Persistent malware infection

[LenD]

I've been working with Tom Mercado on trying to clean my computer. He has the history in an email chain, if you need to see it. I've always used McAfee to protect my computers, but I've had to run the recover mode on this desktop a few times. After the last time, Norton Antivirus tried to run. It had been installed prior to my purchasing the computer. I tried to delete that program and used the Add/Remove Programs to do it instead of running the Uninstall program that was probably with it. Since then, McAfee won't load. I've tried running all the uninstall files that seem appropriate on the Norton site, but they don't do any good. I should have continued searching for another antivirus program, but didn't. So now I have a very persistent malware infection that has nearly disabled my computer at times.

Tom has patiently guided me through the use of several programs to try to clean things up. Nearly all have found and removed various Trojan viruses, but none have removed them for good. The browser is very slow to start, and sometimes I have to close the first or second browser using task manager, before I get one that will respond right. I usually have to click on the home page link to get it to start right.

Most recently, I had a new problem with pop up pages. Tom suggested I run ComboFix and send him the log along with snapshots of the 2 reg3dit files. Running ComboFix stopped the pop-up problem. When I tried to send the log and the snapshots to Tom by email a few days ago, they wouldn't load. The snapshots are too big to send here, but I am sending the ComboFix log. I have not followed the instructions from the "I'm infected - What do I do now?, Please follow these instructions to clean your system" file, yet, but I will do that when I finish here. It may take a while since the virus program sometimes takes a few hours, but I'll get back with you ASAP.

I would appreciate help eradicating the virus' from my pc. BTW, I do have Spyware Blaster, and I use AdAware. I have also installed AVG free, but they have all been disabled except for Spyware Blaster. I had that one disabled, but seemed to be getting new infections, so I enabled it again.

Thanks,

Len

combofixlog4.9.09.txt

combofixlog4.9.09.txt

[LenD]

Tom sent this message by email:

Tom Mercado, Apr 10 00:57:

I can see more malware files in the CF log.

Lets try and clean them up so at least the machine won't get any worse.

Please open Notepad then copy & paste all the following text below that is between the dashed lines, but excluding those lines:

--------------------------

File::

c:\windows\unonamanewohisiq.dll

c:\windows\exogevusukase.dll

c:\windows\ahimelum.dll

c:\windows\Iyezisunog.dat

--------------------------

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe, on the desktop

Drag the .txt file that is located on your desktop into the combofix icon on your desktop as displayed in the link below:

http://www.malwarebytes.org/forums/index.p...ost&p=41516

This will start ComboFix again. After reboot, (in case it asks to reboot), **attach** the contents of Combofix.txt in your next reply

No reboot requested. The file is attached. I'll wait for further instructions about what to do next.

CFlog4.12.09.txt

CFlog4.12.09.txt

[miekiemoes]

Hi,

* Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• In case you already used MBAM previously, please update it before proceeding with the scan. To do this, click the "Update" tab and click the "Check For updates" button.
  
• Once the program has loaded and updates were downloaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply along with a fresh HijackThis log.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

[LenD]

Here are the logs you requested. MBAM didn't find anything this time, but I can tell it's still there.

mbam_log_2009_04_12__16_39_55_.txt

hijackthis4.12.09.txt

mbam_log_2009_04_12__16_39_55_.txt

hijackthis4.12.09.txt

[miekiemoes]

Hi,

Please run Combofix again and post the new log in your next reply. Please don't attach the log, but copy and paste instead

[LenD]

ComboFix 09-04-13.A2 - Compaq_Administrator 2009-04-13 8:07.5 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.366 [GMT -5:00]

Running from: c:\documents and settings\Compaq_Administrator\Desktop\Comix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

L:\autorun.inf

.

((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))

.

2009-04-12 21:40 . 2009-04-12 21:40 -------- d-----w c:\program files\Trend Micro

2009-04-12 21:35 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-04-12 21:35 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-04-10 01:21 . 2009-04-10 01:24 -------- d-----w C:\ComboFix

2009-04-08 23:17 . 2009-04-08 23:17 -------- d-----w c:\program files\Gadwin Systems

2009-04-02 21:13 . 2009-03-17 18:26 65320 ----a-w c:\windows\system32\sbbd.exe

2009-04-02 21:13 . 2008-10-22 22:08 92464 ----a-w c:\windows\system32\drivers\SBREDrv.sys

2009-04-02 21:12 . 2009-04-02 21:16 -------- d-----w C:\VIPRERESCUE

2009-04-02 16:01 . 2009-04-02 17:12 -------- d-----w c:\documents and settings\Compaq_Administrator\DoctorWeb

2009-04-01 02:26 . 2009-04-01 02:26 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\Malwarebytes

2009-03-29 05:08 . 2009-03-29 05:10 -------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner

2009-03-29 05:08 . 2009-03-29 05:08 -------- d-----w c:\program files\Uniblue

2009-03-29 04:46 . 2009-03-29 04:46 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-03-29 04:46 . 2009-04-12 21:35 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-03-28 16:39 . 2009-03-28 16:39 -------- d-----w c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\{8A4CC7C6-575E-4F23-9F1C-53E767FCCC3D}

2009-03-26 19:33 . 2009-03-26 19:33 25012 ----a-w c:\windows\system32\AAWService_2009_03_26_14_33_37.dmp

2009-03-26 17:00 . 2009-03-26 17:00 -------- d-sh--w c:\documents and settings\Compaq_Administrator\IECompatCache

2009-03-26 16:23 . 2009-03-26 16:23 -------- d-----w c:\program files\GetData

2009-03-26 16:13 . 2009-03-29 05:08 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\Uniblue

2009-03-24 05:06 . 2009-04-13 06:19 -------- d--h--w C:\$AVG8.VAULT$

2009-03-24 05:01 . 2009-03-24 05:01 10520 ----a-w c:\windows\system32\avgrsstx.dll

2009-03-24 05:01 . 2009-03-28 15:11 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys

2009-03-24 05:01 . 2009-03-24 05:01 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-03-24 05:01 . 2009-04-11 14:36 -------- d-----w c:\windows\system32\drivers\Avg

2009-03-24 05:01 . 2009-03-24 05:04 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\AVGTOOLBAR

2009-03-24 05:01 . 2009-03-30 16:21 -------- d-----w c:\documents and settings\All Users\Application Data\avg8

2009-03-24 05:01 . 2009-03-24 05:01 -------- d-----w c:\program files\AVG

2009-03-24 01:03 . 2009-03-24 01:03 -------- d-----w c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\bxokewmw

2009-03-24 01:03 . 2009-03-24 01:03 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\bxokewmw

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-12 15:16 . 2008-12-15 04:37 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\mjusbsp

2009-04-10 00:14 . 2008-03-28 10:52 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-04-09 05:02 . 2009-01-30 16:44 14761 ----a-w C:\aaw7boot.log

2009-04-09 03:14 . 2006-09-28 21:09 -------- d-----w c:\program files\SpywareBlaster

2009-04-08 03:17 . 2008-03-06 03:31 -------- d-----w c:\documents and settings\All Users\Application Data\RFA_Backups

2009-04-02 22:10 . 2006-10-01 16:00 -------- d-----w c:\program files\Bible

2009-04-02 20:37 . 2008-11-07 15:49 -------- d-----w c:\program files\Common Files\Motive

2009-03-29 04:16 . 2005-11-11 21:06 -------- d--h--w c:\program files\InstallShield Installation Information

2009-03-28 03:15 . 2005-11-11 21:16 -------- d-----w c:\program files\Common Files\Real

2009-03-26 13:05 . 2008-08-25 05:12 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\W Photo Studio

2009-03-10 02:55 . 2009-03-10 02:55 -------- d-----w c:\program files\Yontoo Layers Client for Internet Explorer

2009-03-10 02:55 . 2009-03-10 02:55 -------- d-----w c:\documents and settings\All Users\Application Data\Tarma Installer

2009-03-09 17:31 . 2009-01-19 18:02 15688 ----a-w c:\windows\system32\lsdelete.exe

2009-03-09 17:26 . 2009-01-19 18:16 64160 ----a-w c:\windows\system32\drivers\Lbd.sys

2009-02-22 04:27 . 2008-09-24 15:09 -------- d-----w c:\documents and settings\All Users\Application Data\NOS

2009-02-22 04:27 . 2008-09-24 15:09 -------- d-----w c:\program files\NOS

2009-02-16 22:30 . 2009-02-16 22:20 4480 ----a-w C:\stub.log

2009-02-16 22:00 . 2009-02-16 21:44 0 ----a-w C:\Log.txt

2009-02-16 21:44 . 2005-11-11 21:22 -------- d-----w c:\program files\Hewlett-Packard

2009-01-28 22:18 . 2008-12-15 03:56 70008 ----a-w c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-01-23 00:38 . 2005-11-11 21:15 70008 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-01-15 08:17 . 2004-08-10 12:00 636264 ----a-w c:\windows\system32\dllcache\iexplore.exe

2009-01-15 08:17 . 2004-08-10 12:00 392040 ----a-w c:\windows\system32\dllcache\iedkcs32.dll

2009-01-15 08:13 . 2004-08-10 12:00 5888512 ----a-w c:\windows\system32\dllcache\mshtml.dll

2009-01-15 08:06 . 2004-08-10 12:00 1182720 ----a-w c:\windows\system32\dllcache\urlmon.dll

2009-01-15 08:06 . 2004-08-10 12:00 236544 ----a-w c:\windows\system32\dllcache\webcheck.dll

2009-01-15 08:06 . 2004-08-10 12:00 105984 ----a-w c:\windows\system32\dllcache\url.dll

2009-01-15 08:05 . 2004-08-10 12:00 911872 ----a-w c:\windows\system32\wininet.dll

2009-01-15 08:05 . 2004-08-10 12:00 911872 ----a-w c:\windows\system32\dllcache\wininet.dll

2009-01-15 08:05 . 2004-08-10 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll

2009-01-15 08:05 . 2004-08-10 12:00 43008 ----a-w c:\windows\system32\dllcache\licmgr10.dll

2009-01-15 08:05 . 2004-08-10 12:00 193536 ----a-w c:\windows\system32\dllcache\msrating.dll

2009-01-15 08:05 . 2004-08-10 12:00 109056 ----a-w c:\windows\system32\dllcache\occache.dll

2009-01-15 08:04 . 2004-08-10 12:00 755200 ----a-w c:\windows\system32\dllcache\VGX.dll

2009-01-15 08:04 . 2004-08-10 12:00 18944 ----a-w c:\windows\system32\dllcache\corpol.dll

2009-01-15 08:04 . 2004-08-10 12:00 18944 ----a-w c:\windows\system32\corpol.dll

2009-01-15 08:04 . 2004-08-10 12:00 25600 ----a-w c:\windows\system32\dllcache\jsproxy.dll

2009-01-15 08:02 . 2004-08-10 12:00 611840 ----a-w c:\windows\system32\dllcache\mstime.dll

2009-01-15 08:01 . 2004-08-10 12:00 183808 ----a-w c:\windows\system32\dllcache\iepeers.dll

2009-01-15 08:01 . 2004-08-10 12:00 34304 ----a-w c:\windows\system32\imgutil.dll

2009-01-15 08:01 . 2004-08-10 12:00 34304 ----a-w c:\windows\system32\dllcache\imgutil.dll

2009-01-15 08:01 . 2004-08-10 12:00 348160 ----a-w c:\windows\system32\dllcache\dxtmsft.dll

2009-01-15 08:01 . 2004-08-10 12:00 46592 ----a-w c:\windows\system32\dllcache\pngfilt.dll

2009-01-15 08:01 . 2004-08-10 12:00 216064 ----a-w c:\windows\system32\dllcache\dxtrans.dll

2009-01-15 08:01 . 2004-08-10 12:00 66560 ----a-w c:\windows\system32\dllcache\mshtmled.dll

2009-01-15 08:00 . 2004-08-10 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll

2009-01-15 08:00 . 2004-08-10 12:00 48128 ----a-w c:\windows\system32\dllcache\mshtmler.dll

2009-01-15 08:00 . 2004-08-10 12:00 45568 ----a-w c:\windows\system32\mshta.exe

2009-01-15 08:00 . 2004-08-10 12:00 45568 ----a-w c:\windows\system32\dllcache\mshta.exe

2009-01-15 07:53 . 2004-08-10 12:00 68608 ----a-w c:\windows\system32\dllcache\hmmapi.dll

2009-01-15 07:50 . 2004-08-10 12:00 156160 ----a-w c:\windows\system32\msls31.dll

2009-01-15 07:50 . 2004-08-10 12:00 156160 ----a-w c:\windows\system32\dllcache\msls31.dll

2008-12-16 03:21 . 2008-12-16 03:21 61224 ----a-w c:\documents and settings\Compaq_Administrator\GoToAssistDownloadHelper.exe

2008-12-01 08:59 . 2008-12-01 05:56 470 ----a-w c:\documents and settings\Compaq_Administrator.YOUR-55E5F9E3D2\Application Data\wklnhst.dat

2008-10-03 18:09 . 2008-09-14 16:33 159 ----a-w c:\documents and settings\Compaq_Administrator.YOUR-55E5F9E3D2\Local Settings\Application Data\fusioncache.dat

2008-06-27 11:41 . 2008-06-27 11:41 47360 ----a-w c:\documents and settings\Compaq_Administrator\Application Data\pcouffin.sys

2008-03-06 16:06 . 2007-04-14 12:07 80376 ----a-w c:\documents and settings\Compaq_Administrator\Application Data\GDIPFONTCACHEV1.DAT

2006-11-15 02:04 . 2006-11-15 02:04 0 ----a-w c:\documents and settings\Compaq_Administrator\Application Data\wklnhst.dat

2006-09-28 21:42 . 2008-12-15 03:56 143 ----a-w c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\fusioncache.dat

2005-11-11 21:31 . 2008-09-14 16:33 45584 ----a-w c:\documents and settings\Compaq_Administrator.YOUR-55E5F9E3D2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2005-11-11 20:51 . 2005-11-11 20:51 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat

.

((((((((((((((((((((((((((((( SnapShot@2009-04-12_ 9.54.44.19 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-04-12 21:35 . 2009-04-06 20:32 38496 c:\windows\system32\drivers\mbamswissarmy.sys

- 2009-03-29 04:46 . 2009-04-06 20:32 38496 c:\windows\system32\drivers\mbamswissarmy.sys

+ 2009-04-12 21:35 . 2009-04-06 20:32 15504 c:\windows\system32\drivers\mbam.sys

- 2009-03-29 04:46 . 2009-04-06 20:32 15504 c:\windows\system32\drivers\mbam.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]

2008-10-01 02:40 192960 --------- c:\program files\Yontoo Layers Client for Internet Explorer\YontooIEClient.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

"cdloader"="c:\documents and settings\Compaq_Administrator\Application Data\mjusbsp\cdloader2.exe" [2008-12-17 50520]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

"Gadwin PrintScreen"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2008-12-09 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"DISCover"="c:\program files\DISC\DISCover.exe" [2005-09-27 1060864]

"DiscUpdateManager"="c:\program files\DISC\DiscUpdateMgr.exe" [2005-09-27 61440]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-09-21 1605740]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"rfagent"="c:\program files\RFA\rfagent.exe" [2007-12-04 916800]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-24 1932568]

"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 c:\windows\arpwrmsg.exe]

c:\documents and settings\Compaq_Administrator\Start Menu\Programs\Startup\

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

c:\documents and settings\Compaq_Administrator.YOUR-55E5F9E3D2\Start Menu\Programs\Startup\

OpenOffice.org 2.0.lnk - c:\program files\OpenOffice.org 2.0\program\quickstart.exe [2006-07-14 393216]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Compaq Connections.lnk - c:\program files\Compaq Connections\5577497\Program\Compaq Connections.exe [2005-11-11 36903]

Event Reminder.lnk - c:\program files\PrintMaster 16\pmremind.exe [2004-01-20 339968]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-11-19 389120]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-03-24 00:01 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\DISC\\DISCover.exe"=

"c:\\Program Files\\DISC\\DiscStreamHub.exe"=

"c:\\Program Files\\DISC\\myFTP.exe"=

"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=

"c:\\Program Files\\Yahoo! Games\\Puzzle Express\\PuzzleExpress.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Documents and Settings\\Compaq_Administrator\\Application Data\\mjusbsp\\magicJack.exe"=

R2 0276491232348368mcinstcleanup;McAfee Application Installer Cleanup (0276491232348368); [x]

R2 hnjfrtbu;Remote Access Auto Connection Monitor;c:\windows\System32\svchost.exe [2004-08-10 14336]

R3 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2008-10-22 92464]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-03-24 325640]

S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-03-28 108552]

S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-24 298264]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

hnjfrtbu

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-04-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 12:21]

2009-04-07 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-04-13 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]

2009-03-15 c:\windows\Tasks\HPCeeSchedule.job

- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2005-09-08 22:22]

2009-03-15 c:\windows\Tasks\McDefragTask.job

- c:\windows\system32\defrag.exe [2004-08-10 07:00]

2009-04-01 c:\windows\Tasks\McQcTask.job

- c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

.

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm

uStart Page = hxxp://weather.yahoo.com/forecast/USAR0066_f.html

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop

mLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop

IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html

Trusted Zone: internet

Trusted Zone: mcafee.com

Trusted Zone: trymedia.com

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-13 08:12

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(616)

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2009-04-13 8:14

ComboFix-quarantined-files.txt 2009-04-13 13:13

ComboFix2.txt 2009-04-12 14:55

ComboFix3.txt 2009-04-10 01:32

ComboFix4.txt 2009-03-30 21:12

ComboFix5.txt 2009-04-13 13:06

Pre-Run: 151,394,680,832 bytes free

Post-Run: 151,455,719,424 bytes free

232 --- E O F --- 2009-03-03 09:08

[miekiemoes]

Hi,

Almost done, just some leftovers to deal with, so..

* Open notepad - don't use any other texteditor than notepad or the script will fail.

Copy/paste the text in the quotebox below into notepad:

Driver::

hnjfrtbu

NetSvc::

hnjfrtbu

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

[miekiemoes]

Extra note, I see you have the Yontoo Layers Client for Internet Explorer installed.

Also.. Alleged to have ads in the layers with no obvious warning on install.

Not sure if you have read the Privacy policy here: http://www.yontoo.com/privacypolicy.aspx

So, I would consider to uninstall it...

[LenD]

OK, here's the CF log.

ComboFix 09-04-13.A2 - Compaq_Administrator 2009-04-13 8:52.6 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.481 [GMT -5:00]

Running from: c:\documents and settings\Compaq_Administrator\Desktop\Comix.exe

Command switches used :: c:\documents and settings\Compaq_Administrator\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

L:\autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_HNJFRTBU

-------\Service_hnjfrtbu

((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))

.

2009-04-12 21:40 . 2009-04-12 21:40 -------- d-----w c:\program files\Trend Micro

2009-04-12 21:35 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-04-12 21:35 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-04-10 01:21 . 2009-04-10 01:24 -------- d-----w C:\ComboFix

2009-04-08 23:17 . 2009-04-08 23:17 -------- d-----w c:\program files\Gadwin Systems

2009-04-02 21:13 . 2009-03-17 18:26 65320 ----a-w c:\windows\system32\sbbd.exe

2009-04-02 21:13 . 2008-10-22 22:08 92464 ----a-w c:\windows\system32\drivers\SBREDrv.sys

2009-04-02 21:12 . 2009-04-02 21:16 -------- d-----w C:\VIPRERESCUE

2009-04-02 16:01 . 2009-04-02 17:12 -------- d-----w c:\documents and settings\Compaq_Administrator\DoctorWeb

2009-04-01 02:26 . 2009-04-01 02:26 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\Malwarebytes

2009-03-29 05:08 . 2009-03-29 05:10 -------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner

2009-03-29 05:08 . 2009-03-29 05:08 -------- d-----w c:\program files\Uniblue

2009-03-29 04:46 . 2009-03-29 04:46 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-03-29 04:46 . 2009-04-12 21:35 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-03-28 16:39 . 2009-03-28 16:39 -------- d-----w c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\{8A4CC7C6-575E-4F23-9F1C-53E767FCCC3D}

2009-03-26 19:33 . 2009-03-26 19:33 25012 ----a-w c:\windows\system32\AAWService_2009_03_26_14_33_37.dmp

2009-03-26 17:00 . 2009-03-26 17:00 -------- d-sh--w c:\documents and settings\Compaq_Administrator\IECompatCache

2009-03-26 16:23 . 2009-03-26 16:23 -------- d-----w c:\program files\GetData

2009-03-26 16:13 . 2009-03-29 05:08 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\Uniblue

2009-03-24 05:06 . 2009-04-13 06:19 -------- d--h--w C:\$AVG8.VAULT$

2009-03-24 05:01 . 2009-03-24 05:01 10520 ----a-w c:\windows\system32\avgrsstx.dll

2009-03-24 05:01 . 2009-03-28 15:11 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys

2009-03-24 05:01 . 2009-03-24 05:01 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-03-24 05:01 . 2009-04-11 14:36 -------- d-----w c:\windows\system32\drivers\Avg

2009-03-24 05:01 . 2009-03-24 05:04 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\AVGTOOLBAR

2009-03-24 05:01 . 2009-03-30 16:21 -------- d-----w c:\documents and settings\All Users\Application Data\avg8

2009-03-24 05:01 . 2009-03-24 05:01 -------- d-----w c:\program files\AVG

2009-03-24 01:03 . 2009-03-24 01:03 -------- d-----w c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\bxokewmw

2009-03-24 01:03 . 2009-03-24 01:03 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\bxokewmw

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-13 13:58 . 2008-12-15 04:37 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\mjusbsp

2009-04-13 13:57 . 2009-01-30 16:44 14985 ----a-w C:\aaw7boot.log

2009-04-10 00:14 . 2008-03-28 10:52 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-04-09 03:14 . 2006-09-28 21:09 -------- d-----w c:\program files\SpywareBlaster

2009-04-08 03:17 . 2008-03-06 03:31 -------- d-----w c:\documents and settings\All Users\Application Data\RFA_Backups

2009-04-02 22:10 . 2006-10-01 16:00 -------- d-----w c:\program files\Bible

2009-04-02 20:37 . 2008-11-07 15:49 -------- d-----w c:\program files\Common Files\Motive

2009-03-29 04:16 . 2005-11-11 21:06 -------- d--h--w c:\program files\InstallShield Installation Information

2009-03-28 03:15 . 2005-11-11 21:16 -------- d-----w c:\program files\Common Files\Real

2009-03-26 13:05 . 2008-08-25 05:12 -------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\W Photo Studio

2009-03-10 02:55 . 2009-03-10 02:55 -------- d-----w c:\program files\Yontoo Layers Client for Internet Explorer

2009-03-10 02:55 . 2009-03-10 02:55 -------- d-----w c:\documents and settings\All Users\Application Data\Tarma Installer

2009-03-09 17:31 . 2009-01-19 18:02 15688 ----a-w c:\windows\system32\lsdelete.exe

2009-03-09 17:26 . 2009-01-19 18:16 64160 ----a-w c:\windows\system32\drivers\Lbd.sys

2009-02-22 04:27 . 2008-09-24 15:09 -------- d-----w c:\documents and settings\All Users\Application Data\NOS

2009-02-22 04:27 . 2008-09-24 15:09 -------- d-----w c:\program files\NOS

2009-02-16 22:30 . 2009-02-16 22:20 4480 ----a-w C:\stub.log

2009-02-16 22:00 . 2009-02-16 21:44 0 ----a-w C:\Log.txt

2009-02-16 21:44 . 2005-11-11 21:22 -------- d-----w c:\program files\Hewlett-Packard

2009-01-28 22:18 . 2008-12-15 03:56 70008 ----a-w c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-01-23 00:38 . 2005-11-11 21:15 70008 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-01-15 08:17 . 2004-08-10 12:00 636264 ----a-w c:\windows\system32\dllcache\iexplore.exe

2009-01-15 08:17 . 2004-08-10 12:00 392040 ----a-w c:\windows\system32\dllcache\iedkcs32.dll

2009-01-15 08:13 . 2004-08-10 12:00 5888512 ----a-w c:\windows\system32\dllcache\mshtml.dll

2009-01-15 08:06 . 2004-08-10 12:00 1182720 ----a-w c:\windows\system32\dllcache\urlmon.dll

2009-01-15 08:06 . 2004-08-10 12:00 236544 ----a-w c:\windows\system32\dllcache\webcheck.dll

2009-01-15 08:06 . 2004-08-10 12:00 105984 ----a-w c:\windows\system32\dllcache\url.dll

2009-01-15 08:05 . 2004-08-10 12:00 911872 ----a-w c:\windows\system32\wininet.dll

2009-01-15 08:05 . 2004-08-10 12:00 911872 ----a-w c:\windows\system32\dllcache\wininet.dll

2009-01-15 08:05 . 2004-08-10 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll

2009-01-15 08:05 . 2004-08-10 12:00 43008 ----a-w c:\windows\system32\dllcache\licmgr10.dll

2009-01-15 08:05 . 2004-08-10 12:00 193536 ----a-w c:\windows\system32\dllcache\msrating.dll

2009-01-15 08:05 . 2004-08-10 12:00 109056 ----a-w c:\windows\system32\dllcache\occache.dll

2009-01-15 08:04 . 2004-08-10 12:00 755200 ----a-w c:\windows\system32\dllcache\VGX.dll

2009-01-15 08:04 . 2004-08-10 12:00 18944 ----a-w c:\windows\system32\dllcache\corpol.dll

2009-01-15 08:04 . 2004-08-10 12:00 18944 ----a-w c:\windows\system32\corpol.dll

2009-01-15 08:04 . 2004-08-10 12:00 25600 ----a-w c:\windows\system32\dllcache\jsproxy.dll

2009-01-15 08:02 . 2004-08-10 12:00 611840 ----a-w c:\windows\system32\dllcache\mstime.dll

2009-01-15 08:01 . 2004-08-10 12:00 183808 ----a-w c:\windows\system32\dllcache\iepeers.dll

2009-01-15 08:01 . 2004-08-10 12:00 34304 ----a-w c:\windows\system32\imgutil.dll

2009-01-15 08:01 . 2004-08-10 12:00 34304 ----a-w c:\windows\system32\dllcache\imgutil.dll

2009-01-15 08:01 . 2004-08-10 12:00 348160 ----a-w c:\windows\system32\dllcache\dxtmsft.dll

2009-01-15 08:01 . 2004-08-10 12:00 46592 ----a-w c:\windows\system32\dllcache\pngfilt.dll

2009-01-15 08:01 . 2004-08-10 12:00 216064 ----a-w c:\windows\system32\dllcache\dxtrans.dll

2009-01-15 08:01 . 2004-08-10 12:00 66560 ----a-w c:\windows\system32\dllcache\mshtmled.dll

2009-01-15 08:00 . 2004-08-10 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll

2009-01-15 08:00 . 2004-08-10 12:00 48128 ----a-w c:\windows\system32\dllcache\mshtmler.dll

2009-01-15 08:00 . 2004-08-10 12:00 45568 ----a-w c:\windows\system32\mshta.exe

2009-01-15 08:00 . 2004-08-10 12:00 45568 ----a-w c:\windows\system32\dllcache\mshta.exe

2009-01-15 07:53 . 2004-08-10 12:00 68608 ----a-w c:\windows\system32\dllcache\hmmapi.dll

2009-01-15 07:50 . 2004-08-10 12:00 156160 ----a-w c:\windows\system32\msls31.dll

2009-01-15 07:50 . 2004-08-10 12:00 156160 ----a-w c:\windows\system32\dllcache\msls31.dll

2008-12-16 03:21 . 2008-12-16 03:21 61224 ----a-w c:\documents and settings\Compaq_Administrator\GoToAssistDownloadHelper.exe

2008-12-01 08:59 . 2008-12-01 05:56 470 ----a-w c:\documents and settings\Compaq_Administrator.YOUR-55E5F9E3D2\Application Data\wklnhst.dat

2008-10-03 18:09 . 2008-09-14 16:33 159 ----a-w c:\documents and settings\Compaq_Administrator.YOUR-55E5F9E3D2\Local Settings\Application Data\fusioncache.dat

2008-06-27 11:41 . 2008-06-27 11:41 47360 ----a-w c:\documents and settings\Compaq_Administrator\Application Data\pcouffin.sys

2008-03-06 16:06 . 2007-04-14 12:07 80376 ----a-w c:\documents and settings\Compaq_Administrator\Application Data\GDIPFONTCACHEV1.DAT

2006-11-15 02:04 . 2006-11-15 02:04 0 ----a-w c:\documents and settings\Compaq_Administrator\Application Data\wklnhst.dat

2006-09-28 21:42 . 2008-12-15 03:56 143 ----a-w c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\fusioncache.dat

2005-11-11 21:31 . 2008-09-14 16:33 45584 ----a-w c:\documents and settings\Compaq_Administrator.YOUR-55E5F9E3D2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2005-11-11 20:51 . 2005-11-11 20:51 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat

.

((((((((((((((((((((((((((((( SnapShot@2009-04-12_ 9.54.44.19 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-04-12 21:35 . 2009-04-06 20:32 38496 c:\windows\system32\drivers\mbamswissarmy.sys

- 2009-03-29 04:46 . 2009-04-06 20:32 38496 c:\windows\system32\drivers\mbamswissarmy.sys

+ 2009-04-12 21:35 . 2009-04-06 20:32 15504 c:\windows\system32\drivers\mbam.sys

- 2009-03-29 04:46 . 2009-04-06 20:32 15504 c:\windows\system32\drivers\mbam.sys

+ 2009-04-13 13:56 . 2005-10-21 01:02 163328 c:\windows\ERDNT\subs\ERDNT.EXE

- 2009-03-30 21:04 . 2005-10-21 01:02 163328 c:\windows\ERDNT\subs\ERDNT.EXE

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]

2008-10-01 02:40 192960 --------- c:\program files\Yontoo Layers Client for Internet Explorer\YontooIEClient.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

"cdloader"="c:\documents and settings\Compaq_Administrator\Application Data\mjusbsp\cdloader2.exe" [2008-12-17 50520]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

"Gadwin PrintScreen"="c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe" [2008-12-09 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"DISCover"="c:\program files\DISC\DISCover.exe" [2005-09-27 1060864]

"DiscUpdateManager"="c:\program files\DISC\DiscUpdateMgr.exe" [2005-09-27 61440]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-09-21 1605740]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"rfagent"="c:\program files\RFA\rfagent.exe" [2007-12-04 916800]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-24 1932568]

"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 c:\windows\arpwrmsg.exe]

c:\documents and settings\Compaq_Administrator\Start Menu\Programs\Startup\

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

c:\documents and settings\Compaq_Administrator.YOUR-55E5F9E3D2\Start Menu\Programs\Startup\

OpenOffice.org 2.0.lnk - c:\program files\OpenOffice.org 2.0\program\quickstart.exe [2006-07-14 393216]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Compaq Connections.lnk - c:\program files\Compaq Connections\5577497\Program\Compaq Connections.exe [2005-11-11 36903]

Event Reminder.lnk - c:\program files\PrintMaster 16\pmremind.exe [2004-01-20 339968]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-11-19 389120]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-03-24 00:01 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\DISC\\DISCover.exe"=

"c:\\Program Files\\DISC\\DiscStreamHub.exe"=

"c:\\Program Files\\DISC\\myFTP.exe"=

"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=

"c:\\Program Files\\Yahoo! Games\\Puzzle Express\\PuzzleExpress.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Documents and Settings\\Compaq_Administrator\\Application Data\\mjusbsp\\magicJack.exe"=

R2 0276491232348368mcinstcleanup;McAfee Application Installer Cleanup (0276491232348368); [x]

R3 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2008-10-22 92464]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-03-24 325640]

S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-03-28 108552]

S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-24 298264]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-04-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 12:21]

2009-04-07 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-04-13 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]

2009-03-15 c:\windows\Tasks\HPCeeSchedule.job

- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2005-09-08 22:22]

2009-03-15 c:\windows\Tasks\McDefragTask.job

- c:\windows\system32\defrag.exe [2004-08-10 07:00]

2009-04-01 c:\windows\Tasks\McQcTask.job

- c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

.

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm

uStart Page = hxxp://weather.yahoo.com/forecast/USAR0066_f.html

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop

mLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=presario&pf=desktop

IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html

Trusted Zone: internet

Trusted Zone: mcafee.com

Trusted Zone: trymedia.com

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-13 08:58

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(600)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(752)

c:\docume~1\COMPAQ~1\LOCALS~1\Temp\IadHide5.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\ati2evxx.exe

c:\windows\ehome\ehrecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\AVG\AVG8\avgtray.exe

c:\program files\OpenOffice.org 3\program\soffice.exe

c:\windows\ehome\mcrdsvc.exe

c:\program files\OpenOffice.org 3\program\soffice.bin

c:\windows\system32\dllhost.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\ehome\ehmsas.exe

c:\windows\system32\wscntfy.exe

c:\program files\DISC\DiscStreamHub.exe

c:\program files\AVG\AVG8\avgrsx.exe

c:\progra~1\AVG\AVG8\avgnsx.exe

.

**************************************************************************

.

Completion time: 2009-04-13 9:05 - machine was rebooted

ComboFix-quarantined-files.txt 2009-04-13 14:05

ComboFix2.txt 2009-04-13 13:14

ComboFix3.txt 2009-04-12 14:55

ComboFix4.txt 2009-04-10 01:32

ComboFix5.txt 2009-04-13 13:52

Pre-Run: 151,403,728,896 bytes free

Post-Run: 151,372,943,360 bytes free

263 --- E O F --- 2009-03-03 09:08

[miekiemoes]

Hi,

This looks OK again.

* Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Let me know in your next reply how things are now.

[LenD]

I restarted the pc. The first browser I tried to open just showed a blank browser w/o going anywhere. I had to use task manager to get it to close. The second browser attempt gave me the choice to restore previous session or open home page. When I had clicked on the restore session link before, it had opened up as many as 39 pages with the one click. Needless to say, I had to shut down the computer and start over when that happened. This time clicking on the restore button opened up the home page. I had set the system restore to off while following yours and Tom's instructions, but I just checked and it is turned back on. Perhaps that's as a result of the file you had me run to uninstall ComboFix.

Do you think we took care of the problem? If so, can you tell me what the name of the virus was. I've seen a lot of Trojan's removed, but I'm not very knowledgeable about this stuff.

Since I can't get McAfee to load anymore, can you please suggest what program(s) to use that will provide me some protection and keep this from happening again? Is AVG a good one? I am very appreciative for all of your help.

[miekiemoes]

The first browser I tried to open just showed a blank browser w/o going anywhere. I had to use task manager to get it to close. The second browser attempt gave me the choice to restore previous session or open home page

I assume you mean your Internet Explorer here?

As I said before, not only malware but also legitimate apps may cause this. In your case, as I already told you, you have some add-ons installed here (one if them is not recommended > see this post.

If you have this again, then it's time to troubleshoot the browser add-ins. To do this, run Internet Explorer 7 without Add-ons, rightclick the IE7 icon present on your desktop and select: "Start without Add-ons"

In case that option is not present there, go to start > All Programs > Accessories > System Tools > Internet Explorer (No Add-ons)

This will start Internet Explorer 7 in the No-Add ons mode. This means that toolbars and Browser Helper Objects will be disabled.

So if your problem is solved when you use the No-Add on mode, this means that one of your Add ons is causing this.

To find out which one exactly, * Open Internet Explorer, click the Tools button in the menu > Manage Add-ons > Enable or Disable Add-ons

This will open a new Window with the Add-ons currently loaded into Internet Explorer (that option should be selected by default under "Show")

Now, it's a matter of trial and error what exact Add-on is causing this, so select the first Add-on there and under settings below, select the "disable" radio button. Click Ok below and close your Internet Explorer in order to accept the changes.

Then open your Internet Explorer again and look if you're still having the same problem, if so - then disable the next Add-on there... and so on, until you figured out which Add-on exactly is causing your problem.

Anyway...

There's nothing malicious in your logs anymore.

Yes, I suggest you uninstall McAfee and replace it with another Antivirus if you're having too many problems with it. Who knows it's the cause of your main problem.

For example Avira Antivir is a great free Antivirus. http://www.free-av.com/

Make sure your McAfee is uninstalled and you have rebooted before you install Avira.

Glad I could help.

Please read my Prevention page with lots of info and tips how to prevent this in the future.

And if you want to improve speed/system performance after malware removal, take a look here.

Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!

[miekiemoes]

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.