Jump to content

Blank Popups and Registry Errors


deltaxi91
 Share

Recommended Posts

I'm hoping someone (anyone) can help me...

I picked up what appears to be a trojan somewhere that keeps reinstalling. The main issue is that a blank pop-up shows up (sometimes 8-9 of them) anytime I do a Google search. Additionally, items in the notification area of the taskbar (like volume control, battery/power options [laptop], etc.) keep disappearing upon restart.

I've run MBAM a number of times, it finds 10+ errors, and delete up to 4 on reboot, only to find them again the next time I run it (and problems keep occurring). I've downloaded Avira and run that, and it keeps finding the same items over and over again.

Below are pasted the MBAM and HiJackThis logs. I appreciate the help in advance (I've been tearing my hair out, and don't have much to spare)...

Malwarebytes' Anti-Malware 1.33

Database version: 1736

Windows 5.1.2600 Service Pack 3

2/9/2009 2:58:12 PM

mbam-log-2009-02-09 (14-58-12).txt

Scan type: Full Scan (C:\|)

Objects scanned: 137817

Time elapsed: 1 hour(s), 0 minute(s), 30 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 4

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 9

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\system32\egrjhp.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{3246caa9-ce54-41c6-8de6-238076dbcb8c} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\prunnet (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\egrjhp.dll (Trojan.Vundo) -> Delete on reboot.

C:\Documents and Settings\Kathy\Local Settings\Temp\winsinstall.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Documents and Settings\Kathy\Local Settings\Temporary Internet Files\Content.IE5\4E4814L5\winsinstall[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP129\A0038883.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\hulifeki.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\afmgrm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\beromavu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\tmp32.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kufubabe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:04:10 PM, on 2/9/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\PSIService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\NetWaiting\netWaiting.exe

C:\Program Files\Dell Support\DSAgnt.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Documents and Settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Apoint\HidFind.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5B35A255-E311-44C1-94FE-31A692069244} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {8c937016-8d47-469f-a676-b01d56734c18} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S

O4 - S-1-5-18 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'Default user')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Google Desktop Sidebar.lnk = C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://pms.caperesortsgroup.com

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL vqikuw.dll C:\WINDOWS\system32\ladakaku.dll eggrur.dll jmvuzt.dll jvrwpg.dll sbhnju.dll C:\WINDOWS\system32\suyetebo.dll egrjhp.dll C:\WINDOWS\system32\kipiheba.dll,

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 9502 bytes

Link to post
Share on other sites

Thanks so much for looking at this --

Malwarebytes' Anti-Malware 1.33

Database version: 1747

Windows 5.1.2600 Service Pack 3

2/10/2009 9:53:27 PM

mbam-log-2009-02-10 (21-53-22).txt

Scan type: Quick Scan

Objects scanned: 68086

Time elapsed: 11 minute(s), 34 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Link to post
Share on other sites

Your log shows that you took no action. Make sure you follow these scan instructions:

Open mbam:

On the Scanner tab, make sure the "Perform Quick Scan" option is selected. Then click on the Scan button.

  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process.

Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Link to post
Share on other sites

Sorry - I posted the wrong log - I copied the log that came up before I selected remove all - here is the archived log (Thanks again):

Malwarebytes' Anti-Malware 1.33

Database version: 1747

Windows 5.1.2600 Service Pack 3

2/10/2009 9:53:31 PM

mbam-log-2009-02-10 (21-53-31).txt

Scan type: Quick Scan

Objects scanned: 68086

Time elapsed: 11 minute(s), 34 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items )

Link to post
Share on other sites

It seems that MS Juan and MS Track System, keep reappearing, even after mbam quarantines and deletes and I still get the full-screen blank pop-ups if I do a google search...

Newest HijackThis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:48:00 PM, on 2/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\PSIService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\Pen_Tablet.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\NetWaiting\netWaiting.exe

C:\Program Files\Dell Support\DSAgnt.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Documents and Settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Apoint\HidFind.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5B35A255-E311-44C1-94FE-31A692069244} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {8c937016-8d47-469f-a676-b01d56734c18} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S

O4 - S-1-5-18 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'Default user')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Google Desktop Sidebar.lnk = C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://pms.caperesortsgroup.com

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL vqikuw.dll C:\WINDOWS\system32\ladakaku.dll eggrur.dll jmvuzt.dll jvrwpg.dll sbhnju.dll C:\WINDOWS\system32\suyetebo.dll egrjhp.dll C:\WINDOWS\system32\kipiheba.dll,

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 9504 bytes

Link to post
Share on other sites

Please download combofix from This Webpage...and read through the instructions there for running the tool.

***Important Note***

Please read through the guidance on that web page carefully and thoroughly...and install the Recovery Console. Using this tool without the Recovery Console installed is NOT RECOMMENDED.

If you have Windows Vista, you can skip the recovery console step...in Vista it's in the System Recovery Options menu. The System Recovery Options menu is on the Windows Vista installation disc. If Windows doesn't start correctly, you can use these tools to repair startup problems.

The Windows Recovery Console will allow you to boot into a special recovery (repair) mode that is not otherwise available. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It's a simple procedure that will only take a few moments.

Once installed, a blue screen prompt should appear that reads as follows:

The Recovery Console was successfully installed.

When you see that screen, please continue as follows:

  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please post back the following on your next reply:

C:\ComboFix.txt

New HijackThis log.

Link to post
Share on other sites

Combofix.txt followed by HiJackThis log:

ComboFix 09-02-10.01 - Kathy 2009-02-10 23:25:38.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1294 [GMT -5:00]

Running from: c:\documents and settings\Kathy\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Kathy\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\Kathy\Local Settings\Temporary Internet Files\fbk.sts

c:\windows\system32\buzalevu.dll

c:\windows\system32\eggrur.dll

c:\windows\system32\jawbvn.dll

c:\windows\system32\jmvuzt.dll

c:\windows\system32\judobida.dll.tmp

c:\windows\system32\jvrwpg.dll

c:\windows\system32\kumiberu.dll

c:\windows\system32\lazimiki.dll.tmp

c:\windows\system32\liwomajo.dll.tmp

c:\windows\system32\maboveli.dll

c:\windows\system32\naluwota.dll

c:\windows\system32\pusekudu.dll.tmp

c:\windows\system32\rinokulo.dll

c:\windows\system32\sbhnju.dll

c:\windows\system32\tizuluke.dll

c:\windows\system32\vpbiuo.dll

c:\windows\system32\yuwefayi.dll

c:\windows\system32\zugovela.dll

c:\windows\Tasks\kianjwre.job

----- BITS: Possible infected sites -----

hxxp://77.74.48.105

.

((((((((((((((((((((((((( Files Created from 2009-01-11 to 2009-02-11 )))))))))))))))))))))))))))))))

.

2009-02-09 18:24 . 2009-02-09 18:24 <DIR> d-------- c:\documents and settings\Kathy\Application Data\True Sword

2009-02-09 18:20 . 2009-02-09 18:31 <DIR> d-------- c:\program files\True Sword 5

2009-02-09 18:20 . 2005-10-11 14:40 356,352 --a------ c:\windows\eSellerateEngine.dll

2009-02-09 18:20 . 2003-06-06 11:21 81,920 --a------ c:\windows\eSellerateControl350.dll

2009-02-08 22:36 . 2009-02-08 22:36 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Moyea

2009-02-08 22:35 . 2009-02-08 22:35 <DIR> d-------- c:\program files\Moyea

2009-02-08 00:01 . 2009-02-08 00:01 127 --a------ c:\windows\system32\MRT.INI

2009-02-07 15:55 . 2009-02-10 21:31 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Move Networks

2009-02-07 12:32 . 2009-02-07 12:32 <DIR> d-------- c:\program files\iTunes

2009-02-07 12:32 . 2009-02-07 12:32 <DIR> d-------- c:\program files\iPod

2009-02-07 12:32 . 2009-02-07 12:32 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2009-02-05 22:59 . 2009-02-05 22:59 <DIR> d-------- c:\program files\Avira

2009-02-05 22:59 . 2009-02-05 22:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-02-01 23:44 . 2009-02-07 12:30 <DIR> d-------- c:\program files\QuickTime

2009-02-01 23:43 . 2009-02-01 23:43 <DIR> d-------- c:\program files\Bonjour

2009-02-01 23:42 . 2009-02-01 23:42 <DIR> d-------- c:\windows\system32\en

2009-02-01 23:42 . 2009-02-01 23:42 <DIR> d-------- c:\windows\system32\bits

2009-02-01 22:41 . 2009-02-01 23:26 <DIR> d-------- C:\e5005ea4a9fa079e4193acc4c64e

2009-02-01 22:39 . 2009-02-01 23:26 <DIR> d-------- C:\7e02c1b6601580e10fc061c9a31b14

2009-02-01 22:23 . 2009-02-01 22:23 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Uniblue

2009-02-01 22:22 . 2009-02-01 23:44 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\~0

2009-01-16 22:16 . 2009-01-16 22:16 574,989 --a------ c:\documents and settings\cam mask 1.png

2009-01-12 22:14 . 2009-01-12 22:14 <DIR> d-------- c:\documents and settings\Allison\Application Data\Malwarebytes

2009-01-11 22:53 . 2009-01-11 22:53 <DIR> d-------- c:\documents and settings\Kathy\PrivacIE

2009-01-11 19:49 . 2009-02-01 23:31 <DIR> d----c--- c:\windows\ie8

2009-01-11 19:46 . 2009-02-01 23:43 <DIR> d-------- c:\program files\Bonjour(2)

2009-01-11 19:43 . 2009-02-01 23:44 <DIR> d-------- c:\program files\iTunes(2)

2009-01-11 19:43 . 2009-02-01 23:44 <DIR> d-------- c:\program files\iPod(2)

2009-01-11 19:36 . 2009-02-01 23:44 <DIR> d-------- c:\program files\QuickTime(2)

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-11 04:28 --------- d-----w c:\documents and settings\Kathy\Application Data\WTablet

2009-02-10 22:29 --------- d-----w c:\documents and settings\Kathy\Application Data\gtk-2.0

2009-02-10 17:13 --------- d-----w c:\documents and settings\LocalService\Application Data\WTablet

2009-02-07 17:32 --------- d-----w c:\program files\Common Files\Apple

2009-02-07 00:51 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-07 00:02 --------- d-----w c:\program files\Inkscape

2009-01-31 15:28 --------- d-----w c:\program files\Common Files\InstallShield

2009-01-14 21:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-14 21:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-01-13 03:26 240 ----a-w c:\program files\eknw.txt

2008-12-23 05:38 --------- d-----w c:\program files\Java

2008-12-17 03:30 --------- d-----w c:\documents and settings\Kathy\Application Data\Malwarebytes

2008-12-17 03:30 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2008-12-17 03:15 --------- d-----w c:\program files\Trend Micro

2008-12-17 01:13 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2008-12-17 01:12 --------- d-----w c:\program files\Lavasoft

2008-12-17 01:11 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2008-12-16 23:41 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2008-12-16 21:28 --------- d-----w c:\program files\Spybot - Search & Destroy

2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys

2008-11-26 05:09 160,263 ----a-w c:\windows\Sqirlz Morph Uninstaller.exe

2008-09-03 02:52 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

2008-09-23 04:05 2,048 --sha-w c:\windows\system32\gajulebi.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]

"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-28 395776]

"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-03 68856]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

"Google Update"="c:\documents and settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-06 176128]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

c:\documents and settings\Kathy\Start Menu\Programs\Startup\

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-07-27 24576]

Google Desktop Sidebar.lnk - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-27 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\WINDOWS\\system32\\Pen_Tablet.exe"=

"c:\\Documents and Settings\\Kathy\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=

"c:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-10-20 1373480]

S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2007-09-26 16512]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-27 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - E:\LaunchU3.exe -a

.

Contents of the 'Scheduled Tasks' folder

2009-02-06 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4086014027-354043883-2978333643-1006.job

- c:\documents and settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 20:10]

.

- - - - ORPHANS REMOVED - - - -

BHO-{5B35A255-E311-44C1-94FE-31A692069244} - (no file)

BHO-{8c937016-8d47-469f-a676-b01d56734c18} - (no file)

HKCU-Run-Uniblue RegistryBooster 2009 - c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe

.

------- Supplementary Scan -------

.

uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk-rel/en/side.html?channel=us

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

Trusted Zone: caperesortsgroup.com\pms

FF - ProfilePath - c:\documents and settings\Kathy\Application Data\Mozilla\Firefox\Profiles\9vvprjyh.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://espn.go.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=

FF - component: c:\documents and settings\Kathy\Application Data\Mozilla\Firefox\Profiles\9vvprjyh.default\extensions\ubiquity@labs.mozilla.com\platform\WINNT_x86-msvc\components\ubiquity.dll

FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\documents and settings\Kathy\Application Data\Mozilla\Firefox\Profiles\9vvprjyh.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll

FF - plugin: c:\documents and settings\Kathy\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-10 23:29:43

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,29,01,11,d9,a3,

9f,57,cc,c8,28,51,af,b0,29,a3,98,c5,75,86,22,a6,ce,8e,89,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"bca643cdc5c2726b20d2ecedcc62c59b"=hex:46,47,15,b0,92,4b,c7,ef,08,e1,b8,27,cf,

ca,55,d2,71,3b,04,66,8b,46,0d,96,5a,db,a2,ae,60,3a,0f,93,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,ff,c3,ea,b8,6d,

64,23,cd,25,da,ec,7e,55,20,c9,26,9c,ea,7b,01,73,ac,cb,ba,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,d1,32,74,52,ad,

bb,43,7f,3e,1e,9e,e0,57,5a,93,61,8c,07,17,8c,b6,e9,61,7c,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,31,63,9a,6d,25,

06,c1,43,cd,44,cd,b9,a6,33,6c,cd,7a,38,f8,3f,a3,93,1b,ea,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,ce,82,c3,66,cb,

2a,4f,67,b0,18,ed,a7,3f,8d,37,a4,57,70,69,9c,a4,3b,3c,24,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,3f,54,ce,c2,d4,

36,02,24,31,77,e1,ba,b1,f8,68,02,c3,59,b1,e6,3f,bd,1e,82,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,ae,23,ab,8a,cb,

42,70,3c,83,6c,56,8b,a0,85,96,ab,ef,7c,a5,9f,75,35,c6,40,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,c0,7a,e8,22,eb,

e8,59,cb,51,fa,6e,91,28,9e,14,cc,7c,5b,4f,7d,ec,bb,39,0e,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,03,41,5c,8e,9e,

d0,bc,be,b1,cd,45,5a,a8,c4,f8,b9,81,99,be,37,b4,dc,b0,28,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,db,7e,bb,91,5e,

13,3d,d5,e3,0e,66,d5,eb,bc,2f,6b,36,61,d4,b7,11,7c,0e,91,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,6a,65,54,3d,b9,

70,22,b6,fa,ea,66,7f,d4,3b,6b,70,6f,fb,06,67,07,ce,cc,7d,6c,43,2d,1e,aa,22,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(864)

c:\windows\System32\BCMLogon.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\WLTRYSVC.EXE

c:\windows\system32\BCMWLTRY.EXE

c:\program files\Lavasoft\Ad-Aware\aawservice.exe

c:\program files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\PSIService.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\WTablet\Pen_TabletUser.exe

c:\program files\Apoint\hidfind.exe

c:\program files\Apoint\ApntEx.exe

c:\program files\OpenOffice.org 3\program\soffice.exe

c:\program files\OpenOffice.org 3\program\soffice.bin

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-02-10 23:33:47 - machine was rebooted [Kathy]

ComboFix-quarantined-files.txt 2009-02-11 04:33:44

Pre-Run: 43,780,247,552 bytes free

Post-Run: 44,211,355,648 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

284 --- E O F --- 2009-02-08 05:17:23

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:34:25 PM, on 2/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\PSIService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\NetWaiting\netWaiting.exe

C:\Program Files\Dell Support\DSAgnt.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Apoint\HidFind.exe

C:\Documents and Settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - S-1-5-18 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'Default user')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Google Desktop Sidebar.lnk = C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://pms.caperesortsgroup.com

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 8635 bytes

Link to post
Share on other sites

Your Java application is out of date and causes a slight security risk as a result.

Please follow these steps to remove older version Java components:

  • Close any open programs you may have running, especially your web browser.
  • Click Start-->Control Panel-->Add or Remove Programs.
  • Click once on any item having Java Runtime Environment in it's name then click the "Remove" button.

Not every version of Java will begin with "Java" so be sure to read each entry in the list.

Repeat the third step above as many times as necessary to remove all versions of Java.

***NOTE***

If you are asked to reboot at any point during the uninstallations, please do so. Then go back to Add/Remove and continue with the rest of the removals...when finished uninstalling all of them, reboot the computer.

  • Navigate to and delete: C:\Program Files\Java<--the Java folder indicated in Bold Red Text (if found)
  • Then go to this page. Scroll down to the first download link, "Java SE Runtime Environment (JRE) 6 Update 12" and click the "Download" button to the right. Select the platform for "Windows".
  • Check the box that says: "I agree to the Java SE Runtime Environment # License Agreement", then click Continue...The page will refresh

Then, click on the link to download Windows Offline Installation. Save it to your desktop.

Now, from your desktop, double-click on the executable to install the newest version.

We need to disable Tea Timer so it won't interfere with our removal efforts:

1) Run Spybot-S&D

2) Go to the Mode menu, and make sure "Advanced Mode" is selected

3) On the left hand side, choose Tools -> Resident

4) Uncheck "Resident TeaTimer" and OK any prompts

5) Restart your computer.

Please open a blank Notepad by clicking start-->run

Then, in the run box type Notepad.exe and click "OK".

Copy the below text in Bold and paste it into the blank Notepad. Save it as CFScript.txt...Change the "Save as type" to All Files and save it to your desktop. Now drag the text document over to your Combofix.exe

Combofix will run again automatically. Please post back the new log that will be generated. Thanks!

KILLALL::

File::

E:\LaunchU3.exe

FileLook::

c:\program files\eknw.txt

Folder::

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

c:\documents and settings\All Users\Application Data\~0

REGNULL::

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

Link to post
Share on other sites

Here's the new combofix:

ComboFix 09-02-11.02 - Kathy 2009-02-11 19:20:50.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1535 [GMT -5:00]

Running from: c:\documents and settings\Kathy\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Kathy\Desktop\cfscript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

* Created a new restore point

FILE ::

E:\LaunchU3.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\DIFxAPI.dll

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\DifXInstall32.exe

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\GEARAspiWDM.inf

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\gearaspiwdmx86.cat

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86\GEARAspi.dll

c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86\GEARAspiWDM.sys

c:\documents and settings\All Users\Application Data\~0

c:\documents and settings\All Users\Application Data\~0\mia.lib

c:\documents and settings\All Users\Application Data\~0\Uniblue RegistryBooster.exe

.

((((((((((((((((((((((((( Files Created from 2009-01-12 to 2009-02-12 )))))))))))))))))))))))))))))))

.

2009-02-11 18:50 . 2009-02-11 18:49 410,984 --a------ c:\windows\system32\deploytk.dll

2009-02-11 18:41 . 2009-02-11 18:49 <DIR> d-------- c:\documents and settings\Kathy\.SunDownloadManager

2009-02-09 18:24 . 2009-02-09 18:24 <DIR> d-------- c:\documents and settings\Kathy\Application Data\True Sword

2009-02-09 18:20 . 2009-02-09 18:31 <DIR> d-------- c:\program files\True Sword 5

2009-02-09 18:20 . 2005-10-11 14:40 356,352 --a------ c:\windows\eSellerateEngine.dll

2009-02-09 18:20 . 2003-06-06 11:21 81,920 --a------ c:\windows\eSellerateControl350.dll

2009-02-08 22:36 . 2009-02-08 22:36 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Moyea

2009-02-08 22:35 . 2009-02-08 22:35 <DIR> d-------- c:\program files\Moyea

2009-02-08 00:01 . 2009-02-08 00:01 127 --a------ c:\windows\system32\MRT.INI

2009-02-07 15:55 . 2009-02-10 21:31 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Move Networks

2009-02-07 12:32 . 2009-02-07 12:32 <DIR> d-------- c:\program files\iTunes

2009-02-07 12:32 . 2009-02-07 12:32 <DIR> d-------- c:\program files\iPod

2009-02-05 22:59 . 2009-02-05 22:59 <DIR> d-------- c:\program files\Avira

2009-02-05 22:59 . 2009-02-05 22:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-02-01 23:44 . 2009-02-07 12:30 <DIR> d-------- c:\program files\QuickTime

2009-02-01 23:43 . 2009-02-01 23:43 <DIR> d-------- c:\program files\Bonjour

2009-02-01 23:42 . 2009-02-01 23:42 <DIR> d-------- c:\windows\system32\en

2009-02-01 23:42 . 2009-02-01 23:42 <DIR> d-------- c:\windows\system32\bits

2009-02-01 22:41 . 2009-02-01 23:26 <DIR> d-------- C:\e5005ea4a9fa079e4193acc4c64e

2009-02-01 22:39 . 2009-02-01 23:26 <DIR> d-------- C:\7e02c1b6601580e10fc061c9a31b14

2009-02-01 22:23 . 2009-02-01 22:23 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Uniblue

2009-01-16 22:16 . 2009-01-16 22:16 574,989 --a------ c:\documents and settings\cam mask 1.png

2009-01-12 22:14 . 2009-01-12 22:14 <DIR> d-------- c:\documents and settings\Allison\Application Data\Malwarebytes

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-12 00:25 --------- d-----w c:\documents and settings\Kathy\Application Data\WTablet

2009-02-12 00:24 --------- d-----w c:\documents and settings\LocalService\Application Data\WTablet

2009-02-11 23:34 --------- d-----w c:\program files\Java

2009-02-10 22:29 --------- d-----w c:\documents and settings\Kathy\Application Data\gtk-2.0

2009-02-07 17:32 --------- d-----w c:\program files\Common Files\Apple

2009-02-07 00:51 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-07 00:02 --------- d-----w c:\program files\Inkscape

2009-02-02 04:44 --------- d-----w c:\program files\QuickTime(2)

2009-02-02 04:44 --------- d-----w c:\program files\iTunes(2)

2009-02-02 04:44 --------- d-----w c:\program files\iPod(2)

2009-02-02 04:43 --------- d-----w c:\program files\Bonjour(2)

2009-01-31 15:28 --------- d-----w c:\program files\Common Files\InstallShield

2009-01-14 21:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-14 21:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-01-13 03:26 240 ----a-w c:\program files\eknw.txt

2008-12-17 03:30 --------- d-----w c:\documents and settings\Kathy\Application Data\Malwarebytes

2008-12-17 03:30 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2008-12-17 03:15 --------- d-----w c:\program files\Trend Micro

2008-12-17 01:13 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2008-12-17 01:12 --------- d-----w c:\program files\Lavasoft

2008-12-17 01:11 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2008-12-16 23:41 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2008-12-16 21:28 --------- d-----w c:\program files\Spybot - Search & Destroy

2008-11-26 05:09 160,263 ----a-w c:\windows\Sqirlz Morph Uninstaller.exe

2008-09-03 02:52 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

2008-09-23 04:05 2,048 --sha-w c:\windows\system32\gajulebi.dll

.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\eknw.txt -- Not a PE file.

MD5: 2579f086c44c16f1bf986cbd17243351

((((((((((((((((((((((((((((( SnapShot@2009-02-10_23.32.25.53 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-06-10 05:21:01 135,168 ----a-w c:\windows\system32\java.exe

+ 2009-02-11 23:49:45 144,792 ----a-w c:\windows\system32\java.exe

- 2008-06-10 05:21:04 135,168 ----a-w c:\windows\system32\javaw.exe

+ 2009-02-11 23:49:45 144,792 ----a-w c:\windows\system32\javaw.exe

- 2008-06-10 06:32:34 139,264 ----a-w c:\windows\system32\javaws.exe

+ 2009-02-11 23:49:45 148,888 ----a-w c:\windows\system32\javaws.exe

+ 2009-02-12 00:24:47 16,384 ----atw c:\windows\temp\Perflib_Perfdata_7ec.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]

"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-28 395776]

"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-03 68856]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

"Google Update"="c:\documents and settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-06 176128]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-11 148888]

c:\documents and settings\Kathy\Start Menu\Programs\Startup\

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-07-27 24576]

Google Desktop Sidebar.lnk - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-27 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\WINDOWS\\system32\\Pen_Tablet.exe"=

"c:\\Documents and Settings\\Kathy\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=

"c:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-10-20 1373480]

S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2007-09-26 16512]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-27 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08

.

Contents of the 'Scheduled Tasks' folder

2009-02-06 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4086014027-354043883-2978333643-1006.job

- c:\documents and settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 20:10]

.

- - - - ORPHANS REMOVED - - - -

BHO-{5B35A255-E311-44C1-94FE-31A692069244} - (no file)

BHO-{8c937016-8d47-469f-a676-b01d56734c18} - (no file)

.

------- Supplementary Scan -------

.

uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

Trusted Zone: caperesortsgroup.com\pms

FF - ProfilePath - c:\documents and settings\Kathy\Application Data\Mozilla\Firefox\Profiles\9vvprjyh.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://espn.go.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=

FF - component: c:\documents and settings\Kathy\Application Data\Mozilla\Firefox\Profiles\9vvprjyh.default\extensions\ubiquity@labs.mozilla.com\platform\WINNT_x86-msvc\components\ubiquity.dll

FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\documents and settings\Kathy\Application Data\Mozilla\Firefox\Profiles\9vvprjyh.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll

FF - plugin: c:\documents and settings\Kathy\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-11 19:26:22

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(876)

c:\windows\System32\BCMLogon.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\WLTRYSVC.EXE

c:\windows\system32\BCMWLTRY.EXE

c:\program files\Lavasoft\Ad-Aware\aawservice.exe

c:\program files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\PSIService.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\WTablet\Pen_TabletUser.exe

c:\program files\Apoint\hidfind.exe

c:\program files\Apoint\ApntEx.exe

c:\program files\OpenOffice.org 3\program\soffice.exe

c:\program files\OpenOffice.org 3\program\soffice.bin

c:\windows\system32\wscntfy.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2009-02-11 19:30:41 - machine was rebooted [Kathy]

ComboFix-quarantined-files.txt 2009-02-12 00:30:38

ComboFix2.txt 2009-02-11 04:33:48

Pre-Run: 44,123,095,040 bytes free

Post-Run: 44,106,047,488 bytes free

213 --- E O F --- 2009-02-08 05:17:23

Link to post
Share on other sites

Please take a look at each of these folders:

c:\program files\QuickTime(2)

c:\program files\iTunes(2)

c:\program files\iPod(2)

c:\program files\Bonjour(2)

...the number "(2)" which follows each folder indicates that there is another folder in the same location with the same name. In other words, your windows explorer program file tree might look something like this:

Bonjour

Bonjour(2)

iPod

iPod(2)

iTunes

iTunes(2)

QuickTime

QuickTime(2)

...the original installation should not have the number (2) beside it. The folders with the number (2) indicate a duplicate. When you post back, tell me what you find in those folders.

Please open a blank Notepad by clicking start-->run

Then, in the run box type Notepad.exe and click "OK".

Copy the below text in Bold and paste it into the blank Notepad. Save it as CFScript.txt...Change the "Save as type" to All Files and save it to your desktop. Now drag the text document over to your Combofix.exe

Combofix will run again automatically. Please post back the new log that will be generated. Thanks!

KILLALL::

File::

c:\program files\eknw.txt

Rootkit::

c:\windows\system32\gajulebi.dll

Link to post
Share on other sites

Your description of folder contents for those does not seem to me to be a completed installation. Here's what I'd like you to do...

For each folder having the (2) beside it, copy it's contents and then open it's corresponding program folder (that is, the other folder with the same name without the number (2) beside it)...then right click anywhere inside that folder and select "Paste". Windows will alert you if any of the files that you are transferring are duplicates and ask you if you want to replace the existing file. Compare the dates and sizes of the files that windows tells you that already exist. If the existing file is newer (and probably larger) than the file you are transferring, then allow windows to transfer those to that folder.

Continue in this manner until you've checked each duplicate folder. Then you can return to the folders you copied from (that is, those with the number (2) beside them) and delete each one. Let me know if you have any trouble with this instruction. Thanks!

Link to post
Share on other sites

Combined files and deleted the empty (2) folders... no problem. Here's the Combofix log:

ComboFix 09-02-12.03 - Kathy 2009-02-14 10:35:32.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1526 [GMT -5:00]

Running from: c:\documents and settings\Kathy\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Kathy\Desktop\cfscript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

* Created a new restore point

FILE ::

c:\program files\eknw.txt

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\eknw.txt

c:\windows\system32\gajulebi.dll

.

((((((((((((((((((((((((( Files Created from 2009-01-14 to 2009-02-14 )))))))))))))))))))))))))))))))

.

2009-02-12 23:46 . 2009-02-12 23:47 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Multi-Note

2009-02-11 20:16 . 2009-02-11 20:16 <DIR> d-------- c:\documents and settings\Kathy\Application Data\PCF-VLC

2009-02-11 20:04 . 2009-02-11 20:04 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Participatory Culture Foundation

2009-02-11 18:50 . 2009-02-11 18:49 410,984 --a------ c:\windows\system32\deploytk.dll

2009-02-11 18:41 . 2009-02-11 18:49 <DIR> d-------- c:\documents and settings\Kathy\.SunDownloadManager

2009-02-09 18:24 . 2009-02-09 18:24 <DIR> d-------- c:\documents and settings\Kathy\Application Data\True Sword

2009-02-09 18:20 . 2009-02-09 18:31 <DIR> d-------- c:\program files\True Sword 5

2009-02-09 18:20 . 2005-10-11 14:40 356,352 --a------ c:\windows\eSellerateEngine.dll

2009-02-09 18:20 . 2003-06-06 11:21 81,920 --a------ c:\windows\eSellerateControl350.dll

2009-02-08 22:36 . 2009-02-08 22:36 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Moyea

2009-02-08 22:35 . 2009-02-08 22:35 <DIR> d-------- c:\program files\Moyea

2009-02-08 00:01 . 2009-02-08 00:01 127 --a------ c:\windows\system32\MRT.INI

2009-02-07 15:55 . 2009-02-12 22:45 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Move Networks

2009-02-07 12:32 . 2009-02-14 10:30 <DIR> d-------- c:\program files\iTunes

2009-02-07 12:32 . 2009-02-14 10:30 <DIR> d-------- c:\program files\iPod

2009-02-05 22:59 . 2009-02-05 22:59 <DIR> d-------- c:\program files\Avira

2009-02-05 22:59 . 2009-02-05 22:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-02-01 23:44 . 2009-02-07 12:30 <DIR> d-------- c:\program files\QuickTime

2009-02-01 23:43 . 2009-02-14 10:29 <DIR> d-------- c:\program files\Bonjour

2009-02-01 23:42 . 2009-02-01 23:42 <DIR> d-------- c:\windows\system32\en

2009-02-01 23:42 . 2009-02-01 23:42 <DIR> d-------- c:\windows\system32\bits

2009-02-01 22:41 . 2009-02-01 23:26 <DIR> d-------- C:\e5005ea4a9fa079e4193acc4c64e

2009-02-01 22:39 . 2009-02-01 23:26 <DIR> d-------- C:\7e02c1b6601580e10fc061c9a31b14

2009-02-01 22:23 . 2009-02-01 22:23 <DIR> d-------- c:\documents and settings\Kathy\Application Data\Uniblue

2009-01-16 22:16 . 2009-01-16 22:16 574,989 --a------ c:\documents and settings\cam mask 1.png

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-14 15:40 --------- d-----w c:\documents and settings\Kathy\Application Data\WTablet

2009-02-13 23:45 --------- d-----w c:\documents and settings\LocalService\Application Data\WTablet

2009-02-12 01:27 --------- d-----w c:\documents and settings\Kathy\Application Data\gtk-2.0

2009-02-11 23:34 --------- d-----w c:\program files\Java

2009-02-07 17:32 --------- d-----w c:\program files\Common Files\Apple

2009-02-07 00:51 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-07 00:02 --------- d-----w c:\program files\Inkscape

2009-01-31 15:28 --------- d-----w c:\program files\Common Files\InstallShield

2009-01-14 21:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-14 21:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-01-13 03:14 --------- d-----w c:\documents and settings\Allison\Application Data\Malwarebytes

2008-12-17 03:30 --------- d-----w c:\documents and settings\Kathy\Application Data\Malwarebytes

2008-12-17 03:30 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2008-12-17 03:15 --------- d-----w c:\program files\Trend Micro

2008-12-17 01:13 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2008-12-17 01:12 --------- d-----w c:\program files\Lavasoft

2008-12-17 01:11 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2008-12-16 23:41 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2008-12-16 21:28 --------- d-----w c:\program files\Spybot - Search & Destroy

2008-11-26 05:09 160,263 ----a-w c:\windows\Sqirlz Morph Uninstaller.exe

2008-09-03 02:52 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-02-10_23.32.25.53 )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-10-16 20:38:34 124,928 -c----w c:\windows\ie7updates\KB961260-IE7\advpack.dll

+ 2008-10-16 20:38:34 347,136 -c----w c:\windows\ie7updates\KB961260-IE7\dxtmsft.dll

+ 2008-10-16 20:38:34 214,528 -c----w c:\windows\ie7updates\KB961260-IE7\dxtrans.dll

+ 2008-10-16 20:38:35 133,120 -c----w c:\windows\ie7updates\KB961260-IE7\extmgr.dll

+ 2008-10-16 20:38:35 63,488 -c----w c:\windows\ie7updates\KB961260-IE7\icardie.dll

+ 2008-10-16 13:11:09 70,656 -c----w c:\windows\ie7updates\KB961260-IE7\ie4uinit.exe

+ 2008-10-16 20:38:35 153,088 -c----w c:\windows\ie7updates\KB961260-IE7\ieakeng.dll

+ 2008-10-16 20:38:35 230,400 -c----w c:\windows\ie7updates\KB961260-IE7\ieaksie.dll

+ 2008-10-15 07:04:53 161,792 -c----w c:\windows\ie7updates\KB961260-IE7\ieakui.dll

+ 2008-10-16 20:38:35 383,488 -c----w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll

+ 2008-10-16 20:38:35 384,512 -c----w c:\windows\ie7updates\KB961260-IE7\iedkcs32.dll

+ 2008-10-16 20:38:37 6,066,176 -c----w c:\windows\ie7updates\KB961260-IE7\ieframe.dll

+ 2008-10-16 20:38:37 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\iernonce.dll

+ 2008-10-16 20:38:37 267,776 -c----w c:\windows\ie7updates\KB961260-IE7\iertutil.dll

+ 2008-10-16 13:11:09 13,824 -c----w c:\windows\ie7updates\KB961260-IE7\ieudinit.exe

+ 2008-10-15 07:06:26 633,632 -c----w c:\windows\ie7updates\KB961260-IE7\iexplore.exe

+ 2008-10-16 20:38:37 27,648 -c----w c:\windows\ie7updates\KB961260-IE7\jsproxy.dll

+ 2008-10-16 20:38:37 459,264 -c----w c:\windows\ie7updates\KB961260-IE7\msfeeds.dll

+ 2008-10-16 20:38:37 52,224 -c----w c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll

+ 2008-12-13 06:40:02 3,593,216 -c----w c:\windows\ie7updates\KB961260-IE7\mshtml.dll

+ 2008-10-16 20:38:38 477,696 -c----w c:\windows\ie7updates\KB961260-IE7\mshtmled.dll

+ 2008-10-16 20:38:38 193,024 -c----w c:\windows\ie7updates\KB961260-IE7\msrating.dll

+ 2008-10-16 20:38:39 671,232 -c----w c:\windows\ie7updates\KB961260-IE7\mstime.dll

+ 2008-10-16 20:38:39 102,912 -c----w c:\windows\ie7updates\KB961260-IE7\occache.dll

+ 2008-10-16 20:38:39 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\pngfilt.dll

+ 2007-03-06 01:22:41 213,216 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe

+ 2007-03-06 01:23:51 371,424 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\updspapi.dll

+ 2008-10-16 20:38:39 105,984 -c----w c:\windows\ie7updates\KB961260-IE7\url.dll

+ 2008-10-16 20:38:39 1,160,192 -c----w c:\windows\ie7updates\KB961260-IE7\urlmon.dll

+ 2008-10-16 20:38:39 233,472 -c----w c:\windows\ie7updates\KB961260-IE7\webcheck.dll

+ 2008-10-16 20:38:40 826,368 -c----w c:\windows\ie7updates\KB961260-IE7\wininet.dll

- 2008-10-16 20:38:34 124,928 ----a-w c:\windows\system32\advpack.dll

+ 2008-12-20 23:15:11 124,928 ----a-w c:\windows\system32\advpack.dll

- 2008-10-16 20:38:34 124,928 ------w c:\windows\system32\dllcache\advpack.dll

+ 2008-12-20 23:15:11 124,928 ------w c:\windows\system32\dllcache\advpack.dll

- 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll

+ 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll

- 2008-10-16 20:38:34 214,528 ------w c:\windows\system32\dllcache\dxtrans.dll

+ 2008-12-20 23:15:13 214,528 ------w c:\windows\system32\dllcache\dxtrans.dll

- 2008-10-16 20:38:35 133,120 ------w c:\windows\system32\dllcache\extmgr.dll

+ 2008-12-20 23:15:13 133,120 ------w c:\windows\system32\dllcache\extmgr.dll

- 2008-10-16 20:38:35 63,488 ------w c:\windows\system32\dllcache\icardie.dll

+ 2008-12-20 23:15:13 63,488 ------w c:\windows\system32\dllcache\icardie.dll

- 2008-10-16 13:11:09 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe

+ 2008-12-19 09:10:15 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe

- 2008-10-16 20:38:35 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll

+ 2008-12-20 23:15:14 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll

- 2008-10-16 20:38:35 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll

+ 2008-12-20 23:15:14 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll

- 2008-10-15 07:04:53 161,792 ------w c:\windows\system32\dllcache\ieakui.dll

+ 2008-12-19 05:23:56 161,792 ------w c:\windows\system32\dllcache\ieakui.dll

- 2008-10-16 20:38:35 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll

+ 2008-12-20 23:15:15 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll

- 2008-10-16 20:38:35 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll

+ 2008-12-20 23:15:16 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll

- 2008-10-16 20:38:37 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll

+ 2008-12-20 23:15:21 6,066,688 ------w c:\windows\system32\dllcache\ieframe.dll

- 2008-10-16 20:38:37 44,544 ------w c:\windows\system32\dllcache\iernonce.dll

+ 2008-12-20 23:15:21 44,544 ------w c:\windows\system32\dllcache\iernonce.dll

- 2008-10-16 20:38:37 267,776 ------w c:\windows\system32\dllcache\iertutil.dll

+ 2008-12-20 23:15:22 267,776 ------w c:\windows\system32\dllcache\iertutil.dll

- 2008-10-16 13:11:09 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe

+ 2008-12-19 09:10:15 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe

- 2008-10-15 07:06:26 633,632 ------w c:\windows\system32\dllcache\iexplore.exe

+ 2008-12-19 05:25:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe

- 2008-10-16 20:38:37 27,648 ------w c:\windows\system32\dllcache\jsproxy.dll

+ 2008-12-20 23:15:23 27,648 ------w c:\windows\system32\dllcache\jsproxy.dll

- 2008-10-16 20:38:37 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll

+ 2008-12-20 23:15:23 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll

- 2008-10-16 20:38:37 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll

+ 2008-12-20 23:15:24 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll

- 2008-12-13 06:40:02 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll

+ 2009-01-17 02:35:14 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll

- 2008-10-16 20:38:38 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll

+ 2008-12-20 23:15:30 477,696 ------w c:\windows\system32\dllcache\mshtmled.dll

- 2008-10-16 20:38:38 193,024 ------w c:\windows\system32\dllcache\msrating.dll

+ 2008-12-20 23:15:31 193,024 ------w c:\windows\system32\dllcache\msrating.dll

- 2008-10-16 20:38:39 671,232 ------w c:\windows\system32\dllcache\mstime.dll

+ 2008-12-20 23:15:32 671,232 ------w c:\windows\system32\dllcache\mstime.dll

- 2008-10-16 20:38:39 102,912 ------w c:\windows\system32\dllcache\occache.dll

+ 2008-12-20 23:15:38 102,912 ------w c:\windows\system32\dllcache\occache.dll

- 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll

+ 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll

- 2008-10-16 20:38:39 105,984 ------w c:\windows\system32\dllcache\url.dll

+ 2008-12-20 23:15:39 105,984 ------w c:\windows\system32\dllcache\url.dll

- 2008-10-16 20:38:39 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll

+ 2008-12-20 23:15:40 1,160,192 ------w c:\windows\system32\dllcache\urlmon.dll

- 2008-10-16 20:38:39 233,472 ------w c:\windows\system32\dllcache\webcheck.dll

+ 2008-12-20 23:15:40 233,472 ------w c:\windows\system32\dllcache\webcheck.dll

- 2008-10-16 20:38:40 826,368 ------w c:\windows\system32\dllcache\wininet.dll

+ 2008-12-20 23:15:41 826,368 ------w c:\windows\system32\dllcache\wininet.dll

- 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dxtmsft.dll

+ 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dxtmsft.dll

- 2008-10-16 20:38:34 214,528 ------w c:\windows\system32\dxtrans.dll

+ 2008-12-20 23:15:13 214,528 ------w c:\windows\system32\dxtrans.dll

- 2008-10-16 20:38:35 133,120 ------w c:\windows\system32\extmgr.dll

+ 2008-12-20 23:15:13 133,120 ------w c:\windows\system32\extmgr.dll

- 2008-10-16 20:38:35 63,488 ----a-w c:\windows\system32\icardie.dll

+ 2008-12-20 23:15:13 63,488 ----a-w c:\windows\system32\icardie.dll

- 2008-10-16 13:11:09 70,656 ------w c:\windows\system32\ie4uinit.exe

+ 2008-12-19 09:10:15 70,656 ------w c:\windows\system32\ie4uinit.exe

- 2008-10-16 20:38:35 153,088 ------w c:\windows\system32\ieakeng.dll

+ 2008-12-20 23:15:14 153,088 ------w c:\windows\system32\ieakeng.dll

- 2008-10-16 20:38:35 230,400 ------w c:\windows\system32\ieaksie.dll

+ 2008-12-20 23:15:14 230,400 ------w c:\windows\system32\ieaksie.dll

- 2008-10-15 07:04:53 161,792 ------w c:\windows\system32\ieakui.dll

+ 2008-12-19 05:23:56 161,792 ------w c:\windows\system32\ieakui.dll

- 2008-10-16 20:38:35 383,488 ----a-w c:\windows\system32\ieapfltr.dll

+ 2008-12-20 23:15:15 383,488 ----a-w c:\windows\system32\ieapfltr.dll

- 2008-10-16 20:38:35 384,512 ------w c:\windows\system32\iedkcs32.dll

+ 2008-12-20 23:15:16 384,512 ------w c:\windows\system32\iedkcs32.dll

- 2008-10-16 20:38:37 6,066,176 ----a-w c:\windows\system32\ieframe.dll

+ 2008-12-20 23:15:21 6,066,688 ----a-w c:\windows\system32\ieframe.dll

- 2008-10-16 20:38:37 44,544 ------w c:\windows\system32\iernonce.dll

+ 2008-12-20 23:15:21 44,544 ------w c:\windows\system32\iernonce.dll

- 2008-10-16 20:38:37 267,776 ----a-w c:\windows\system32\iertutil.dll

+ 2008-12-20 23:15:22 267,776 ----a-w c:\windows\system32\iertutil.dll

- 2008-10-16 13:11:09 13,824 ----a-w c:\windows\system32\ieudinit.exe

+ 2008-12-19 09:10:15 13,824 ----a-w c:\windows\system32\ieudinit.exe

- 2008-06-10 05:21:01 135,168 ----a-w c:\windows\system32\java.exe

+ 2009-02-11 23:49:45 144,792 ----a-w c:\windows\system32\java.exe

- 2008-06-10 05:21:04 135,168 ----a-w c:\windows\system32\javaw.exe

+ 2009-02-11 23:49:45 144,792 ----a-w c:\windows\system32\javaw.exe

- 2008-06-10 06:32:34 139,264 ----a-w c:\windows\system32\javaws.exe

+ 2009-02-11 23:49:45 148,888 ----a-w c:\windows\system32\javaws.exe

- 2008-10-16 20:38:37 27,648 ------w c:\windows\system32\jsproxy.dll

+ 2008-12-20 23:15:23 27,648 ------w c:\windows\system32\jsproxy.dll

- 2009-01-09 22:35:30 20,853,704 ----a-w c:\windows\system32\MRT.exe

+ 2009-02-03 23:21:12 21,244,864 ----a-w c:\windows\system32\MRT.exe

- 2008-10-16 20:38:37 459,264 ----a-w c:\windows\system32\msfeeds.dll

+ 2008-12-20 23:15:23 459,264 ----a-w c:\windows\system32\msfeeds.dll

- 2008-10-16 20:38:37 52,224 ----a-w c:\windows\system32\msfeedsbs.dll

+ 2008-12-20 23:15:24 52,224 ----a-w c:\windows\system32\msfeedsbs.dll

- 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\mshtml.dll

+ 2009-01-17 02:35:14 3,594,752 ----a-w c:\windows\system32\mshtml.dll

- 2008-10-16 20:38:38 477,696 ------w c:\windows\system32\mshtmled.dll

+ 2008-12-20 23:15:30 477,696 ------w c:\windows\system32\mshtmled.dll

- 2008-10-16 20:38:38 193,024 ------w c:\windows\system32\msrating.dll

+ 2008-12-20 23:15:31 193,024 ------w c:\windows\system32\msrating.dll

- 2008-10-16 20:38:39 671,232 ------w c:\windows\system32\mstime.dll

+ 2008-12-20 23:15:32 671,232 ------w c:\windows\system32\mstime.dll

- 2008-10-16 20:38:39 102,912 ------w c:\windows\system32\occache.dll

+ 2008-12-20 23:15:38 102,912 ------w c:\windows\system32\occache.dll

- 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\pngfilt.dll

+ 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\pngfilt.dll

- 2007-11-30 12:39:22 17,272 ------w c:\windows\system32\spmsg.dll

+ 2008-07-09 07:38:24 17,272 ------w c:\windows\system32\spmsg.dll

- 2008-10-16 20:38:39 105,984 ----a-w c:\windows\system32\url.dll

+ 2008-12-20 23:15:39 105,984 ----a-w c:\windows\system32\url.dll

- 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\urlmon.dll

+ 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\urlmon.dll

- 2008-10-16 20:38:39 233,472 ----a-w c:\windows\system32\webcheck.dll

+ 2008-12-20 23:15:40 233,472 ----a-w c:\windows\system32\webcheck.dll

- 2008-10-16 20:38:40 826,368 ----a-w c:\windows\system32\wininet.dll

+ 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\wininet.dll

+ 2009-02-14 15:40:18 16,384 ----atw c:\windows\temp\Perflib_Perfdata_104.dat

.

-- Snapshot reset to current date --

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]

"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-28 395776]

"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-03 68856]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

"Google Update"="c:\documents and settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-06 176128]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-11 148888]

c:\documents and settings\Kathy\Start Menu\Programs\Startup\

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-07-27 24576]

Google Desktop Sidebar.lnk - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-27 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\WINDOWS\\system32\\Pen_Tablet.exe"=

"c:\\Documents and Settings\\Kathy\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=

"c:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-10-20 1373480]

S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2007-09-26 16512]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-07-27 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08

.

Contents of the 'Scheduled Tasks' folder

2009-02-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4086014027-354043883-2978333643-1006.job

- c:\documents and settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 20:10]

.

- - - - ORPHANS REMOVED - - - -

BHO-{5B35A255-E311-44C1-94FE-31A692069244} - (no file)

BHO-{8c937016-8d47-469f-a676-b01d56734c18} - (no file)

.

------- Supplementary Scan -------

.

uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

Trusted Zone: caperesortsgroup.com\pms

FF - ProfilePath - c:\documents and settings\Kathy\Application Data\Mozilla\Firefox\Profiles\9vvprjyh.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://espn.go.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=

FF - component: c:\documents and settings\Kathy\Application Data\Mozilla\Firefox\Profiles\9vvprjyh.default\extensions\ubiquity@labs.mozilla.com\platform\WINNT_x86-msvc\components\ubiquity.dll

FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\documents and settings\Kathy\Application Data\Mozilla\Firefox\Profiles\9vvprjyh.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll

FF - plugin: c:\documents and settings\Kathy\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-14 10:40:57

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(872)

c:\windows\System32\BCMLogon.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\WLTRYSVC.EXE

c:\windows\system32\BCMWLTRY.EXE

c:\program files\Lavasoft\Ad-Aware\aawservice.exe

c:\program files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\PSIService.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\WTablet\Pen_TabletUser.exe

c:\program files\Apoint\hidfind.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\Apoint\ApntEx.exe

c:\program files\OpenOffice.org 3\program\soffice.exe

c:\program files\OpenOffice.org 3\program\soffice.bin

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-02-14 10:45:46 - machine was rebooted

ComboFix-quarantined-files.txt 2009-02-14 15:45:43

ComboFix2.txt 2009-02-12 00:30:43

ComboFix3.txt 2009-02-11 04:33:48

Pre-Run: 43,845,713,920 bytes free

Post-Run: 43,829,825,536 bytes free

347 --- E O F --- 2009-02-12 03:42:48

Link to post
Share on other sites

Everything's been running well for a couple of days... thank you so much!

FF has been pretty smooth - IE still won't boot. The window will open, but the homepage won't load, and it crashes almost immediately thereafter. I do use FireFox for just about everything, so no IE isn't a dealbreaker for me, just disconcerting that it still crashes. Maybe reinstall it???

The only other thing (and this is extremely minor comparatively) the notification area in the task bar doesn't show the volume, battery/charging or connection icons on startup. If I go the Control Panel and check off to show the volume they will all come back, but they always disappear on restart. In the Taskbar Advanced options, I put them all to be "Always Show" and they still disappear when I restart. Thoughts?

Here's the HiJack This:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:13:57 PM, on 2/16/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\PSIService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\NetWaiting\netWaiting.exe

C:\Program Files\Dell Support\DSAgnt.exe

C:\Program Files\RocketDock\RocketDock.exe

C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\Documents and Settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Apoint\HidFind.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6070727

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kathy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - S-1-5-18 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User 'Default user')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Google Desktop Sidebar.lnk = C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://pms.caperesortsgroup.com

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.1.6.cab

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 9129 bytes

Link to post
Share on other sites

To assist in the prevention of spyware infections:

Immunize your browser by installing Spywareblaster. What does it do?

  • Prevents the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
  • Blocks spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
  • Restricts the actions of potentially unwanted sites in Internet Explorer.

Keep your anti-virus and spyware definitions up to date. Be sure to scan often.

Below you can choose from several of the freeware Firewalls available on the public domain. Even though you may have a Firewall already installed, keep this list handy should you choose not to renew your subscription for whatever reason.

You should always have at least (but not more than ) one of these types of third party firewalls running on board:

Kerio Personal Firewall

Zone Alarm

Outpost Free

Comodo Beware of the "Ask" tool bar that's now included. If you don't want it, remove the check from the box during installation

Install the free security tool "Secunia PSI" to help protect your system against software vulnerabilities. The free utility scans your system's software applications and offers a one button "Download "Solution" feature that updates the exploited software AND provides other related information/patching if warranted.

Stay updated with the most recent Windows patches as well...using Microsoft's Windows Update. Make it easy on yourself, and set this feature to Automatic.

Using an alternate browser can reduce your chance of certain infections installing themselves. I recommend installing Mozilla Firefox. If you don't already have "Firefox", please consider installing and using this browser for surfing.

If you still wish to use Internet Explorer, please make sure you install SpywareBlaster (from above) to protect you from most ActiveX infections.

Become familiar with the MalwareBytes anti-malware application. Use it often especially if you begin to notice the system performance behavior is not what it should be. Learn more about the program Here where you can also request assistance if you have some concerns about the programs findings.

***Note***

The licensed version provides real time protection and other automatic features otherwise not available.

Comodo's BOClean utility is another very good "Free" malware cleaner that runs in the background to help prevent malware intrusions.

Run CCleaner often. The Yahoo Toolbar is included by default during the installation...if you DO NOT WANT IT, be sure to remove the check from the "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser" option during installation setup or else just download the Slim version (no toolbar...third download link at the bottom of that page)..

Or if you just want to run your on board Disk Cleanup ("Start--> Programs-->Accessories-->System Tools-->Disk Cleanup" ), just open the utility and check off the following:

Downloaded Program Files, Temporary Internet Files, Recycle Bin, and Temporary Files. Don't forget to defrag the system.

So how did I get infected in the first place?

Regards, and Happy Surfing!

Link to post
Share on other sites

This issue appears resolved and the thread is closed to prevent others from posting here.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.