Google search results being redirected to spam sites

I'm having a problem it seems a lot of people are having: searching on Google turns up normal results, but clicking on them makes the page not load for a few seconds and then goes off to some Spam site. Just started happening today.

I didn't install any specific file but I believe I may have received an email through Outlook that seemed to start this just by opening it. The email seemed to crash Word as the email editor for Outlook, and at that moment ESET kept repeatedly blocking a .RAR download from two different ip addresses. I ran a full Malwarebytes & ESET scan and it found a couple viruses and removed them. On reboot, still getting redirected. Tried a number of things I've read on a couple different forums including ComboFix (sorry didn't see that I should wait to run that, as noted on this site), and still getting redirected. Let me know if you want me to post the log from the ComboFix.

Anyways, here's my DDS log. The other two .txt files are attached. I had issues trying to run GMER at first, it locked up the computer and ran so slow for like 2 hours. I followed the instructions from a user having a similar problem so that you get the random named version of GMER, disable ESET, disconnect from the internet and was able to create a txt file.

Thanks in advance for any help!!


DDS (Ver_10-03-17.01) - NTFSx86
Run by eharrison at 14:20:10.19 on Fri 05/21/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3037.2523 [GMT -4:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PDF Complete\pdfsvc.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Print Manager Plus - Client\CheckPages.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Trojan Remover\Trjscan.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
C:\Program Files\AnalogX\Atomic TimeSync\ats.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\Documents and Settings\eharrison\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.hp.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [Google Update] "c:\documents and settings\eharrison\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [PDF Complete] c:\program files\pdf complete\pdfsty.exe
mRun: [SetRefresh] c:\program files\compaq\setrefresh\SetRefresh.exe
mRun: [Recguard] c:\windows\sminst\Recguard.exe
mRun: [Reminder] c:\windows\creator\Remind_XP.exe
mRun: [Scheduler] c:\windows\sminst\Scheduler.exe
mRun: [RoxioDragToDisc] "c:\program files\roxio\drag-to-disc\DrgToDsc.exe"
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [PrintManagerPlusClient] "c:\program files\print manager plus - client\CheckPages.exe"
mRun: [TrojanScanner] c:\program files\trojan remover\Trjscan.exe /boot
StartupFolder: c:\docume~1\eharri~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\eharri~1\startm~1\programs\startup\atomic~1.lnk - c:\program files\analogx\atomic timesync\ats.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\deskto~1.lnk - c:\program files\research in motion\blackberry\DesktopMgr.exe
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260895295039
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
TCP: {26AF1ED1-1A05-419C-BDE5-5B60FC4BF08A} = 10.0.0.4
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\eharri~1\applic~1\mozilla\firefox\profiles\6zbajrrb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\documents and settings\eharrison\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-9-29 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-9-29 96408]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-9-29 735960]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\pdf complete\pdfsvc.exe [2009-12-2 635416]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2009-12-2 243856]

=============== Created Last 30 ================

2010-05-21 18:13:45 0 d-sh--w- c:\documents and settings\eharrison\IECompatCache
2010-05-21 17:47:56 0 d-----w- c:\docume~1\eharri~1\applic~1\Simply Super Software
2010-05-21 17:39:03 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-05-21 17:39:03 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-05-21 17:39:03 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-05-21 17:39:03 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-05-21 17:39:03 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-05-21 17:39:02 0 d-----w- c:\program files\Trojan Remover
2010-05-21 17:39:02 0 d-----w- c:\docume~1\alluse~1\applic~1\Simply Super Software
2010-05-21 16:45:39 0 d-sha-r- C:\cmdcons
2010-05-21 16:43:57 77312 ----a-w- c:\windows\MBR.exe
2010-05-21 16:43:55 256512 ----a-w- c:\windows\PEV.exe
2010-05-21 16:43:55 161792 ----a-w- c:\windows\SWREG.exe
2010-05-21 16:43:54 98816 ----a-w- c:\windows\sed.exe
2010-05-21 16:38:15 3693488 ----a-r- C:\ComboFix.exe
2010-05-21 14:39:56 0 d-----w- C:\Avandia_2004
2010-05-21 14:39:51 0 d-----w- C:\HUMIRA_Philly
2010-05-18 21:13:57 0 d-----w- c:\docume~1\eharri~1\applic~1\webex
2010-05-07 17:00:19 0 d-----w- c:\program files\Veetle
2010-05-05 12:51:00 0 d-----w- C:\Young_Jeezy_Trap_Or_Die_2-2010

==================== Find3M ====================

2010-05-10 12:25:47 2516 --sha-w- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys
2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-13 05:55:56 68436 ----a-w- c:\windows\fonts\Parchment MF.ttf
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll
2010-02-25 15:54:36 11070976 ------w- c:\windows\system32\dllcache\ieframe.dll
2010-02-24 13:11:07 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-24 09:54:25 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe
2009-12-02 05:00:23 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat
2009-12-15 15:49:39 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009121520091216\index.dat

============= FINISH: 14:20:26.02 ===============

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE



Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

Thanks! The issue has not been resolved. Here is the DDS.txt - do you still need the GMER? I ran it for 2 hours and haven't changed anything yet since the attachment.


DDS (Ver_10-03-17.01) - NTFSx86
Run by eharrison at 2:49:32.22 on Sun 05/23/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3037.2387 [GMT -4:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SMINST\Scheduler.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Print Manager Plus - Client\CheckPages.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\AnalogX\Atomic TimeSync\ats.exe
C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\WINDOWS\system32\rdpclip.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.hp.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [Google Update] "c:\documents and settings\eharrison\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [PDF Complete] c:\program files\pdf complete\pdfsty.exe
mRun: [SetRefresh] c:\program files\compaq\setrefresh\SetRefresh.exe
mRun: [Recguard] c:\windows\sminst\Recguard.exe
mRun: [Reminder] c:\windows\creator\Remind_XP.exe
mRun: [Scheduler] c:\windows\sminst\Scheduler.exe
mRun: [RoxioDragToDisc] "c:\program files\roxio\drag-to-disc\DrgToDsc.exe"
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [PrintManagerPlusClient] "c:\program files\print manager plus - client\CheckPages.exe"
mRun: [TrojanScanner] c:\program files\trojan remover\Trjscan.exe /boot
StartupFolder: c:\docume~1\eharri~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\eharri~1\startm~1\programs\startup\atomic~1.lnk - c:\program files\analogx\atomic timesync\ats.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\deskto~1.lnk - c:\program files\research in motion\blackberry\DesktopMgr.exe
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260895295039
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
TCP: {26AF1ED1-1A05-419C-BDE5-5B60FC4BF08A} = 10.0.0.4
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\eharri~1\applic~1\mozilla\firefox\profiles\6zbajrrb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\documents and settings\eharrison\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-9-29 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-9-29 96408]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-9-29 735960]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\pdf complete\pdfsvc.exe [2009-12-2 635416]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2009-12-2 243856]

=============== Created Last 30 ================

2010-05-23 06:47:16 525824 ----a-w- C:\dds.scr
2010-05-21 20:50:42 118784 ----a-w- c:\windows\system32\chg.exe
2010-05-21 18:13:45 0 d-sh--w- c:\documents and settings\eharrison\IECompatCache
2010-05-21 17:47:56 0 d-----w- c:\docume~1\eharri~1\applic~1\Simply Super Software
2010-05-21 17:39:03 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-05-21 17:39:03 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-05-21 17:39:03 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-05-21 17:39:03 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-05-21 17:39:03 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-05-21 17:39:02 0 d-----w- c:\program files\Trojan Remover
2010-05-21 17:39:02 0 d-----w- c:\docume~1\alluse~1\applic~1\Simply Super Software
2010-05-21 16:45:39 0 d-sha-r- C:\cmdcons
2010-05-21 16:43:57 77312 ----a-w- c:\windows\MBR.exe
2010-05-21 16:43:55 256512 ----a-w- c:\windows\PEV.exe
2010-05-21 16:43:55 161792 ----a-w- c:\windows\SWREG.exe
2010-05-21 16:43:54 98816 ----a-w- c:\windows\sed.exe
2010-05-21 16:38:15 3693488 ----a-r- C:\ComboFix.exe
2010-05-21 14:39:56 0 d-----w- C:\Avandia_2004
2010-05-21 14:39:51 0 d-----w- C:\HUMIRA_Philly
2010-05-18 21:13:57 0 d-----w- c:\docume~1\eharri~1\applic~1\webex
2010-05-07 17:00:19 0 d-----w- c:\program files\Veetle
2010-05-05 12:51:00 0 d-----w- C:\Young_Jeezy_Trap_Or_Die_2-2010

==================== Find3M ====================

2010-05-10 12:25:47 2516 --sha-w- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys
2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-13 05:55:56 68436 ----a-w- c:\windows\fonts\Parchment MF.ttf
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll
2010-02-25 15:54:36 11070976 ------w- c:\windows\system32\dllcache\ieframe.dll
2010-02-24 13:11:07 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-24 09:54:25 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe
2009-12-02 05:00:23 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat
2009-12-15 15:49:39 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009121520091216\index.dat

============= FINISH: 2:49:39.57 ===============

Edited by elonepb, 23 May 2010 - 01:59 AM.

Hello, elonepb
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

If you do not make a reply in 5 days, we will have to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:

• Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
• If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
• Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
• Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
• Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
• Please set your system to show all files.
  Click Start, open My Computer, select the Tools menu and click Folder Options.
  Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
  Uncheck: Hide file extensions for known file types
  Uncheck the Hide protected operating system files (recommended) option.
  Click Yes to confirm.

Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to before saving it to your desktop.

Link 1
Link 2



--------------------------------------------------------------------

Double click on the renamed Combofix.exe & follow the prompts.

When finished, it will produce a report for you.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Thanks Schauber, here is the ComboFix.txt results:

ComboFix 10-05-22.03 - eharrison 05/23/2010 11:58:11.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3037.2561 [GMT -4:00]
Running from: C:\schrauber.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\feed.txt

c:\windows\system32\ws2_32.dll . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-04-23 to 2010-05-23 )))))))))))))))))))))))))))))))
.

2010-05-23 15:55 . 2010-05-23 15:56 3693870 ----a-r- C:\schrauber.exe
2010-05-23 07:00 . 2010-05-23 07:00 293376 ----a-w- C:\ww6s27yk.exe
2010-05-23 06:47 . 2010-05-23 06:59 525824 ----a-w- C:\dds.scr
2010-05-21 20:50 . 2010-05-23 15:38 118784 ----a-w- c:\windows\system32\chg.exe
2010-05-21 18:13 . 2010-05-21 18:13 -------- d-sh--w- c:\documents and settings\eharrison\IECompatCache
2010-05-21 18:01 . 2010-02-28 00:46 3691384 ----a-w- c:\documents and settings\eharrison\Application Data\Simply Super Software\Trojan Remover\cfw5A.exe
2010-05-21 17:47 . 2010-05-21 17:47 -------- d-----w- c:\documents and settings\eharrison\Application Data\Simply Super Software
2010-05-21 17:43 . 2010-05-21 18:01 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-21 17:43 . 2010-02-28 00:46 3691384 ----a-w- c:\documents and settings\Administrator\Application Data\Simply Super Software\Trojan Remover\yjmC333.exe
2010-05-21 17:39 . 2006-06-19 16:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-05-21 17:39 . 2006-05-25 18:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-05-21 17:39 . 2005-08-26 04:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-05-21 17:39 . 2003-02-02 23:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-05-21 17:39 . 2002-03-06 04:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-05-21 17:39 . 2010-05-21 17:39 -------- d-----w- c:\program files\Trojan Remover
2010-05-21 17:39 . 2010-05-21 17:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2010-05-21 17:39 . 2010-05-21 17:39 -------- d-----w- c:\documents and settings\Administrator\Application Data\Simply Super Software
2010-05-21 17:02 . 2010-05-21 17:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-05-21 16:38 . 2010-05-23 15:36 3693870 ----a-r- C:\ComboFix.exe
2010-05-21 15:50 . 2010-05-21 15:50 -------- d-----w- c:\documents and settings\eharrison\Local Settings\Application Data\ESET
2010-05-21 14:39 . 2010-05-21 14:42 -------- d-----w- C:\Avandia_2004
2010-05-21 14:39 . 2010-05-21 14:40 -------- d-----w- C:\HUMIRA_Philly
2010-05-18 21:13 . 2010-05-18 21:14 -------- d-----w- c:\documents and settings\eharrison\Application Data\webex
2010-05-07 17:00 . 2010-05-07 17:01 -------- d-----w- c:\program files\Veetle
2010-05-07 15:50 . 2010-05-07 15:50 666112 ----a-w- c:\documents and settings\eharrison\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\pmv306hw-1004220-0-main.dll
2010-05-07 15:50 . 2010-05-07 15:50 319488 ----a-w- c:\documents and settings\eharrison\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
2010-05-05 12:51 . 2010-05-06 20:52 -------- d-----w- C:\Young_Jeezy_Trap_Or_Die_2-2010

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-21 20:58 . 2009-12-15 15:10 256 ----a-w- c:\windows\system32\pool.bin
2010-05-21 20:52 . 2009-12-16 15:22 -------- d-----w- c:\documents and settings\eharrison\Application Data\uTorrent
2010-05-21 17:00 . 2009-12-16 14:22 -------- d-----w- c:\program files\Trillian
2010-05-21 16:03 . 2009-12-16 15:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-19 04:12 . 2009-12-02 05:05 -------- d-----w- c:\documents and settings\All Users\Application Data\PDFC
2010-05-10 12:25 . 2009-12-16 15:37 2516 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-05-10 12:25 . 2009-12-16 15:37 2516 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-05-10 11:57 . 2009-12-16 15:22 -------- d-----w- c:\program files\uTorrent
2010-05-07 17:26 . 2010-03-31 13:49 -------- d-----w- c:\program files\GoldWave
2010-05-06 14:48 . 2010-04-09 17:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk
2010-05-06 14:48 . 2010-04-09 17:10 -------- d-----w- c:\program files\backburner 2
2010-04-29 19:39 . 2009-12-16 15:18 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2009-12-16 15:18 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-19 18:21 . 2010-04-19 18:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion
2010-04-14 17:53 . 2010-04-14 17:53 -------- d-----w- c:\documents and settings\eharrison\Application Data\StreamTorrent
2010-04-14 17:53 . 2010-04-14 17:53 -------- d-----w- c:\program files\StreamTorrent 1.0
2010-04-12 18:57 . 2009-12-15 19:24 67928 ----a-w- c:\documents and settings\eharrison\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-01 12:55 . 2010-04-01 12:55 -------- d-----w- c:\documents and settings\eharrison\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1
2010-04-01 12:55 . 2010-04-01 12:55 -------- d-----w- c:\program files\twhirl
2010-04-01 12:55 . 2010-04-01 12:55 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-04-01 12:54 . 2010-04-01 12:55 38784 ----a-w- c:\documents and settings\eharrison\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-30 16:16 . 2010-03-30 16:16 26694 ----a-r- c:\documents and settings\eharrison\Application Data\Microsoft\Installer\{B866835D-EC31-4B05-851C-EBE73F2461FC}\BlackBerry.exe
2010-03-30 16:16 . 2009-12-15 15:09 -------- d-----w- c:\program files\Common Files\Research In Motion
2010-03-30 13:00 . 2010-03-30 13:00 -------- d-----w- c:\documents and settings\eharrison\Application Data\U3
2010-03-10 06:15 . 2008-04-14 09:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24 . 2008-04-14 09:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2008-04-14 09:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-05-18 21:12 . 2010-05-18 21:12 28488 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2010-05-18 21:12 . 2010-05-18 21:12 185240 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2010-05-18 21:13 . 2010-05-18 21:13 46408 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll
2010-05-18 21:13 . 2010-05-18 21:13 99224 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.

------- Sigcheck -------

[-] 2008-04-14 . 48FDBBE0E55B15E1886FCF5D8563B19F . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2008-04-14 . 5D567A625ECB5B4728130E4B31CA87EF . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-05-21_18.11.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-23 15:38 . 2010-05-23 15:38 16384 c:\windows\Temp\Perflib_Perfdata_758.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-05-05 321328]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"Google Update"="c:\documents and settings\eharrison\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-14 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2009-06-18 563736]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-21 525824]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2006-05-12 1138688]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-31 761856]
"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-07-10 872448]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-10-30 1116920]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2054360]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-27 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-27 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-27 142872]
"PrintManagerPlusClient"="c:\program files\Print Manager Plus - Client\CheckPages.exe" [2009-04-20 393216]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2010-02-28 1165192]

c:\documents and settings\eharrison\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Atomic TimeSync.lnk - c:\program files\AnalogX\Atomic TimeSync\ats.exe [2009-12-16 142832]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2010-3-10 1819992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-08-22 19:13 2363392 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-05-05 19:41 321328 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Print Manager Plus - Client\\CheckPages.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [9/29/2009 2:02 PM 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [9/29/2009 2:05 PM 96408]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9/29/2009 2:03 PM 735960]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [12/2/2009 1:05 AM 635416]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/18/2007 12:09 AM 11032]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [12/2/2009 1:49 AM 243856]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1/29/2010 5:40 PM 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-08-22 19:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2373030711-2729494683-1341707072-1113Core.job
- c:\documents and settings\eharrison\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-14 14:58]

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2373030711-2729494683-1341707072-1113UA.job
- c:\documents and settings\eharrison\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-14 14:58]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.hp.com/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {26AF1ED1-1A05-419C-BDE5-5B60FC4BF08A} = 10.0.0.4
FF - ProfilePath - c:\documents and settings\eharrison\Application Data\Mozilla\Firefox\Profiles\6zbajrrb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\documents and settings\eharrison\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
Completion time: 2010-05-23 12:00:22
ComboFix-quarantined-files.txt 2010-05-23 16:00
ComboFix2.txt 2010-05-23 15:46
ComboFix3.txt 2010-05-21 18:12

Pre-Run: 170,633,068,544 bytes free
Post-Run: 170,622,545,920 bytes free

- - End Of File - - DA6A0F9800BFAE3B3BC2075997ADAD6A

Oh and after running ComboFix (renamed), when I click on google search links Firefox is now crashing. So I'm not getting redirected right now, but it's making Firefox crash each time.

Hi,

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:



Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Hi Schrauber, did as you instructed and I haven't gotten any crashes or redirections. Here is the log from ComboFix:

ComboFix 10-05-24.03 - eharrison 05/24/2010 18:52:32.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3037.2462 [GMT -4:00]
Running from: C:\ComboFix.exe
Command switches used :: C:\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\feed.txt
c:\windows\system32\hlp.dat

c:\windows\system32\ws2_32.dll . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-04-24 to 2010-05-24 )))))))))))))))))))))))))))))))
.

2010-05-23 15:57 . 2010-05-23 16:00 -------- d-----w- C:\schrauber
2010-05-23 15:55 . 2010-05-23 15:56 3693870 ----a-r- C:\schrauber.exe
2010-05-23 07:00 . 2010-05-23 07:00 293376 ----a-w- C:\ww6s27yk.exe
2010-05-23 06:47 . 2010-05-23 06:59 525824 ----a-w- C:\dds.scr
2010-05-21 20:50 . 2010-05-24 22:55 118784 ----a-w- c:\windows\system32\chg.exe
2010-05-21 18:13 . 2010-05-21 18:13 -------- d-sh--w- c:\documents and settings\eharrison\IECompatCache
2010-05-21 18:01 . 2010-02-28 00:46 3691384 ----a-w- c:\documents and settings\eharrison\Application Data\Simply Super Software\Trojan Remover\cfw5A.exe
2010-05-21 17:47 . 2010-05-21 17:47 -------- d-----w- c:\documents and settings\eharrison\Application Data\Simply Super Software
2010-05-21 17:43 . 2010-05-21 18:01 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-21 17:43 . 2010-02-28 00:46 3691384 ----a-w- c:\documents and settings\Administrator\Application Data\Simply Super Software\Trojan Remover\yjmC333.exe
2010-05-21 17:39 . 2006-06-19 16:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-05-21 17:39 . 2006-05-25 18:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-05-21 17:39 . 2005-08-26 04:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-05-21 17:39 . 2003-02-02 23:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-05-21 17:39 . 2002-03-06 04:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-05-21 17:39 . 2010-05-21 17:39 -------- d-----w- c:\program files\Trojan Remover
2010-05-21 17:39 . 2010-05-21 17:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2010-05-21 17:39 . 2010-05-21 17:39 -------- d-----w- c:\documents and settings\Administrator\Application Data\Simply Super Software
2010-05-21 17:02 . 2010-05-21 17:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-05-21 16:38 . 2010-05-24 22:50 3696466 ----a-r- C:\ComboFix.exe
2010-05-21 15:50 . 2010-05-21 15:50 -------- d-----w- c:\documents and settings\eharrison\Local Settings\Application Data\ESET
2010-05-21 14:39 . 2010-05-21 14:42 -------- d-----w- C:\Avandia_2004
2010-05-21 14:39 . 2010-05-21 14:40 -------- d-----w- C:\HUMIRA_Philly
2010-05-18 21:13 . 2010-05-18 21:14 -------- d-----w- c:\documents and settings\eharrison\Application Data\webex
2010-05-07 17:00 . 2010-05-07 17:01 -------- d-----w- c:\program files\Veetle
2010-05-07 15:50 . 2010-05-07 15:50 666112 ----a-w- c:\documents and settings\eharrison\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\pmv306hw-1004220-0-main.dll
2010-05-07 15:50 . 2010-05-07 15:50 319488 ----a-w- c:\documents and settings\eharrison\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
2010-05-05 12:51 . 2010-05-06 20:52 -------- d-----w- C:\Young_Jeezy_Trap_Or_Die_2-2010

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-24 22:58 . 2009-12-15 15:10 256 ----a-w- c:\windows\system32\pool.bin
2010-05-24 22:58 . 2009-12-16 15:22 -------- d-----w- c:\documents and settings\eharrison\Application Data\uTorrent
2010-05-21 17:00 . 2009-12-16 14:22 -------- d-----w- c:\program files\Trillian
2010-05-21 16:03 . 2009-12-16 15:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-19 04:12 . 2009-12-02 05:05 -------- d-----w- c:\documents and settings\All Users\Application Data\PDFC
2010-05-10 12:25 . 2009-12-16 15:37 2516 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-05-10 12:25 . 2009-12-16 15:37 2516 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2010-05-10 11:57 . 2009-12-16 15:22 -------- d-----w- c:\program files\uTorrent
2010-05-07 17:26 . 2010-03-31 13:49 -------- d-----w- c:\program files\GoldWave
2010-05-06 14:48 . 2010-04-09 17:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Autodesk
2010-05-06 14:48 . 2010-04-09 17:10 -------- d-----w- c:\program files\backburner 2
2010-04-29 19:39 . 2009-12-16 15:18 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2009-12-16 15:18 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-19 18:21 . 2010-04-19 18:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion
2010-04-14 17:53 . 2010-04-14 17:53 -------- d-----w- c:\documents and settings\eharrison\Application Data\StreamTorrent
2010-04-14 17:53 . 2010-04-14 17:53 -------- d-----w- c:\program files\StreamTorrent 1.0
2010-04-12 18:57 . 2009-12-15 19:24 67928 ----a-w- c:\documents and settings\eharrison\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-01 12:55 . 2010-04-01 12:55 -------- d-----w- c:\documents and settings\eharrison\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1
2010-04-01 12:55 . 2010-04-01 12:55 -------- d-----w- c:\program files\twhirl
2010-04-01 12:55 . 2010-04-01 12:55 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-04-01 12:54 . 2010-04-01 12:55 38784 ----a-w- c:\documents and settings\eharrison\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-30 16:16 . 2010-03-30 16:16 26694 ----a-r- c:\documents and settings\eharrison\Application Data\Microsoft\Installer\{B866835D-EC31-4B05-851C-EBE73F2461FC}\BlackBerry.exe
2010-03-30 16:16 . 2009-12-15 15:09 -------- d-----w- c:\program files\Common Files\Research In Motion
2010-03-30 13:00 . 2010-03-30 13:00 -------- d-----w- c:\documents and settings\eharrison\Application Data\U3
2010-03-10 06:15 . 2008-04-14 09:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-02-25 06:24 . 2008-04-14 09:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2008-04-14 09:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-05-18 21:12 . 2010-05-18 21:12 28488 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2010-05-18 21:12 . 2010-05-18 21:12 185240 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2010-05-18 21:13 . 2010-05-18 21:13 46408 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll
2010-05-18 21:13 . 2010-05-18 21:13 99224 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
------- Sigcheck -------

[-] 2008-04-14 . 48FDBBE0E55B15E1886FCF5D8563B19F . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2008-04-14 . 5D567A625ECB5B4728130E4B31CA87EF . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-05-21_18.11.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-24 22:55 . 2010-05-24 22:55 16384 c:\windows\Temp\Perflib_Perfdata_76c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-05-05 321328]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"Google Update"="c:\documents and settings\eharrison\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-14 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2009-06-18 563736]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-21 525824]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2006-05-12 1138688]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-31 761856]
"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-07-10 872448]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-10-30 1116920]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-11 648536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2054360]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-27 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-27 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-27 142872]
"PrintManagerPlusClient"="c:\program files\Print Manager Plus - Client\CheckPages.exe" [2009-04-20 393216]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2010-02-28 1165192]

c:\documents and settings\eharrison\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Atomic TimeSync.lnk - c:\program files\AnalogX\Atomic TimeSync\ats.exe [2009-12-16 142832]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2010-3-10 1819992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-08-22 19:13 2363392 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-05-05 19:41 321328 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Print Manager Plus - Client\\CheckPages.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1/29/2010 5:40 PM 691696]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [9/29/2009 2:02 PM 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [9/29/2009 2:05 PM 96408]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9/29/2009 2:03 PM 735960]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [12/2/2009 1:05 AM 635416]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/18/2007 12:09 AM 11032]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [12/2/2009 1:49 AM 243856]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-08-22 19:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2373030711-2729494683-1341707072-1113Core.job
- c:\documents and settings\eharrison\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-14 14:58]

2010-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2373030711-2729494683-1341707072-1113UA.job
- c:\documents and settings\eharrison\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-14 14:58]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.hp.com/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {26AF1ED1-1A05-419C-BDE5-5B60FC4BF08A} = 10.0.0.4
FF - ProfilePath - c:\documents and settings\eharrison\Application Data\Mozilla\Firefox\Profiles\6zbajrrb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\documents and settings\eharrison\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-24 18:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\TEMP\HTTA.tmp
c:\windows\TEMP\HTTB.tmp
c:\windows\TEMP\NODC.tmp
c:\windows\TEMP\NODD.tmp

scan completed successfully
hidden files: 4

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys spcz.sys hal.dll >>UNKNOWN [0x8A4C1938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9e74cb8
\Driver\atapi -> atapi.sys @ 0xb9e09b40
\Driver\iaStor -> iaStor.sys @ 0xb9d6fed0
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Intel® 82567V-2 Gigabit Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xb9c10bb0
PacketIndicateHandler -> NDIS.sys @ 0xb9c1db21
SendHandler -> NDIS.sys @ 0xb9bfb87b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3800)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\windows\system32\CDRTC.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\rdpclip.exe
c:\program files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
c:\program files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
.
**************************************************************************
.
Completion time: 2010-05-24 19:00:30 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-24 23:00
ComboFix2.txt 2010-05-23 16:01
ComboFix3.txt 2010-05-23 15:46
ComboFix4.txt 2010-05-21 18:12

Pre-Run: 170,676,850,688 bytes free
Post-Run: 170,639,167,488 bytes free

- - End Of File - - 17EEC58EDA476DA6B37E27967C3A74CD

Hi,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  CODE
  :filefind
  user32*
  ws2_32*
  
  
• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Thanks schauber, I will post these as soon as possible

Here are the results of SystemLook:

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 03:45 on 27/05/2010 by eharrison (Administrator - Elevation successful)

========== filefind ==========

Searching for "user32*"
C:\i386\USER32.DL_ --a--- 264107 bytes [15:00 14/04/2008] [15:00 14/04/2008] 457B8FBB78708301D3928C06CEB96A27
C:\windows\system32\user32.dll --a--- 578560 bytes [09:00 14/04/2008] [09:00 14/04/2008] 48FDBBE0E55B15E1886FCF5D8563B19F

Searching for "ws2_32*"
C:\i386\WS2_32.DL_ --a--- 38853 bytes [15:00 14/04/2008] [15:00 14/04/2008] 7A1DD74A2FCBEAD3402CC14182BD7A01
C:\windows\system32\ws2_32.dll --a--- 82432 bytes [09:00 14/04/2008] [09:00 14/04/2008] 5D567A625ECB5B4728130E4B31CA87EF

-=End Of File=-

Hi,

Please copy and paste the content of the codebox below into notepad and save it as fix.bat to your windows folder, so you will have c:\windows\fix.bat.





You must first verify that you can logon to the Windows Recovery Console.
To do so, you must have the Recovery Console installed or use the Windows XP installation cd.

How to install and use the Windows XP Recovery Console


Restart the computer and logon to the Recovery Console.
Execute the following bolded command at the x:\windows> prompt <--- the red x represents your operating system drive letter, usually C

batch fix.bat

Your system should reboot, if not please reboot into normal mode. Please post back with a fresh Combofix logfile.

Thanks Schauber - I'm away on vacation but I'll do this as soon as I get back.

Ok