Infested Virus/Malware [V2]

(original thread)
http://www.bleepingcomputer.com/forums/topic383140.html

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by owner at 11:45:58.85 on 05/03/2011
Internet Explorer: 8.0.6001.19019
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3070.2005 [GMT -8:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\rundll32.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Razer\Diamondback 3G\razerhid.exe
C:\Windows\vVX3000.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Razer\Diamondback 3G\razertra.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Razer\Diamondback 3G\razerofa.exe
C:\Users\owner\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.ca/
uInternet Settings,ProxyServer = 62.129.245.186:8080
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: RuneScape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll
mURLSearchHooks: RuneScape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: RuneScape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: RuneScape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Diamondback] c:\program files\razer\diamondback 3g\razerhid.exe
mRun: [VX3000] c:\windows\vVX3000.exe
mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVG Anti-Rootkit;AVG Anti-Rootkit;c:\windows\system32\drivers\avgarkt.sys [2007-1-31 5632]
R1 AvgArCln;Avg Anti-Rootkit Clean Driver;c:\windows\system32\drivers\AvgArCln.sys [2011-3-4 3968]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-7-9 248936]
R3 Razerlow;Diamondback 3G USB Filter Driver;c:\windows\system32\drivers\DB3G.sys [2010-9-2 13225]
R3 xcbdaNtsc;ViXS Tuner Card (NTSC);c:\windows\system32\drivers\xcbda.sys [2007-9-7 156928]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2010-10-22 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-22 1493352]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 VST_DPV;VST_DPV;c:\windows\system32\drivers\VSTDPV3.SYS [2008-1-20 987648]
S3 VSTHWBS2;VSTHWBS2;c:\windows\system32\drivers\VSTBS23.SYS [2008-1-20 251904]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2011-03-05 00:04:01 -------- d-----w- c:\users\owner\appdata\roaming\SUPERAntiSpyware.com
2011-03-05 00:04:01 -------- d-----w- c:\progra~2\SUPERAntiSpyware.com
2011-03-05 00:03:48 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-03-04 23:42:23 3968 ----a-w- c:\windows\system32\drivers\AvgArCln.sys
2011-03-04 21:27:26 439632 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll
2011-03-04 21:27:26 439632 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{b1045142-f9e4-4972-a458-61a36e0f1ae5}\gapaengine.dll
2011-03-04 21:26:33 5943120 ------w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{8801c13b-855a-4f55-a3ed-ec5d6d5bd9de}\mpengine.dll
2011-03-04 21:09:52 -------- d-----w- c:\users\owner\appdata\local\{3BF35ABC-2187-4C22-A13B-71FDC427500B}
2011-03-04 21:02:04 -------- d-----w- c:\program files\Microsoft Security Client
2011-03-04 18:57:08 200704 --sha-r- c:\windows\system32\WMSPDMOEG.dll
2011-03-04 18:39:24 -------- d-----w- c:\program files\iPod
2011-03-04 18:39:20 -------- d-----w- c:\program files\iTunes
2011-03-04 18:35:11 -------- d-----w- c:\program files\Bonjour
2011-03-04 07:48:26 -------- d-----w- c:\users\owner\appdata\local\{D59CA89B-DEF4-432D-834F-7586FA0DF09C}
2011-03-03 19:48:15 -------- d-----w- c:\users\owner\appdata\local\{E12B7C0F-100D-428F-95EA-ECC9BCEE8A5E}
2011-03-03 06:59:51 -------- d-----w- c:\users\owner\appdata\local\{A6140378-70B1-42E9-B4A9-8CBB090FC871}
2011-03-02 18:59:30 -------- d-----w- c:\users\owner\appdata\local\{29B47CE7-98A7-4B10-B57F-D40FAFA6EB90}
2011-03-02 18:39:42 -------- d-----w- c:\users\owner\appdata\roaming\ParetoLogic
2011-03-02 18:39:42 -------- d-----w- c:\users\owner\appdata\roaming\DriverCure
2011-03-02 18:39:27 -------- d-----w- c:\progra~2\ParetoLogic
2011-03-02 06:59:07 -------- d-----w- c:\users\owner\appdata\local\{20B086E6-BC87-4E07-B08C-466CDE6FF2C3}
2011-03-01 18:58:33 -------- d-----w- c:\users\owner\appdata\local\{4D7D3452-F505-4B3E-A63D-0DBF32A642AD}
2011-03-01 05:57:55 -------- d-----w- c:\users\owner\appdata\local\{0BAFFCC2-37A1-4FD1-B8AD-27C7EAC2FD4D}
2011-02-28 17:57:31 -------- d-----w- c:\users\owner\appdata\local\{71F6C281-5464-4B50-B74B-2C6F7A4BD509}
2011-02-27 19:41:39 -------- d-----w- c:\users\owner\appdata\local\{3730D861-32FD-444A-B05C-52E4650330C4}
2011-02-27 07:41:17 -------- d-----w- c:\users\owner\appdata\local\{84687FB0-75DB-4D8B-B205-E4EEB8C0C56F}
2011-02-26 17:31:11 -------- d-----w- c:\users\owner\appdata\local\{7FC3D9C5-3E01-436D-9289-968BCB0E0DFF}
2011-02-26 05:31:00 -------- d-----w- c:\users\owner\appdata\local\{911D4169-AB1A-47CE-8946-C542D3B9BB84}
2011-02-25 17:30:46 -------- d-----w- c:\users\owner\appdata\local\{1BF32956-5427-4CE2-A5C6-FD113C297268}
2011-02-24 18:48:20 -------- d-----w- c:\users\owner\appdata\local\{8B1F611D-0BB6-42B6-A47A-3D377A365C4C}
2011-02-24 06:48:07 -------- d-----w- c:\users\owner\appdata\local\{B2F5CCDD-B424-4926-829F-B23A24D912CC}
2011-02-23 17:48:06 -------- d-----w- c:\users\owner\appdata\local\{EA98B9A6-FDD2-462B-A7FA-E821EE7478FA}
2011-02-22 22:57:06 -------- d-----w- c:\users\owner\appdata\local\{E6F2022B-9954-4728-8676-C5B36DBE0969}
2011-02-21 09:00:14 -------- d-----w- c:\users\owner\appdata\local\{8F0CB173-375B-4AC3-84FC-408530B7E96C}
2011-02-20 20:59:43 -------- d-----w- c:\users\owner\appdata\local\{5B175A33-F4F9-4347-9283-FE535102793A}
2011-02-20 07:32:08 -------- d-----w- c:\users\owner\appdata\local\{B396D0FF-6C3D-4E24-918D-E91A36A385D8}
2011-02-19 18:51:26 -------- d-----w- c:\users\owner\appdata\local\{014FAC97-84F8-40AE-B8B3-9390D2B76099}
2011-02-19 02:42:37 -------- d-----w- c:\users\owner\appdata\local\{621A6074-A8A4-4D66-A920-3ACBCD2D0598}
2011-02-18 03:16:53 -------- d-----w- c:\users\owner\appdata\local\{C564462E-7030-491F-AB00-D9ADA79BB160}
2011-02-17 15:16:31 -------- d-----w- c:\users\owner\appdata\local\{24F3AA49-BF3C-4215-A90E-BFDD04109CC4}
2011-02-16 22:55:41 -------- d-----w- c:\users\owner\appdata\local\{6804E629-4C72-4B76-A1B5-05D22B573A96}
2011-02-15 23:55:22 -------- d-----w- c:\users\owner\appdata\local\{825077B1-5325-4512-9210-C6CD183152A6}
2011-02-15 06:01:08 -------- d-----w- c:\users\owner\appdata\local\{05E2CCBF-B369-45E0-A50D-0B725EEF7FE4}
2011-02-14 16:29:01 -------- d-----w- c:\users\owner\appdata\local\{04F21484-68B1-45C6-A267-80A5C60E8009}
2011-02-13 22:15:01 -------- d-----w- c:\users\owner\appdata\local\{475E8748-4A1C-4BF6-BFC9-40CA4B0F3337}
2011-02-13 09:26:53 -------- d-----w- c:\users\owner\appdata\local\{FD161EA6-0A10-40FB-83B5-4FF28F2D78BB}
2011-02-12 19:20:26 -------- d-----w- c:\users\owner\appdata\local\{CA2E6F33-F293-4924-984E-FD757BE1799A}
2011-02-11 22:52:12 -------- d-----w- c:\users\owner\appdata\local\{B6340C5F-E20B-4C46-ADFD-8D13C8729E17}
2011-02-11 10:51:48 -------- d-----w- c:\users\owner\appdata\local\{F8EA49E1-7855-4E00-A92D-04317F1CE573}
2011-02-10 22:51:26 -------- d-----w- c:\users\owner\appdata\local\{BEB91F7E-1967-4601-833E-0DC424BD14FE}
2011-02-10 10:51:05 -------- d-----w- c:\users\owner\appdata\local\{845B3ECF-7F6A-40AA-B007-025C17FC70C4}
2011-02-09 23:18:28 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-02-09 23:18:28 292352 ----a-w- c:\windows\system32\atmfd.dll
2011-02-09 22:50:41 -------- d-----w- c:\users\owner\appdata\local\{2E795A3A-A952-4E15-9405-5F1EFCEEE3D4}
2011-02-09 00:46:40 -------- d-----w- c:\users\owner\appdata\local\{95E9FF7A-14FC-45E7-8829-E80437DB6DC0}
2011-02-09 00:38:18 -------- d-----w- c:\windows\en
2011-02-09 00:25:40 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2011-02-09 00:25:40 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2011-02-09 00:25:39 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2011-02-09 00:25:05 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2011-02-09 00:24:25 15712 ----a-w- c:\program files\common files\windows live\.cache\b4c87ba01cbc7ef03\MeshBetaRemover.exe
2011-02-05 01:16:11 -------- d-----w- c:\program files\Acer Inc
2011-02-05 01:14:50 199176 ----a-w- c:\windows\GVUni.exe
.
==================== Find3M ====================
.
2011-02-03 05:40:23 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-20 16:08:16 478720 ----a-w- c:\windows\system32\dxgi.dll
2011-01-20 16:08:06 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08:06 189952 ----a-w- c:\windows\system32\d3d10core.dll
2011-01-20 16:08:06 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2011-01-20 16:08:06 1029120 ----a-w- c:\windows\system32\d3d10.dll
2011-01-20 16:07:58 37376 ----a-w- c:\windows\system32\cdd.dll
2011-01-20 16:07:42 258048 ----a-w- c:\windows\system32\winspool.drv
2011-01-20 16:07:16 586240 ----a-w- c:\windows\system32\stobject.dll
2011-01-20 16:06:38 2873344 ----a-w- c:\windows\system32\mf.dll
2011-01-20 16:06:35 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04:54 98816 ----a-w- c:\windows\system32\mfps.dll
2011-01-20 16:04:54 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-01-20 14:28:38 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2011-01-20 14:27:50 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-20 14:26:30 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25:25 847360 ----a-w- c:\windows\system32\OpcServices.dll
2011-01-20 14:24:32 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-20 14:24:26 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15:10 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14:39 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14:03 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-01-20 14:14:03 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-01-20 14:12:46 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2011-01-20 14:11:34 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2011-01-20 13:47:51 683008 ----a-w- c:\windows\system32\d2d1.dll
2011-01-20 13:44:05 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-01-20 13:44:03 797184 ----a-w- c:\windows\system32\FntCache.dll
2010-12-31 13:57:01 2039808 ----a-w- c:\windows\system32\win32k.sys
2010-12-28 15:55:03 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-25 22:11:54 1409 ----a-w- c:\windows\system32\PGMUS.FOT
2010-12-25 22:11:54 1409 ----a-w- c:\windows\system32\pgjazz__.FOT
2010-12-18 06:27:04 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-18 06:22:41 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-18 06:22:27 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-18 06:22:11 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-12-18 06:22:11 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-12-18 05:25:26 385024 ----a-w- c:\windows\system32\html.iec
2010-12-18 04:48:39 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-12-18 04:47:11 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2010-12-14 14:49:23 1169408 ----a-w- c:\windows\system32\sdclt.exe
.
============= FINISH: 11:47:23.68 ===============


I tried to run a GMER scan at least 7 times, every time excluding one my computer would freeze during the scan and then black screen shortly after. The one time the scan actually finished my computer crashed while saving the log file. This is the only time my computer has ever frozen or crashed since I've had it. Sorry I could not provide the GMER log.

Well I managed to get a GMER scan to work, how ever I'll note that there is a lot less items that were displayed on the client window than there was the other time when my computer froze while saving the log. Anyways here is the log I managed to save. I hope this helps.

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-03-05 17:13:09
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000053 Hitachi_ rev.V54O
Running: gmer.exe; Driver: C:\Users\owner\AppData\Local\Temp\uwryrpow.sys


---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C7115537-04F8-9BCE-37C0-36935C918AE8}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C7115537-04F8-9BCE-37C0-36935C918AE8}@maahkllnlbipekpmjofiiknocf 0x6B 0x61 0x6A 0x6B ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{C7115537-04F8-9BCE-37C0-36935C918AE8}@nacfeobffgfifjcemjjamheckdld 0x6B 0x61 0x6A 0x6B ...
Reg HKCU\Software\Microsoft\Windows Live\Companion\heavy_metal.man@hotmail.com@bddeef4dae722d4d2a7d25d1d9c78ba4\r\n 0xAB 0x94 0x28 0xE7 ...
Reg HKCU\Software\Microsoft\Windows Live\Companion\heavy_metal.man@hotmail.com@a241760fe14b81dc807ec50d0dac489a\r\n 0x08 0x0E 0x69 0xD9 ...
Reg HKCU\Software\Microsoft\Windows Live\Companion\heavy_metal.man@hotmail.com@3490a684a8b230ec76b83ca02f090cc2\r\n 0xE2 0x6F 0x53 0x0C ...
Reg HKCU\Software\Microsoft\Windows Live\Companion\heavy_metal.man@hotmail.com@f6620a565d07597bd38af380af3518a2\r\n 0x6B 0xD7 0x98 0x2F ...

---- EOF - GMER 1.0.15 ----

Merged posts. ~ OB

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~-Additional information-~
-When trying to load Microsoft Security Essentials the program opens for a flash then closes.
-Microsoft Antimalware service is disabled, when turning service to automatic, and starting it flicks back to disabled.
-Google links are redirected, when clicked on a google link the word "google" in the url changes to "enhogionargt" for about one second then redirects to a random website, examples of websites I have been redirected to are...
'to join cityville on facebook'
'fake virus scan, that tells me I'm infected'
'dating sites'
-Any microsoft software that is used for antimalware or antivirus will close when trying to install or open it. (How ever I am able to run/open in safemode with networking)
-Originally random pop ups would appear even when no windows were opened. I have manually removed the infected files causing this to happen.

Edited by Overture_22, 06 March 2011 - 04:04 PM.

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
• These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
• Please do not PM me directly for help. If you have any questions, post them in this topic.
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Rootkit UnHooker (RkU)
Please download Rootkit Unhooker from one of the following links and save it to your desktop.
Link 1 (.exe file)
Link 2 (zipped file)
Link 3 (.rar file)In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

• Double-click on RKUnhookerLE.exe to start the program.
  Vista/Windows 7 users right-click and select Run As Administrator.
• Click the Report tab, then click Scan.
• Check Drivers, Stealth, and uncheck the rest.
• Click OK.
• Wait until it's finished and then go to File > Save Report.
• Save the report to your Desktop.
• Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".



NEXT:


Running aswMBR.exe

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it


Click the "Scan" button to start scan


On completion of the scan click save log, save it to your desktop and post in your next reply.


NEXT:




Running OTL

We need to create an OTL Report

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
• Save it to your desktop.
• Double click on the icon on your desktop.
• Click the "Scan All Users" checkbox.
• Push the button.
• Two reports will open, copy and paste them in a reply here:
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized

NEXT:


Please provide an update on how things are currently running in your next reply.

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.