jbeckman

March 30, 2009

Will do, thanks you so very much!

Hi,
If you want to show your appreciation, then purchase MBAM, so you're extra protected. :-)
Glad I could help.
Please read my Prevention page with lots of info and tips how to prevent this in the future.
And if you want to improve speed/system performance after malware removal, take a look here.
Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.
Happy Surfing again!

March 30, 2009

miekiemoes,

I really appreciate your help all morning, I promised a case a beer to help resolve this issue. What is your Paypal and I will send you enough $ for a nice lunch/dinner!

March 30, 2009

I think that worked?

Malwarebytes' Anti-Malware 1.35

Database version: 1919

Windows 5.1.2600 Service Pack 3

3/30/2009 12:57:27 PM

mbam-log-2009-03-30 (12-57-27).txt

Scan type: Quick Scan

Objects scanned: 72894

Time elapsed: 3 minute(s), 28 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

March 30, 2009

File has been submitted, here is the new log:

ComboFix 09-03-29.04 - HP_Administrator 2009-03-30 12:34:24.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.569 [GMT -5:00]

Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated)

AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated)

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated)

* Created a new restore point

FILE ::

c:\windows\arevaxitig.dll

c:\windows\system32\drivers\aododhmo.sys

c:\windows\system32\REN94.tmp

c:\windows\system32\REN95.tmp

c:\windows\system32\REN96.tmp

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\arevaxitig.dll

c:\windows\Hvoxutuyezevu.dat

c:\windows\mshod32.dll

c:\windows\system32\REN94.tmp

c:\windows\system32\REN95.tmp

c:\windows\system32\REN96.tmp

c:\windows\Yzosego.bin

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_aododhmo

((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-30 )))))))))))))))))))))))))))))))

.

2009-03-30 12:17 . 2009-03-30 12:17 <DIR> d-------- c:\program files\Avira

2009-03-30 12:17 . 2009-03-30 12:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-03-30 12:17 . 2009-02-13 11:31 55,640 --a------ c:\windows\system32\drivers\avgntflt.sys

2009-03-27 11:15 . 2009-03-27 11:15 <DIR> d-------- c:\program files\Java

2009-03-27 11:15 . 2009-03-27 11:15 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-03-27 11:01 . 2009-03-27 11:01 <DIR> d-------- c:\documents and settings\HP_Administrator\Application Data\Winamp

2009-03-27 10:54 . 2009-03-27 10:54 <DIR> d-------- c:\program files\Common Files\xing shared

2009-03-27 08:14 . 2009-03-27 08:14 <DIR> d-------- c:\program files\Trend Micro

2009-03-26 17:41 . 2009-03-26 17:41 578,560 --a------ c:\windows\system32\dllcache\user32.dll

2009-03-26 17:39 . 2009-03-26 17:40 <DIR> d-------- c:\windows\ERUNT

2009-03-26 17:31 . 2009-03-26 17:54 <DIR> d-------- C:\SDFix

2009-03-25 12:13 . 2009-03-27 09:21 <DIR> d-------- c:\program files\Windows Live Safety Center

2009-03-23 14:05 . 2009-03-27 10:14 <DIR> d-------- c:\program files\Spyware Doctor

2009-03-23 14:05 . 2009-03-23 14:05 <DIR> d-------- c:\documents and settings\HP_Administrator\Application Data\PC Tools

2009-03-23 14:05 . 2009-03-30 08:59 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP

2009-03-23 14:05 . 2009-03-23 14:09 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys

2009-03-23 14:05 . 2009-03-23 14:09 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys

2009-03-23 14:05 . 2009-03-23 14:09 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys

2009-03-23 14:05 . 2008-06-02 15:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys

2009-03-18 13:18 . 2009-03-26 17:14 <DIR> d-------- c:\program files\SUPERAntiSpyware

2009-03-18 13:18 . 2009-03-18 13:18 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard

2009-03-18 13:18 . 2009-03-18 13:18 <DIR> d-------- c:\documents and settings\HP_Administrator\Application Data\SUPERAntiSpyware.com

2009-03-18 13:18 . 2009-03-18 13:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-03-18 13:17 . 2009-03-26 17:15 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-03-18 13:17 . 2009-03-18 13:17 <DIR> d-------- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes

2009-03-18 13:17 . 2009-03-18 13:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-03-18 13:17 . 2009-03-26 16:49 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-18 13:17 . 2009-03-26 16:49 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-03-09 15:31 . 2009-03-09 15:31 20,955 --a------ c:\windows\system32\AAWService_2009_03_09_15_31_21.dmp

2009-02-25 09:18 . 2009-01-09 14:19 1,089,593 --------- c:\windows\system32\dllcache\ntprint.cat

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-30 14:49 --------- d-----w c:\program files\Lavasoft

2009-03-27 18:12 --------- d-----w c:\program files\Mozilla Thunderbird

2009-03-27 16:41 --------- d-----w c:\program files\Rhapsody

2009-03-27 16:21 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\AdobeUM

2009-03-27 16:01 --------- d-----w c:\program files\Winamp

2009-03-27 15:54 --------- d-----w c:\program files\Common Files\Real

2009-03-26 12:39 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-03-24 20:37 --------- d-----w c:\program files\Full Tilt Poker

2009-03-24 13:59 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-03-24 13:29 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2009-03-02 21:12 --------- d-----w c:\documents and settings\HP_Administrator\Application Data\OpenOffice.org2

2009-01-29 17:30 --------- d-----w c:\program files\Reference Assemblies

2009-01-29 17:30 --------- d-----w c:\program files\MSBuild

2007-12-19 21:36 1,042 ------w c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat

2008-12-17 19:00 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008121720081218\index.dat

.

((((((((((((((((((((((((((((( SnapShot@2009-03-30_11.56.53.70 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-02-13 16:17:49 45,416 ----a-w c:\windows\system32\drivers\avgntdd.sys

+ 2009-02-13 16:29:11 22,360 ----a-w c:\windows\system32\drivers\avgntmgr.sys

+ 2009-02-13 19:22:54 95,576 ----a-w c:\windows\system32\drivers\avipbb.sys

- 2007-04-19 13:09:02 28,352 ----a-w c:\windows\system32\drivers\ssmdrv.sys

+ 2009-02-13 16:50:02 28,376 ----a-w c:\windows\system32\drivers\ssmdrv.sys

+ 2009-03-30 17:37:42 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_474.dat

+ 2007-11-07 07:19:20 54,272 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]

"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2007-08-30 205480]

"agpart"="c:\program files\Partners\AGPART11.EXE" [2002-02-12 60416]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-27 198160]

"UniPrint"="c:\program files\UniPrint\Client\SetDfltSettings.exe" [2006-08-23 155857]

"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-03-26 228088]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-27 148888]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"ftutil2"="ftutil2.dll" [2004-06-07 c:\windows\system32\ftutil2.dll]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-13 c:\windows\RTHDCPL.EXE]

"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 c:\windows\arpwrmsg.exe]

"nwiz"="nwiz.exe" [2006-05-09 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks 2001 Delivery Agent.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks 2001 Delivery Agent.lnk

backup=c:\windows\pss\QuickBooks 2001 Delivery Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

--a------ 2009-03-26 17:14 1830128 c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Partners\\DATCNECT\\DATCBUS.EXE"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Program Files\\Partners\\BUSBOY.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"12561:TCP"= 12561:TCP:BitComet 12561 TCP

"12561:UDP"= 12561:UDP:BitComet 12561 UDP

"22576:TCP"= 22576:TCP:BitComet 22576 TCP

"22576:UDP"= 22576:UDP:BitComet 22576 UDP

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-02-17 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-02-17 55024]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-03-30 108289]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]

S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-02-17 7408]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-03-23 356920]

.

Contents of the 'Scheduled Tasks' folder

2009-03-30 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []

.

------- Supplementary Scan -------

.

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PAVILION&pf=desktop

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PAVILION&pf=desktop

uInternet Connection Wizard,ShellNext = iexplore

IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\5b75z7ld.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-30 12:39:00

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\windows\arservice.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\wdfmgr.exe

c:\windows\ehome\mcrdsvc.exe

c:\program files\Partners\BUSBOY.EXE

c:\program files\Partners\BBPART11.EXE

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-03-30 12:43:13 - machine was rebooted

ComboFix-quarantined-files.txt 2009-03-30 17:43:10

ComboFix2.txt 2009-03-30 16:58:08

ComboFix3.txt 2009-03-26 13:46:15

Pre-Run: 156,911,443,968 bytes free

Post-Run: 156,936,630,272 bytes free

206 --- E O F --- 2009-03-26 12:40:36

March 30, 2009

Sorry!!

ComboFix 09-03-29.04 - HP_Administrator 2009-03-30 11:48:59.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.623 [GMT -5:00]

Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe

AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated)

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-30 )))))))))))))))))))))))))))))))

.

2009-03-27 11:15 . 2009-03-27 11:15 <DIR> d-------- c:\program files\Java

2009-03-27 11:15 . 2009-03-27 11:15 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-03-27 11:05 . 2009-03-27 11:05 0 --a------ c:\windows\system32\REN96.tmp

2009-03-27 11:05 . 2009-03-27 11:05 0 --a------ c:\windows\system32\REN95.tmp

2009-03-27 11:05 . 2009-03-27 11:05 0 --a------ c:\windows\system32\REN94.tmp