22 . 2009-09-10 20:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-12 17:22 . 2009-10-12 17:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-12 17:22 . 2009-10-12 17:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-12 17:22 . 2009-09-10 20:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-09 15:09 . 2009-10-09 20:06 -------- d-----w- c:\documents and settings\Ricks\Local Settings\Application Data\FullTiltPoker.NET
2009-10-09 14:43 . 2009-10-09 14:44 -------- d-----w- c:\documents and settings\Managing System\Local Settings\Application Data\FullTiltPoker
2009-10-08 21:20 . 2009-10-08 21:20 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-04 20:10 . 2007-01-09 14:48 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-10-25 16:05 . 2007-01-09 14:20 232248 ----a-w- c:\windows\system32\nvModes.dat
2009-10-09 20:06 . 2007-05-06 16:46 -------- d-----w- c:\program files\poker
2009-10-09 14:45 . 2007-05-06 17:23 -------- d-----w- c:\program files\Full Tilt Poker
2009-10-08 11:07 . 2009-09-02 00:13 -------- d-----w- c:\documents and settings\Ricks\Application Data\MyDataZone
2009-10-02 00:48 . 2009-10-02 00:48 -------- d-----w- c:\documents and settings\Ricks\Application Data\IObit
2009-10-01 16:29 . 2009-10-02 19:55 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-08-30 19:45 . 2008-12-28 16:17 128 ----a-w- c:\documents and settings\Ricks\Local Settings\Application Data\fusioncache.dat
2009-08-07 01:24 . 2005-08-16 10:40 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 01:24 . 2005-08-16 10:40 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 01:24 . 2005-08-16 10:40 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 01:24 . 2005-05-26 11:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 01:24 . 2005-08-16 10:40 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-07 01:24 . 2005-08-16 10:18 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 01:23 . 2005-08-16 10:40 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 01:23 . 2008-06-16 14:26 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 01:23 . 2008-06-16 14:26 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 01:23 . 2005-08-16 10:40 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-07-28 14:19 . 2009-07-28 14:19 1051168 --sha-w- c:\windows\system32\nukubufa.exe
2009-07-21 01:37 . 2009-07-21 01:37 838656 --sha-w- c:\windows\system32\zopimiwo.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-20 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"OE_OEM"="c:\program files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe" [2006-11-01 321040]
"SetDefaultMIDI"="MIDIDef.exe" - c:\windows\MIDIDEF.EXE [2004-12-22 24576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-22 13508608]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-22 1392640]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-08-04 1032192]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter"="c:\program files\Creative\VoiceCenter\AndreaVC.exe" [2006-02-16 1118208]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2006-05-04 237568]
"LogitechCameraAssistant"="c:\program files\Logitech\Video\CameraAssistant.exe" [2006-05-04 489472]
"LogitechVideo[inspector]"="c:\program files\Logitech\Video\InstallHelper.exe" [2006-05-04 14:32 73728]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-01-09 169984]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-01-09 98304]
"bacstray"="c:\program files\Broadcom\BACS\BacsTray.exe" [2005-07-13 118784]
"FLMK08KB"="c:\program files\Micro Innovations\Wireless Keyboard\KbdAp32A.exe" [2007-06-10 384512]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 69632]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-02-22 1626112]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2008-02-22 86016]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-24 282624]
"NvMediaCenter"="NvMCTray.dll" - c:\windows\system32\nvmctray.dll [2008-02-22 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Ricks\Start Menu\Programs\Startup\
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2007-11-11 1787184]

c:\documents and settings\Managing System\Start Menu\Programs\Startup\
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2007-11-11 1787184]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-24 622653]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-1-9 24576]
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-6-27 323646]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
MiniEYE-MiniREAD Launch.lnk - c:\program files\Infinite Mind LC\eyeQ\ARLaunch.exe [2007-6-17 323584]
officejet 6100.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-6-27 147456]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2006-2-9 811008]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"=
"c:\\Program Files\\Trend Micro\\Internet Security 14\\PcCtlCom.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=

R2 litsgt;litsgt;c:\windows\system32\drivers\litsgt.sys [6/17/2007 6:15 AM 137344]
R2 tansgt;tansgt;c:\windows\system32\drivers\tansgt.sys [6/17/2007 6:15 AM 12032]
R2 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [8/16/2007 4:28 AM 345432]
R2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [11/9/2006 1:03 AM 923216]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [6/12/2007 5:00 AM 36368]
R2 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [11/9/2006 1:04 AM 566872]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [11/9/2006 1:03 AM 280392]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBR
*Deregistered* - mbr
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/search?q=work+groups&rls=com.microsoft:*:IE-Address&ie=UTF-8&oe=UTF-8&sourceid=ie7&rlz=1I7DMUS
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {73B30E9B-D111-4E99-9788-219135010899} = 66.174.92.14 66.174.95.44
.
- - - - ORPHANS REMOVED - - - -

BHO-{5dfe6459-1adc-416a-b988-054239706af2} - wizejimi.dll
BHO-{6b0b07b5-daaf-4cdc-958c-63905cdb255f} - peserodo.dll
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-72468532 - c:\documents and settings\All Users\Application Data\72468532\72468532.exe
HKLM-Run-zayohopen - c:\windows\system32\gomevibi.dll
HKLM-Run-pewugeduku - korakuma.dll
SharedTaskScheduler-{8af7267f-80b9-42de-8e35-ab5cbf5d1fa1} - c:\windows\system32\wedijuzo.dll
SharedTaskScheduler-{e5f284e7-eed0-419f-abde-c35e8a043640} - c:\windows\system32\wedijuzo.dll
SharedTaskScheduler-{e39ba52b-aee7-4dbe-bc10-b04fd13c022c} - c:\windows\system32\wedijuzo.dll
SharedTaskScheduler-{8aec81e0-562f-4e2e-8a39-aab278786500} - c:\windows\system32\wedijuzo.dll
SharedTaskScheduler-{799f3003-40a3-4cd5-8d7e-c6faca8c921e} - c:\windows\system32\wedijuzo.dll
SharedTaskScheduler-{d50e7d12-f705-4124-b5c9-bfe9ddb3cdb9} - c:\windows\system32\wedijuzo.dll
SharedTaskScheduler-{1b33ec57-ebc0-46be-9b67-7fb6cc235129} - c:\windows\system32\gomevibi.dll
SharedTaskScheduler-{385211af-4a20-4628-9f05-71c9f258fc19} - c:\windows\system32\gomevibi.dll
SSODL-beyenenuv-{8af7267f-80b9-42de-8e35-ab5cbf5d1fa1} - c:\windows\system32\wedijuzo.dll
SSODL-yiyomeros-{e5f284e7-eed0-419f-abde-c35e8a043640} - c:\windows\system32\wedijuzo.dll
SSODL-pebaniked-{e39ba52b-aee7-4dbe-bc10-b04fd13c022c} - c:\windows\system32\wedijuzo.dll
SSODL-danoyovaz-{8aec81e0-562f-4e2e-8a39-aab278786500} - c:\windows\system32\wedijuzo.dll
SSODL-fupasudum-{799f3003-40a3-4cd5-8d7e-c6faca8c921e} - c:\windows\system32\wedijuzo.dll
SSODL-jegahuwig-{d50e7d12-f705-4124-b5c9-bfe9ddb3cdb9} - c:\windows\system32\wedijuzo.dll
SSODL-midufuriz-{1b33ec57-ebc0-46be-9b67-7fb6cc235129} - c:\windows\system32\gomevibi.dll
SSODL-tadugedil-{385211af-4a20-4628-9f05-71c9f258fc19} - c:\windows\system32\gomevibi.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-04 13:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,62,b5,40,5f,33,52,ee,49,ab,3e,f2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,62,b5,40,5f,33,52,ee,49,ab,3e,f2,\

[HKEY_USERS\S-1-5-21-999908618-2689249281-85626951-1010\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:f6,b3,a4,6c,c0,de,28,a0,87,be,75,46,f5,04,6a,b6,3f,7f,bf,04,ab,8b,ae,
31,53,e9,a8,8e,67,7d,d5,a5,20,69,4d,98,fd,42,57,b5,06,ae,2b,55,46,66,9a,96,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(764)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\CTsvcCDA.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\progra~1\TRENDM~1\INTERN~1\PcCtlCom.exe
c:\windows\system32\stacsv.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\rundll32.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\RunDLL32.exe
c:\windows\system32\Rundll32.exe
c:\windows\system32\Rundll32.exe
c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
.
**************************************************************************
.
Completion time: 2009-11-04 13:18 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-04 20:18

Pre-Run: 17,202,741,248 bytes free
Post-Run: 19,524,100,096 bytes free

#6 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:32 PM

Posted 04 November 2009 - 07:50 PM

Copy and paste ALL the following text in the Quote box below into Notepad.
Click on File(in the menu at the top)>Save as../Save as Type: 'All Files' /File name: CFScript to your desktop.

File::
c:\windows\system32\nukubufa.exe
c:\windows\system32\zopimiwo.exe
Prior to running Combofix.exe you should disable your antivirus program.

Now drag then drop the CFScript file onto ComboFix.exe as seen in the image below.

Posted Image

This will start ComboFix again.
After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.



===================



Please update Malwarebytes and run a full scan.
  • Open Malwarebytes and select the Update tab.
  • Click on the Check for Updates button and allow the program to download the latest updates.
  • Once you have the latest updates, select the Scanner tab.
  • Select "Perform full scan" and click the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#7 Rickphx

Rickphx
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:06:32 PM

Posted 05 November 2009 - 02:52 PM

Hi Sam,

Thanks again for your help.

I ran the Combofix with the text you provided pasted into it. One question, during the running of this program it indicated that there was a new version of the program and did i want to download it. Since i was not sure if this was Combofix related or someother program I did not accept. Should i rerun and accept the updated version?

Below is my Combofix log

___________________

ComboFix 09-11-04.02 - Managing System 11/05/2009 6:25.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1432 [GMT -7:00]
Running from: c:\documents and settings\Managing System\Desktop\ComboFix2.exe
Command switches used :: c:\documents and settings\Managing System\Desktop\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: PC-cillin Internet Security - Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

FILE ::
"c:\windows\system32\nukubufa.exe"
"c:\windows\system32\zopimiwo.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\nukubufa.exe
c:\windows\system32\zopimiwo.exe

.
((((((((((((((((((((((((( Files Created from 2009-10-05 to 2009-11-05 )))))))))))))))))))))))))))))))
.

2009-11-04 19:55 . 2009-11-04 20:18 -------- d-----w- C:\ComboFix213445C
2009-11-04 19:50 . 2009-11-04 19:53 -------- d-----w- C:\ComboFix2
2009-10-19 23:02 . 2009-10-19 23:03 -------- d-----w- C:\Autorun
2009-10-13 11:08 . 2009-10-13 11:08 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-10-12 19:14 . 2009-10-12 20:47 -------- d-----w- c:\program files\downloads
2009-10-12 17:50 . 2009-10-12 17:50 -------- d-----w- c:\documents and settings\Managing System\Application Data\Malwarebytes
2009-10-12 17:22 . 2009-09-10 20:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-12 17:22 . 2009-10-12 17:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-12 17:22 . 2009-10-12 17:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-12 17:22 . 2009-09-10 20:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-09 15:09 . 2009-10-09 20:06 -------- d-----w- c:\documents and settings\Ricks\Local Settings\Application Data\FullTiltPoker.NET
2009-10-09 14:43 . 2009-10-09 14:44 -------- d-----w- c:\documents and settings\Managing System\Local Settings\Application Data\FullTiltPoker
2009-10-08 21:20 . 2009-10-08 21:20 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-05 13:21 . 2007-01-09 14:48 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-11-05 13:20 . 2007-01-09 14:58 -------- d-----w- c:\program files\Microsoft Works
2009-10-25 16:05 . 2007-01-09 14:20 232248 ----a-w- c:\windows\system32\nvModes.dat
2009-10-09 20:06 . 2007-05-06 16:46 -------- d-----w- c:\program files\poker
2009-10-09 14:45 . 2007-05-06 17:23 -------- d-----w- c:\program files\Full Tilt Poker
2009-10-08 11:07 . 2009-09-02 00:13 -------- d-----w- c:\documents and settings\Ricks\Application Data\MyDataZone
2009-10-02 00:48 . 2009-10-02 00:48 -------- d-----w- c:\documents and settings\Ricks\Application Data\IObit
2009-10-01 16:29 . 2009-10-02 19:55 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-08-30 19:45 . 2008-12-28 16:17 128 ----a-w- c:\documents and settings\Ricks\Local Settings\Application Data\fusioncache.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-11-04_20.12.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-08-16 10:18 . 2009-11-05 13:26 73270 c:\windows\system32\perfc009.dat
- 2005-08-16 10:18 . 2009-11-04 20:15 73270 c:\windows\system32\perfc009.dat
+ 2003-09-04 21:14 . 2003-09-04 21:14 94208 c:\windows\system32\Macromed\Flash\GetFlash.exe
- 2003-09-04 21:14 . 2003-09-04 20:14 94208 c:\windows\system32\Macromed\Flash\GetFlash.exe
+ 2004-09-30 01:11 . 2009-06-24 19:56 86016 c:\windows\Microsoft.NET\Framework\v1.0.3705\ToGac.exe
+ 2004-10-08 00:36 . 2009-06-24 19:56 73728 c:\windows\Microsoft.NET\Framework\v1.0.3705\SetRegNI.exe
- 2005-08-16 10:38 . 2007-01-02 22:29 86016 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorld.dll
+ 2005-08-16 10:38 . 2009-06-24 05:01 86016 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorld.dll
- 2005-08-16 10:38 . 2007-01-02 22:29 73728 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorie.dll
+ 2005-08-16 10:38 . 2009-06-24 05:01 73728 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorie.dll
- 2005-08-16 10:38 . 2008-04-13 16:10 32768 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_wp.exe
+ 2005-08-16 10:38 . 2009-06-24 05:12 32768 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_wp.exe
- 2005-08-16 10:38 . 2008-04-13 16:10 32768 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_state.exe
+ 2005-08-16 10:38 . 2009-06-24 05:12 32768 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_state.exe
+ 2007-01-09 14:58 . 2009-11-05 13:20 17534 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\gtngstrtd.exe
- 2007-01-09 14:58 . 2009-06-13 16:34 17534 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\gtngstrtd.exe
- 2007-01-09 14:58 . 2009-06-13 16:34 65536 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\_B8B1511D9331_467C_9B1B_E8204012E95B.exe
+ 2007-01-09 14:58 . 2009-11-05 13:20 65536 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\_B8B1511D9331_467C_9B1B_E8204012E95B.exe
+ 2007-01-09 14:58 . 2009-11-05 13:20 65536 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\_630CEEA9B210_4765_A2B1_FC24596048D7.exe
- 2007-01-09 14:58 . 2009-06-13 16:34 65536 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\_630CEEA9B210_4765_A2B1_FC24596048D7.exe
- 2007-01-09 14:58 . 2009-06-13 16:34 65536 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\_4E403E143BE9_4CD1_B8DF_8012EBBE9E82.exe
+ 2007-01-09 14:58 . 2009-11-05 13:20 65536 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\_4E403E143BE9_4CD1_B8DF_8012EBBE9E82.exe
+ 2009-11-05 13:18 . 2009-11-05 13:18 90112 c:\windows\assembly\NativeImages1_v1.0.3705\System.Drawing.Design\1.0.3300.0__b03f5f7f11d50a3a_882ae0ce\System.Drawing.Design.dll
+ 2009-11-05 13:18 . 2009-11-05 13:18 61440 c:\windows\assembly\NativeImages1_v1.0.3705\CustomMarshalers\1.0.3300.0__b03f5f7f11d50a3a_49b4ae2d\CustomMarshalers.dll
+ 2009-11-05 13:16 . 2009-11-05 13:20 5300 c:\windows\SoftwareDistribution\EventCache\{2EDC7A81-9252-4C96-9684-313263EDD5D6}.bin
+ 2005-08-16 10:38 . 2009-06-29 18:57 8192 c:\windows\Microsoft.NET\Framework\v1.0.3705\IEExec.exe
- 2005-08-16 10:38 . 2007-01-02 22:29 8192 c:\windows\Microsoft.NET\Framework\v1.0.3705\IEExec.exe
+ 2007-01-09 14:58 . 2009-11-05 13:20 4710 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\WSBico.exe
- 2007-01-09 14:58 . 2009-06-13 16:34 4710 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\WSBico.exe
- 2007-01-09 14:58 . 2009-06-13 16:34 4710 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\Win2Kico.exe
+ 2007-01-09 14:58 . 2009-11-05 13:20 4710 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\Win2Kico.exe
+ 2005-08-16 10:18 . 2009-11-05 13:26 441774 c:\windows\system32\perfh009.dat
- 2005-08-16 10:18 . 2009-11-04 20:15 441774 c:\windows\system32\perfh009.dat
- 2005-08-16 10:38 . 2004-07-20 00:54 303104 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorjit.dll
+ 2005-08-16 10:38 . 2009-06-24 04:59 303104 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorjit.dll
+ 2005-08-16 10:38 . 2009-06-24 05:12 200704 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_isapi.dll
- 2005-08-16 10:38 . 2008-04-13 16:09 200704 c:\windows\Microsoft.NET\Framework\v1.0.3705\aspnet_isapi.dll
- 2007-01-09 14:58 . 2009-06-13 16:34 184320 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\_9FA356B1395F_4530_8CB3_946ED0B3291E.exe
+ 2007-01-09 14:58 . 2009-11-05 13:20 184320 c:\windows\Installer\{6D52C408-B09A-4520-9B18-475B81D393F1}\_9FA356B1395F_4530_8CB3_946ED0B3291E.exe
+ 2009-11-05 13:18 . 2009-11-05 13:18 847872 c:\windows\assembly\NativeImages1_v1.0.3705\System.Drawing\1.0.3300.0__b03f5f7f11d50a3a_430e5134\System.Drawing.dll
+ 2005-08-16 10:18 . 2009-08-04 15:13 2145280 c:\windows\system32\ntoskrnl.exe
- 2005-08-16 10:18 . 2009-02-06 11:06 2145280 c:\windows\system32\ntoskrnl.exe
- 2004-08-04 04:59 . 2009-02-06 10:32 2023936 c:\windows\system32\ntkrnlpa.exe
+ 2004-08-04 04:59 . 2009-08-04 14:20 2023936 c:\windows\system32\ntkrnlpa.exe
+ 2008-10-31 03:35 . 2009-08-05 03:44 2189184 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2008-10-31 03:35 . 2009-08-04 14:20 2023936 c:\windows\system32\dllcache\ntkrpamp.exe
- 2008-10-31 03:35 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\ntkrpamp.exe
- 2008-10-31 03:35 . 2009-02-08 01:02 2066048 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2008-10-31 03:35 . 2009-08-04 14:20 2066048 c:\windows\system32\dllcache\ntkrnlpa.exe
- 2008-10-31 03:35 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2008-10-31 03:35 . 2009-08-04 15:13 2145280 c:\windows\system32\dllcache\ntkrnlmp.exe
- 2005-08-16 10:38 . 2007-01-02 22:40 1200128 c:\windows\Microsoft.NET\Framework\v1.0.3705\System.Web.dll
+ 2005-08-16 10:38 . 2009-06-29 18:58 1200128 c:\windows\Microsoft.NET\Framework\v1.0.3705\System.Web.dll
- 2005-08-16 10:38 . 2007-12-17 11:59 2281472 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
+ 2005-08-16 10:38 . 2009-06-24 05:00 2281472 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
+ 2005-08-16 10:38 . 2009-06-24 05:00 2273280 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorsvr.dll
- 2005-08-16 10:38 . 2007-12-17 11:58 2273280 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorsvr.dll
+ 2005-08-16 10:38 . 2009-06-29 18:58 1998848 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorlib.dll
- 2005-08-16 10:38 . 2007-01-02 22:21 1998848 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscorlib.dll
+ 2009-09-17 21:03 . 2009-09-17 21:03 4873216 c:\windows\Installer\44bcb.msp
+ 2008-10-31 03:35 . 2009-08-05 03:44 2189184 c:\windows\Driver Cache\i386\ntoskrnl.exe
- 2008-10-31 03:35 . 2009-02-06 10:32 2023936 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2008-10-31 03:35 . 2009-08-04 14:20 2023936 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2008-10-31 03:35 . 2009-08-04 14:20 2066048 c:\windows\Driver Cache\i386\ntkrnlpa.exe
- 2008-10-31 03:35 . 2009-02-08 01:02 2066048 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-10-31 03:35 . 2009-08-04 15:13 2145280 c:\windows\Driver Cache\i386\ntkrnlmp.exe
- 2008-10-31 03:35 . 2009-02-06 11:06 2145280 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2009-11-05 13:18 . 2009-11-05 13:18 1855488 c:\windows\assembly\NativeImages1_v1.0.3705\System\1.0.3300.0__b77a5c561934e089_1a96daae\System.dll
+ 2009-11-05 13:18 . 2009-11-05 13:18 2027520 c:\windows\assembly\NativeImages1_v1.0.3705\System.Xml\1.0.3300.0__b77a5c561934e089_147cfd36\System.Xml.dll
+ 2009-11-05 13:18 . 2009-11-05 13:18 2953216 c:\windows\assembly\NativeImages1_v1.0.3705\System.Windows.Forms\1.0.3300.0__b77a5c561934e089_7886bb5a\System.Windows.Forms.dll
+ 2009-11-05 13:18 . 2009-11-05 13:18 1454080 c:\windows\assembly\NativeImages1_v1.0.3705\System.Design\1.0.3300.0__b03f5f7f11d50a3a_b5305c49\System.Design.dll
+ 2009-11-05 13:18 . 2009-11-05 13:18 3301376 c:\windows\assembly\NativeImages1_v1.0.3705\mscorlib\1.0.3300.0__b77a5c561934e089_7598460c\mscorlib.dll
+ 2009-11-05 13:18 . 2009-11-05 13:18 1200128 c:\windows\assembly\GAC\System.Web\1.0.3300.0__b03f5f7f11d50a3a\System.Web.dll
- 2009-03-28 17:18 . 2009-03-28 17:18 1200128 c:\windows\assembly\GAC\System.Web\1.0.3300.0__b03f5f7f11d50a3a\System.Web.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-20 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"OE_OEM"="c:\program files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe" [2006-11-01 321040]
"SetDefaultMIDI"="MIDIDef.exe" - c:\windows\MIDIDEF.EXE [2004-12-22 24576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-22 13508608]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-22 1392640]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-08-04 1032192]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter"="c:\program files\Creative\VoiceCenter\AndreaVC.exe" [2006-02-16 1118208]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2006-05-04 237568]
"LogitechCameraAssistant"="c:\program files\Logitech\Video\CameraAssistant.exe" [2006-05-04 489472]
"LogitechVideo[inspector]"="c:\program files\Logitech\Video\InstallHelper.exe" [2006-05-04 14:32 73728]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-01-09 169984]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-01-09 98304]
"bacstray"="c:\program files\Broadcom\BACS\BacsTray.exe" [2005-07-13 118784]
"FLMK08KB"="c:\program files\Micro Innovations\Wireless Keyboard\KbdAp32A.exe" [2007-06-10 384512]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 69632]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-02-22 1626112]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2008-02-22 86016]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-24 282624]
"NvMediaCenter"="NvMCTray.dll" - c:\windows\system32\nvmctray.dll [2008-02-22 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Ricks\Start Menu\Programs\Startup\
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2007-11-11 1787184]

c:\documents and settings\Managing System\Start Menu\Programs\Startup\
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2007-11-11 1787184]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-24 622653]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-1-9 24576]
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-6-27 323646]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
MiniEYE-MiniREAD Launch.lnk - c:\program files\Infinite Mind LC\eyeQ\ARLaunch.exe [2007-6-17 323584]
officejet 6100.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-6-27 147456]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2006-2-9 811008]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"=
"c:\\Program Files\\Trend Micro\\Internet Security 14\\PcCtlCom.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=

R2 litsgt;litsgt;c:\windows\system32\drivers\litsgt.sys [6/17/2007 6:15 AM 137344]
R2 tansgt;tansgt;c:\windows\system32\drivers\tansgt.sys [6/17/2007 6:15 AM 12032]
R2 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [8/16/2007 4:28 AM 345432]
R2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [11/9/2006 1:03 AM 923216]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [6/12/2007 5:00 AM 36368]
R2 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [11/9/2006 1:04 AM 566872]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [11/9/2006 1:03 AM 280392]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/search?q=work+groups&rls=com.microsoft:*:IE-Address&ie=UTF-8&oe=UTF-8&sourceid=ie7&rlz=1I7DMUS
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {73B30E9B-D111-4E99-9788-219135010899} = 66.174.92.14 66.174.95.44
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-05 06:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,62,b5,40,5f,33,52,ee,49,ab,3e,f2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,62,b5,40,5f,33,52,ee,49,ab,3e,f2,\

[HKEY_USERS\S-1-5-21-999908618-2689249281-85626951-1010\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:f6,b3,a4,6c,c0,de,28,a0,87,be,75,46,f5,04,6a,b6,3f,7f,bf,04,ab,8b,ae,
31,53,e9,a8,8e,67,7d,d5,a5,20,69,4d,98,fd,42,57,b5,06,ae,2b,55,46,66,9a,96,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
Completion time: 2009-11-05 6:36
ComboFix-quarantined-files.txt 2009-11-05 13:36
ComboFix2.txt 2009-11-04 20:18

Pre-Run: 19,326,296,064 bytes free
Post-Run: 19,277,299,712 bytes free

#8 Rickphx

Rickphx
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:06:32 PM

Posted 05 November 2009 - 02:56 PM

Sam,

Here is the report from the updated Malware run. Thanks again

___________________

Database version: 3105
Windows 5.1.2600 Service Pack 3

11/5/2009 7:58:12 AM
mbam-log-2009-11-05 (07-58-12).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 281776
Time elapsed: 1 hour(s), 0 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 76

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\72468532\72468532.exe.vir (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dezopiji.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dofodiro.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\fohavato.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\fuzadule.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\gomevibi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\higesamo.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\huwifolu.dll.vir (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jurafisi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kebulovo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\korakuma.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\mebokewe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\nehalofu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\nelumoje.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\nukubufa.exe.vir (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\pafelewa.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\peserodo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\pijizare.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\piwuporo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\razifazi.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\repomini.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\rizewilo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\sigalesi.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\sodubudu.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\sujejawo.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\tirobuse.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\toyedofi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\tuburavi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\vigodite.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wayapego.dll.tmp.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zeladugu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zisilore.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zopimiwo.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1126\A0650835.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1126\A0650836.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1126\A0650837.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1126\A0650839.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1130\A0651857.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1137\A0656012.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1137\A0656013.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1137\A0656014.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1137\A0656107.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1137\A0656108.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1137\A0656109.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1140\A0658287.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1140\A0658288.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1140\A0658289.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1141\A0658343.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1141\A0658344.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1141\A0658345.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1141\A0658347.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1141\A0658348.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659668.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659675.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659676.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659679.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659682.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659684.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659688.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659689.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659690.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659691.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659694.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659695.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659697.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659698.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659700.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659701.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659705.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659707.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659708.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659712.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659713.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1143\A0659678.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1144\A0659945.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1144\A0659946.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

#9 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:32 PM

Posted 05 November 2009 - 07:06 PM

I'm not sure we'll need to run Combofix again, but if we do then yes you will want to download the updated version.
How is your computer behaving now?
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#10 Rickphx

Rickphx
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:06:32 PM

Posted 08 November 2009 - 12:05 PM

Morning Sam,

Hope your weekend is going well. The computer is working better, thank you. What you have suggested looks like it took care of the SecurityTool virus issues and I have not had weird popups happening. One item that concerns me though is that I can not manually update my TrendMicro virus definitions. I get a message that says to try again in a little while because the program is in the process of loading, does not seem to matter how long I wait this message. The definitions appear to be updating through the automatic update that I have setup, just not working with the manual.

Also on some of the other computer logins setup on my machine I am getting a piwnporo.dll erorr

Thoughts?

Rick

#11 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:32 PM

Posted 09 November 2009 - 07:43 AM

Go here and download Hijackthis.
http://www.bleepingcomputer.com/files/hijackthis.php

Now log into the user account where you are getting the error message and create a log.
Please post that log in your next reply.


As far as your Trendmicro issue that sounds like something you should contact their support staff for. Since it is able to update automatically it doesn't seem to be a problem with your system overall, more likely just a Trendmicro issue.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#12 Rickphx

Rickphx
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:06:32 PM

Posted 09 November 2009 - 07:13 PM

Hi Sam,

Thanks again for your help. So i tried to run the program and received the following error.

Hijack This

For some reason your system denied write access to the Hosts File. If any hijacked domains are in this file, Hijack THis may not be able to fix this. If that happens, you need to edit the file yourself. To do this, click Start, Run and type:
notepad C:\WINDOWS\System32\drivers\etc\hosts
and press Enter. Find the line(s)HijackThis reports and delete them. Save the file as "hosts." (with quotes), and reboot.
For Vista: simply, exit HijackThis, right click on the HijackThis icon, choose'Run as adminstrator'.
________________________

Below is the log that the file created even though the error was created.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:59:22 PM, on 11/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Broadcom\BACS\BacsTray.exe
C:\Program Files\Micro Innovations\Wireless Keyboard\KbdAp32A.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
C:\Documents and Settings\Rick\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4070109
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4070109
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4070109
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [bacstray] C:\Program Files\Broadcom\BACS\BacsTray.exe
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Micro Innovations\Wireless Keyboard\KbdAp32A.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [zayohopen] Rundll32.exe "c:\windows\system32\piwuporo.dll",a
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
O4 - Startup: VZAccess Manager.lnk = C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MiniEYE-MiniREAD Launch.lnk = C:\Program Files\Infinite Mind LC\eyeQ\ARLaunch.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab3.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h30155.www3.hp.com/ediags/dd/instal...nosticsxp2k.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\stacsv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 11564 bytes

#13 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:32 PM

Posted 10 November 2009 - 07:57 AM

Run Hijackthis again, click scan, and Put a checkmark next to each of the lines listed below. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O4 - HKCU\..\Run: [zayohopen] Rundll32.exe "c:\windows\system32\piwuporo.dll",a



Reboot your computer, log into the same user account, and let me know if you still get any errors.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#14 Rickphx

Rickphx
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:06:32 PM

Posted 12 November 2009 - 09:43 AM

Sam,

No errors on login. The *.dll error is gone. But I still received the pervious error when I ran HijackThis. Replicated the error below, is this a problem?

________________________________

For some reason your system denied write access to the Hosts File. If any hijacked domains are in this file, Hijack THis may not be able to fix this. If that happens, you need to edit the file yourself. To do this, click Start, Run and type:
notepad C:\WINDOWS\System32\drivers\etc\hosts
and press Enter. Find the line(s)HijackThis reports and delete them. Save the file as "hosts." (with quotes), and reboot.
For Vista: simply, exit HijackThis, right click on the HijackThis icon, choose'Run as adminstrator'.

#15 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:32 PM

Posted 12 November 2009 - 05:43 PM

No, that's not a problem. It just indicates that you are using a non-administrative user account. And your hosts file doesn't have any problems.

Any other issues?
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users