Google redirect

anonymousrex · May 29, 2009

I've used Hijackthis!, AVG, Malware, Kaspersky, Spybot S&D, but to no avail.

I keep getting redirected through addresses like this one --> http://google-redirect.com/r.php?u=59... etc, etc.

Kindest thanks in advance!

A.P.

-----------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.37

Database version: 2191

Windows 5.1.2600 Service Pack 3

5/29/2009 10:45:55 AM

mbam-log-2009-05-29 (10-45-55).txt

Scan type: Full Scan (C:\|)

Objects scanned: 238241

Time elapsed: 56 minute(s), 19 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 9

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\autochk.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\LocalService\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\Owner\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\Owner\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\Owner\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\documents and settings\Owner\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> Delete on reboot.

C:\WINDOWS\system32\lmn_setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

--------------------------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:57:44 AM, on 5/29/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Memeo\AutoBackup\MemeoService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\carpserv.exe

C:\Program Files\HPQ\One-Touch\OneTouch.EXE

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Linksys\WPC11 Config Utility\WPC11Cfg.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [CARPService] carpserv.exe

O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [EPSON Stylus CX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P26 "EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"

O4 - HKLM\..\Run: [stxTrayMenu] "C:\Program Files\Seagate\SystemTray\StxMenuMgr.exe"

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\Owner\protect.dll,_IWMPEvents@16

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O4 - S-1-5-18 Startup: ChkDisk.lnk = ? (User 'SYSTEM')

O4 - .DEFAULT Startup: ChkDisk.lnk = ? (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Instant Wireless Configuration Utility.lnk = C:\Program Files\Linksys\WPC11 Config Utility\WPC11Cfg.exe

O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1182815036291

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: AutoBackup (BMUService) - Memeo - C:\Program Files\Memeo\AutoBackup\MemeoService.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

--

End of file - 7394 bytes

miekiemoes · May 29, 2009

Hi,

Please download and run WUS_Fix.exe: http://users.telenet.be/marcvn/tools/WUS_Fix.exe

This should restore the default registry settings related with BITS and Automatic updates.

Then, * Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

anonymousrex · May 31, 2009

Much thanks! Here is the log:

ComboFix 09-05-30.06 - Owner 05/31/2009 13:32.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.153 [GMT -5:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\LocalService\protect.dll

c:\documents and settings\Owner\Application Data\wiaserva.log

c:\documents and settings\Owner\protect.dll

c:\documents and settings\Owner\Start Menu\Programs\Startup\ChkDisk.dll

c:\documents and settings\Owner\Start Menu\Programs\Startup\ChkDisk.lnk

c:\program files\ThunMail

c:\program files\ThunMail\testabd.exe

c:\recycled\Recycled

c:\windows\system32\autochk.dll

c:\windows\system32\config\systemprofile\protect.dll

c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\ChkDisk.lnk

c:\windows\system32\drivers\ovfsthqxrllogbaipufgmoosyxjkimsuotoial.sys

c:\windows\system32\drivers\ovfsthqxrllogbaipufgmoosyxjkimsuotoial.sys.rmv

c:\windows\system32\drivers\ovfsthqxrllogbaipufgmoosyxjkimsuotoial.sys.rmv.rmv

c:\windows\system32\lds.exe

c:\windows\system32\lmn_setup.exe

c:\windows\system32\ovfsthbmtmtecpvsucqhpcspyuptddanbfsotp.dll

c:\windows\system32\ovfsthbmtmtecpvsucqhpcspyuptddanbfsotp.dll.rmv.rmv

c:\windows\system32\ovfsthpoeywjwrfsvotnovmkocoqysoanbapes.dat

c:\windows\system32\ovfsthpoeywjwrfsvotnovmkocoqysoanbapes.dat.rmv.rmv

c:\windows\system32\ovfsthqojgxafvsvkoxauiygpldsyjqsdpmmvi.dat

c:\windows\system32\ovfsthqojgxafvsvkoxauiygpldsyjqsdpmmvi.dat.rmv.rmv

c:\windows\system32\ovfsthwwpesuapnpiclhgyxfliiidlqskcyqtq.dll

c:\windows\system32\ovfsthwwpesuapnpiclhgyxfliiidlqskcyqtq.dll.rmv.rmv

c:\windows\system32\ovfsthyeorjlyitvesxqdyvkxpdovwqjmqeyqb.dll

c:\windows\system32\ovfsthyeorjlyitvesxqdyvkxpdovwqjmqeyqb.dll.rmv.rmv

c:\windows\system32\sysloc

c:\recycler\NPROTECT\NPROTECT.LOG . . . . failed to delete

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_ovfsthtgtepvrxdylnyakconmfiohrjnqlbyca

-------\Legacy_AVAST!ANTIVIRUS

((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-31 )))))))))))))))))))))))))))))))

.

2009-05-31 18:26 . 2009-05-31 19:39 344096 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2009-05-31 18:26 . 2009-05-31 19:39 1838624 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-05-29 16:17 . 2009-05-26 09:18 105 ----a-w- C:\tj.vbs

2009-05-29 16:17 . 2009-05-29 16:17 107201 ----a-w- c:\windows\system32\vic_setup.exe

2009-05-29 02:32 . 2009-05-26 18:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-29 02:32 . 2009-05-29 02:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-05-29 02:32 . 2009-05-26 18:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-05-27 19:13 . 2009-05-27 19:13 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe

2009-05-27 19:13 . 2009-05-27 19:13 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys

2009-05-27 19:13 . 2009-05-27 19:13 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys

2009-05-27 18:40 . 2009-05-27 22:22 105395 ----a-w- c:\windows\system32\drivers\klin.dat

2009-05-27 18:40 . 2009-05-27 22:22 94643 ----a-w- c:\windows\system32\drivers\klick.dat

2009-05-27 18:38 . 2009-05-31 19:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2009-05-27 18:38 . 2009-05-27 18:38 -------- d-----w- c:\program files\Kaspersky Lab

2009-05-27 02:11 . 2009-05-27 02:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

2009-05-26 20:53 . 2009-05-27 18:16 180 ----a-w- C:\487656.bat

2009-05-18 14:48 . 2009-05-17 23:28 312088 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avglngx.dll

2009-05-18 14:48 . 2009-05-17 23:28 1437464 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll

2009-05-18 06:25 . 2009-05-18 06:25 2051864 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll

2009-05-18 06:25 . 2009-05-17 23:29 2302232 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll

2009-05-18 06:25 . 2009-05-17 23:29 3399960 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe

2009-05-18 06:25 . 2009-05-17 23:29 3288344 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe

2009-05-18 06:25 . 2009-05-17 23:28 424472 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwdwsc.dll

2009-05-18 06:25 . 2009-05-17 23:29 486168 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe

2009-05-18 06:25 . 2009-05-17 23:28 354584 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgxch32.dll

2009-05-18 06:25 . 2009-05-17 23:28 177432 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmail.dll

2009-05-18 06:25 . 2009-05-17 23:28 1262880 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwd.dll

2009-05-18 06:24 . 2009-05-17 23:28 1083672 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe

2009-05-18 06:24 . 2009-05-17 23:28 755992 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll

2009-05-17 15:42 . 2009-05-17 15:42 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE

2009-05-12 15:26 . 2009-05-12 15:26 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache

2009-05-11 16:12 . 2009-05-11 16:12 -------- d-----w- c:\windows\ie8updates

2009-05-11 16:08 . 2009-05-11 16:10 -------- dc-h--w- c:\windows\ie8

2009-05-11 16:04 . 2009-04-25 05:30 102400 -c----w- c:\windows\system32\dllcache\iecompat.dll

2009-05-07 14:11 . 2009-05-07 14:11 202 ----a-w- C:\43214354.bat

2009-05-06 15:12 . 2009-05-06 15:13 -------- d-----w- c:\program files\Quake

2009-05-05 23:56 . 2009-05-05 23:56 -------- d-----w- c:\program files\CAM Development

2009-05-04 22:42 . 2009-05-04 22:42 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2009-05-02 04:11 . 2009-05-02 04:11 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2009-05-01 21:10 . 2009-05-01 21:10 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-05-01 21:10 . 2009-05-08 14:44 -------- d-----w- c:\program files\SUPERAntiSpyware

2009-05-01 21:10 . 2009-05-08 14:44 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com

2009-05-01 20:50 . 2009-05-01 20:50 -------- d-sh--w- c:\documents and settings\Owner\PrivacIE

2009-05-01 20:21 . 2009-05-01 20:21 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes

2009-05-01 20:20 . 2009-05-01 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-05-01 19:44 . 2009-05-01 19:44 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-31 19:39 . 2009-05-31 18:26 2256 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2009-05-31 19:39 . 2009-05-31 18:26 15444 --sha-w- c:\windows\system32\drivers\fidbox.idx

2009-05-29 23:31 . 2009-04-29 20:15 -------- d-----w- c:\documents and settings\Owner\Application Data\uTorrent

2009-05-29 09:31 . 2005-09-15 00:06 -------- d-----w- c:\program files\Norton SystemWorks

2009-05-27 19:13 . 2008-01-29 22:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys

2009-05-27 18:26 . 2009-04-17 05:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-05-27 02:11 . 2007-06-26 15:07 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-05-27 02:11 . 2007-06-26 15:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-05-21 22:01 . 2008-09-05 01:34 -------- d-----w- c:\program files\VCE3

2009-05-16 18:12 . 2009-03-08 00:45 -------- d-----w- c:\program files\Common Files\DVDVideoSoft

2009-05-08 14:40 . 2007-06-26 14:53 -------- d-----w- c:\program files\Lavasoft

2009-05-08 14:40 . 2007-06-26 14:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-04-30 21:56 . 2009-04-30 21:56 -------- d-----w- c:\documents and settings\Owner\Application Data\AVG8

2009-04-30 00:20 . 2009-04-30 00:20 28320 ----a-w- c:\windows\system32\drivers\kjrxslpo.sys

2009-04-29 20:15 . 2009-04-29 20:15 -------- d-----w- c:\program files\uTorrent

2009-04-19 17:14 . 2009-02-26 05:28 -------- d-----w- c:\program files\Virtual Earth 3D

2009-04-17 14:29 . 2005-09-15 00:05 -------- d-----w- c:\program files\Common Files\Symantec Shared

2009-04-17 05:50 . 2005-09-15 00:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2009-04-17 00:55 . 2009-04-17 00:54 -------- d-----w- c:\program files\TeaTimer (Spybot - Search & Destroy)

2009-04-17 00:55 . 2009-04-17 00:54 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)

2009-04-17 00:54 . 2009-04-17 00:54 -------- d-----w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)

2009-04-17 00:52 . 2009-04-17 00:52 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)

2009-04-16 23:27 . 2009-04-16 23:14 -------- d-----w- c:\program files\Registry Easy

2009-04-15 23:09 . 2009-04-15 23:09 -------- d-----w- c:\documents and settings\Owner\Application Data\WinPatrol

2009-04-11 21:22 . 2009-04-11 21:22 -------- d-----w- c:\program files\Common Files\Vbox

2009-04-11 21:21 . 2009-04-11 21:21 -------- d-----w- c:\program files\Macromedia

2009-04-11 21:21 . 2005-04-10 18:33 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-04-07 03:34 . 2009-04-07 03:31 -------- d-----w- c:\program files\Microsoft Works

2009-04-02 00:38 . 2006-09-14 02:20 -------- d-----w- c:\program files\Java

2009-04-02 00:36 . 2009-04-02 00:36 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

2009-04-02 00:26 . 2009-04-02 00:19 -------- d-----w- c:\program files\Wise Registry Cleaner

2009-03-30 21:14 . 2003-03-19 04:14 499712 ----a-w- c:\windows\system32\msvcp71.dll

2009-03-26 02:05 . 2009-03-26 02:05 390664 ----a-w- c:\documents and settings\Owner\Application Data\Real\RealPlayer\Update\RealPlayer11.exe

2009-03-10 03:54 . 2005-05-22 14:04 71656 -c--a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-03-09 10:19 . 2009-03-05 18:38 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-03-08 09:34 . 2005-04-27 17:54 914944 ----a-w- c:\windows\system32\wininet.dll

2009-03-08 09:34 . 2003-03-31 19:00 43008 ----a-w- c:\windows\system32\licmgr10.dll

2009-03-08 09:33 . 2003-03-31 19:00 18944 ----a-w- c:\windows\system32\corpol.dll

2009-03-08 09:33 . 2003-03-31 19:00 420352 ----a-w- c:\windows\system32\vbscript.dll

2009-03-08 09:32 . 2003-03-31 19:00 72704 ----a-w- c:\windows\system32\admparse.dll

2009-03-08 09:32 . 2003-03-31 19:00 71680 ----a-w- c:\windows\system32\iesetup.dll

2009-03-08 09:31 . 2003-03-31 19:00 34816 ----a-w- c:\windows\system32\imgutil.dll

2009-03-08 09:31 . 2003-03-31 19:00 48128 ----a-w- c:\windows\system32\mshtmler.dll

2009-03-08 09:31 . 2003-03-31 19:00 45568 ----a-w- c:\windows\system32\mshta.exe

2009-03-08 09:22 . 2003-03-31 19:00 156160 ----a-w- c:\windows\system32\msls31.dll

2009-03-06 14:22 . 2003-03-31 19:00 284160 ----a-w- c:\windows\system32\pdh.dll

2009-03-05 18:38 . 2009-03-05 18:38 503808 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-5d427480-n\msvcp71.dll

2009-03-05 18:38 . 2009-03-05 18:38 499712 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-5d427480-n\jmc.dll

2009-03-05 18:38 . 2009-03-05 18:38 348160 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-5d427480-n\msvcr71.dll

2009-03-05 18:36 . 2009-03-05 18:36 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_12\lzma.dll

2005-09-15 00:08 . 2005-09-15 00:08 32 -csha-w- c:\windows\{2D92D7DC-5B35-4D32-B3E8-E804DEA0B192}.dat

2005-09-15 00:09 . 2005-09-15 00:09 32 --sha-w- c:\windows\{877424D6-FEE6-4FDE-9D4D-E8B5F2F610A9}.dat

2005-09-15 00:08 . 2005-09-15 00:08 32 -csha-w- c:\windows\{8EEB6B91-D905-4C83-BCA0-B80431F84DE2}.dat

2005-09-15 00:08 . 2005-09-15 00:08 32 -csha-w- c:\windows\system32\{919AE528-3D80-45FC-92CF-B9B53178B526}.dat

2005-09-15 00:08 . 2005-09-15 00:08 32 -csha-w- c:\windows\system32\{B45A4985-AB5F-42D1-9D9C-07688BE9BD49}.dat

2005-09-15 00:09 . 2005-09-15 00:09 32 -csha-w- c:\windows\system32\{C105DA0E-16BB-45F1-BA57-1535393E91A3}.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QT4HPOT"="c:\program files\HPQ\One-Touch\OneTouch.EXE" [2003-10-03 102400]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-05-22 110592]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-05-22 610304]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696]

"EPSON Stylus CX3800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE" [2005-02-08 98304]

"StxTrayMenu"="c:\program files\Seagate\SystemTray\StxMenuMgr.exe" [2007-01-04 187496]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-30 198160]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-05-27 206088]

"CARPService"="carpserv.exe" - c:\windows\system32\carpserv.exe [2003-05-21 4608]

"ATIModeChange"="Ati2mdxx.exe" - c:\windows\system32\Ati2mdxx.exe [2001-09-04 28672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

Instant Wireless Configuration Utility.lnk - c:\program files\Linksys\WPC11 Config Utility\WPC11Cfg.exe [2005-4-18 180224]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32

"wave1"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS3\\Dreamweaver.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\ICQ6\\ICQ.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 5:29 PM 33808]

R2 NProtectService;Norton Unerase Protection;c:\program files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE [9/14/2005 7:07 PM 135168]

R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\alifir.sys [4/10/2005 5:55 AM 26624]

R3 CALIAUD;Conexant AMC 3D Environmental Audio;c:\windows\system32\drivers\caliaud.sys [2/17/2004 5:58 PM 292352]

R3 CALIHALA;CALIHALA;c:\windows\system32\drivers\calihal.sys [2/17/2004 5:59 PM 273536]

R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [3/13/2008 6:02 PM 26640]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [4/30/2008 5:06 PM 24592]

S1 gvnfwpuw;gvnfwpuw;\??\c:\windows\system32\drivers\gvnfwpuw.sys --> c:\windows\system32\drivers\gvnfwpuw.sys [?]

S1 hehqlbez;hehqlbez;\??\c:\windows\system32\drivers\hehqlbez.sys --> c:\windows\system32\drivers\hehqlbez.sys [?]

S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\progra~1\Belkin\BELKIN~1.11G\DNINDIS5.SYS [7/8/2008 5:07 PM 17149]

S3 DP83815;National Semiconductor Corp. DP83815 NDIS 5.0 Miniport Driver;c:\windows\system32\drivers\DP83815.sys [5/20/2002 11:51 AM 16064]

S3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\DRIVERS\RT2860.sys --> c:\windows\system32\DRIVERS\RT2860.sys [?]

S3 UXDCMN;UXDCMN;\??\d:\uxdcmn.sys --> d:\UXDCMN.SYS [?]

S3 WPC11;Instant Wireless Network PC Card V3.0 Driver;c:\windows\system32\drivers\LSWLNDS.sys [4/18/2005 11:43 PM 54083]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - PCANDIS5

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-05-29 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job

- c:\program files\Norton SystemWorks\OBC.exe [2002-08-30 03:57]

2009-05-14 c:\windows\Tasks\Schedule Task Weekly.job

- c:\program files\Registry Easy\RE.exe [2009-04-16 00:08]

.

- - - - ORPHANS REMOVED - - - -

HKU-Default-Run-autochk - c:\docume~1\LOCALS~1\protect.dll

SafeBoot-procexp90.Sys

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\l10hveag.default\

FF - prefs.js: browser.startup.homepage - hxxp://cm.my.yahoo.com

FF - prefs.js: network.proxy.http - localhost

FF - prefs.js: network.proxy.http_port - 7171

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll

FF - plugin: c:\windows\system32\C2MP\npdivx32.dll

FF - plugin: c:\windows\system32\npmirage.dll

FF - plugin: c:\windows\system32\NPSWF32.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-31 14:43

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,34,da,52,7f,f0,d8,94,4a,99,83,36,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,34,da,52,7f,f0,d8,94,4a,99,83,36,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]

@DACL=(02 0000)

"Installed"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]

@DACL=(02 0000)

"Installed"="1"

"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

@DACL=(02 0000)

"Installed"="1"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1760)

c:\windows\system32\SynTPFcs.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\OneX.DLL

c:\windows\system32\eappprxy.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-05-31 14:51 - machine was rebooted

ComboFix-quarantined-files.txt 2009-05-31 19:51

Pre-Run: 30,417,883,136 bytes free

Post-Run: 30,279,974,912 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

300 --- E O F --- 2009-05-25 17:35

miekiemoes · June 1, 2009

Hi,

What a mess...

* Open notepad - don't use any other texteditor than notepad or the script will fail.

Copy/paste the text in the quotebox below into notepad:

File::
C:\tj.vbs
c:\windows\system32\vic_setup.exe
C:\487656.bat
C:\43214354.bat
Firefox::
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\l10hveag.default\
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
Driver::
hehqlbez
gvnfwpuw

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

anonymousrex · June 1, 2009

I don't know if this matters or not, but during this last execution of combofix, I was asked if I wanted to update. I clicked Yes.

Also, the 'ComboFix' command prompt window is still opened (even after the log was generated) and the last line says "Could not find c:/windows/system32/drivers/combo-fix.sys". I will go ahead and close this window since there doesn't appear to be any more activity.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------

ComboFix 09-05-31.02 - Owner 05/31/2009 20:28.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.271 [GMT -5:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

* Created a new restore point

FILE ::

"C:\43214354.bat"

"C:\487656.bat"

"C:\tj.vbs"

"c:\windows\system32\vic_setup.exe"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\43214354.bat

C:\487656.bat

C:\tj.vbs

c:\windows\system32\vic_setup.exe

c:\recycler\NPROTECT\NPROTECT.LOG . . . . failed to delete

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_gvnfwpuw

-------\Service_hehqlbez

((((((((((((((((((((((((( Files Created from 2009-05-01 to 2009-06-01 )))))))))))))))))))))))))))))))

.

2009-05-31 18:26 . 2009-06-01 01:41 1935392 --sha-w- c:\windows\system32\drivers\fidbox.dat

2009-05-31 18:26 . 2009-06-01 01:40 368672 --sha-w- c:\windows\system32\drivers\fidbox2.dat