Personal Guard 2009 Has Got me Bad

bobsmg · November 4, 2009

Personal Guard is having it's way with me. I can't get Malware to run (and I can't get Safe Mode to run either), but have the Hijack this log:

Please help!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:10:08 PM, on 11/3/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe

C:\Program Files\Windows Media Player\WMPNetwk.exe

C:\WINDOWS\System32\alg.exe

C:\windows\system\hpsysdrv.exe

C:\Program Files\Personal Guard 2009\personalguard.exe

C:\WINDOWS\system32\winsc.exe

C:\HP\KBD\KBD.EXE

C:\Program Files\Yahoo!\browser\ybrwicon.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\ATI Multimedia\main\ATIDtct.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Electronic Arts\EADM\Core.exe

C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe

C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPMAIN.EXE

C:\Program Files\Qlock\qlock.exe

C:\WINDOWS\System32\rundll32.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\PROGRA~1\Yahoo!\browser\ycommon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

F2 - REG:system.ini: Shell=Explorer.exe logon.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll

O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY

O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [kujavefik] Rundll32.exe "c:\windows\system32\yaveyayu.dll",a

O4 - HKLM\..\Run: [personalguard] C:\Program Files\Personal Guard 2009\personalguard.exe

O4 - HKCU\..\Run: [jobexec] C:\WINDOWS\System32\jobexec.exe

O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcStd7_0_8 -reboot 1

O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent

O4 - HKCU\..\Run: [search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - Startup: qlock.lnk = C:\Program Files\Qlock\qlock.exe

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPMAIN.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\JavaSoft\JRE\1.3.1_04\bin\npjava131_04.dll (file missing)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\JavaSoft\JRE\1.3.1_04\bin\npjava131_04.dll (file missing)

O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll

O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll

O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll

O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://www.brownpapertickets.com

O15 - Trusted Zone: *.intuit.com

O15 - Trusted Zone: http://*.turbotax.com

O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll

O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.ipswitch.com/_installs/wsftp_le/setup.exe

O16 - DPF: {53C9A69F-A62B-4A09-9B04-F7395682B3AF} (WebTransferCtrl Class) - https://worksite.pillsburylaw.com/WorkSite/...es/iManFile.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1408.g.akamai.net/7/1408/9955/2003...iTunesSetup.exe

O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab

O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._1/axofupld.cab

O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://tsweb.haas.berkeley.edu/msrdp.cab

O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://tsweb.haas.berkeley.edu/msrdp.cab

O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/...ropper1_1us.cab

O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://pillsburylaw.webex.com/client/T26L/webex/ieatgpc.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL liferazi.dll c:\windows\system32\yaveyayu.dll

O21 - SSODL: SysNet - {235AAC05-FA55-4646-A2CA-82397C8CD6D8} - C:\Documents and Settings\All Users\Microsoft AData\sysnet.dll

O21 - SSODL: zozusopoh - {4d9dd172-9ffd-4fdb-b2e1-6236136b3fcf} - c:\windows\system32\yaveyayu.dll

O22 - SharedTaskScheduler: jugezatag - {4d9dd172-9ffd-4fdb-b2e1-6236136b3fcf} - c:\windows\system32\yaveyayu.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Update Service (gupdate1c9106f549cdb70) (gupdate1c9106f549cdb70) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

--

End of file - 18189 bytes

chamber · November 4, 2009

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link HERE
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

bobsmg · November 4, 2009

Hello!

Thanks..below is the log from Combofix:

ComboFix 09-11-03.03 - Administrator 11/04/2009 7:40.1.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1118 [GMT -8:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrator\Desktop\Personal Guard 2009.lnk

c:\documents and settings\Administrator\Start Menu\Programs\Personal Guard 2009

c:\documents and settings\Administrator\Start Menu\Programs\Personal Guard 2009\Personal Guard 2009.lnk

c:\documents and settings\Administrator\Start Menu\Programs\Personal Guard 2009\Uninstall.lnk

c:\documents and settings\All Users\Microsoft AData

c:\documents and settings\All Users\Microsoft AData\setup.exe

c:\documents and settings\All Users\Microsoft AData\sysnet.dll

c:\documents and settings\All Users\Microsoft AData\t.sid

c:\program files\INSTALL.LOG

c:\program files\Personal Guard 2009

c:\program files\Personal Guard 2009\config.scf

c:\program files\Personal Guard 2009\mmbase.sdb

c:\program files\Personal Guard 2009\personalguard.exe

c:\program files\Personal Guard 2009\q.sdb

c:\program files\Personal Guard 2009\queue.sdb

c:\program files\Personal Guard 2009\uninstalls.exe

c:\program files\Personal Guard 2009\vvbase.sdb

c:\windows\Downloaded Program Files\setup.dll

c:\windows\Fonts\acrsec.fon

c:\windows\Fonts\acrsecB.fon

c:\windows\Fonts\acrsecI.fon

c:\windows\microsoftdef.dll

c:\windows\system32\dagetowa.dll

c:\windows\system32\demozela.dll.tmp

c:\windows\system32\fodedozu.dll

c:\windows\system32\fopiyora.dll

c:\windows\system32\gayiloba.dll

c:\windows\system32\hasabasi.dll

c:\windows\system32\hiduvudi.dll

c:\windows\system32\iAlmcoin.dll

c:\windows\system32\jupabone.dll

c:\windows\system32\liferazi.dll

c:\windows\system32\logon.exe

c:\windows\system32\lowsec

c:\windows\system32\lowsec\local.ds

c:\windows\system32\lowsec\user.ds

c:\windows\system32\pibijego.dll.tmp

c:\windows\system32\ps2.bat

c:\windows\system32\sdra64.exe

c:\windows\system32\sokolofi.dll.tmp

c:\windows\system32\tanovivo.dll

c:\windows\system32\tijayefe.dll

c:\windows\system32\vabewuze.dll

c:\windows\system32\wogeyabo.dll

c:\windows\system32\zarojeho.dll

c:\windows\Tasks\oyallxvz.job

D:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2009-10-04 to 2009-11-04 )))))))))))))))))))))))))))))))

.

2009-11-04 04:04 . 2009-11-04 04:04 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp

2009-11-04 00:49 . 2009-11-04 00:49 -------- d-----w- c:\program files\Trend Micro

2009-11-03 23:36 . 2009-11-04 00:46 -------- d-----w- c:\program files\Malwarebytes AntiMalware

2009-11-03 22:58 . 2009-11-03 22:58 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2009-11-03 16:19 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-03 16:19 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-03 14:50 . 2009-11-03 14:50 114 ---ha-w- C:\aaw7boot.cmd

2009-11-03 07:02 . 2009-11-03 07:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-11-03 06:57 . 2009-11-04 00:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-03 06:57 . 2009-11-03 06:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-11-03 06:06 . 2008-12-11 16:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2009-11-03 06:05 . 2009-08-24 22:05 206256 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2009-11-03 06:05 . 2009-08-19 19:01 86888 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2009-11-03 06:05 . 2009-11-03 06:09 -------- d-----w- c:\program files\Common Files\PC Tools

2009-11-03 06:04 . 2008-12-10 19:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2009-11-03 06:04 . 2009-11-03 06:51 -------- d-----w- c:\program files\Spyware Doctor

2009-11-03 06:04 . 2009-11-03 06:04 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2009-11-03 06:04 . 2009-11-03 06:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools

2009-11-03 06:04 . 2009-11-03 06:59 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-11-03 05:53 . 2009-11-03 05:53 -------- d-----w- c:\program files\Windows Defender

2009-11-03 01:09 . 2009-11-03 15:16 38352 ----a-w- c:\windows\regred.exe

2009-11-03 01:09 . 2009-11-03 15:16 33149 ----a-w- c:\windows\usexplorer.exe

2009-11-03 01:09 . 2009-11-03 15:16 47872 ----a-w- c:\windows\certsystem.exe

2009-11-03 01:09 . 2009-11-03 15:16 51197 ----a-w- c:\windows\spoov.exe

2009-11-02 15:56 . 2009-11-02 15:56 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2009-11-02 15:52 . 2009-11-03 14:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-11-02 06:11 . 2009-11-04 01:19 -------- d-----w- c:\program files\Norton Internet Security

2009-11-02 06:06 . 2009-11-02 14:58 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL

2009-11-02 06:06 . 2009-11-02 14:58 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2009-11-02 06:02 . 2009-11-02 14:58 -------- d-----w- c:\program files\Symantec

2009-11-01 01:45 . 2009-11-01 01:45 382976 ----a-w- c:\windows\system32\winsc.exe

2009-11-01 01:45 . 2009-11-03 15:16 28320 ----a-w- c:\windows\securits.com

2009-10-26 16:00 . 2009-10-26 16:00 -------- d-----w- c:\windows\system32\scripting

2009-10-26 16:00 . 2009-10-26 16:00 -------- d-----w- c:\windows\l2schemas

2009-10-26 16:00 . 2009-10-26 16:00 -------- d-----w- c:\windows\system32\en

2009-10-23 17:10 . 2009-10-23 17:10 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2009-10-23 16:40 . 2009-10-23 16:40 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2009-10-23 16:40 . 2009-10-23 16:40 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2009-10-23 16:40 . 2009-10-23 16:40 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2009-10-23 16:21 . 2009-08-29 08:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2009-10-23 16:21 . 2009-08-29 08:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2009-10-23 16:20 . 2009-10-24 10:01 -------- d-----w- c:\windows\ie8updates

2009-10-23 16:19 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll

2009-10-23 16:17 . 2009-10-23 16:18 -------- dc-h--w- c:\windows\ie8

2009-10-19 01:39 . 2009-10-19 01:39 -------- d--h--w- c:\windows\PIF

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-04 16:10 . 2007-05-21 00:38 -------- d-----w- c:\program files\Common Files\Symantec Shared

2009-11-04 04:08 . 2003-09-24 01:57 -------- d-----w- c:\program files\Google

2009-11-04 01:26 . 2003-04-24 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2009-11-02 14:58 . 2009-11-02 14:49 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF

2009-11-02 14:58 . 2009-11-02 14:49 10635 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT

2009-10-22 10:11 . 2004-12-30 05:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype

2009-10-21 23:00 . 2007-12-02 18:45 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM

2009-10-19 02:08 . 2009-05-13 03:59 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent

2009-09-26 22:07 . 2009-09-26 22:05 -------- d-----w- c:\program files\iTunes

2009-09-26 22:05 . 2004-05-01 06:29 -------- d-----w- c:\program files\iPod

2009-09-26 22:05 . 2007-07-27 04:54 -------- d-----w- c:\program files\Common Files\Apple

2009-09-18 04:56 . 2009-09-18 04:56 51580 ---ha-w- c:\windows\system32\mlfcache.dat

2009-09-16 04:30 . 2003-12-20 22:59 -------- d-----w- c:\documents and settings\Administrator\Application Data\Apple Computer

2009-09-15 05:31 . 2009-09-15 05:31 -------- d-----w- c:\program files\iPhone Configuration Utility

2009-09-15 05:29 . 2009-09-15 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2009-09-15 05:25 . 2006-01-23 06:28 -------- d-----w- c:\program files\QuickTime

2009-09-15 03:24 . 2009-09-15 03:24 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys

2009-09-15 03:24 . 2009-09-15 03:24 -------- d-----w- c:\program files\Linksys Wireless-G PCI Wireless Network Monitor

2009-09-15 03:24 . 2003-04-24 15:18 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-09-11 14:18 . 2003-07-15 21:23 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-09-11 03:35 . 2009-09-11 03:35 -------- d-----w- c:\program files\Telltale Games

2009-09-04 21:03 . 2003-07-15 21:23 58880 ----a-w- c:\windows\system32\msasn1.dll

2009-08-29 08:08 . 2006-06-23 19:33 916480 ----a-w- c:\windows\system32\wininet.dll

2009-08-29 02:42 . 2008-09-11 22:11 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll

2009-08-29 02:42 . 2007-09-15 03:36 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2009-08-26 08:00 . 2003-07-15 20:58 247326 ----a-w- c:\windows\system32\strmdll.dll

2009-08-07 02:24 . 2006-08-08 05:39 327896 ----a-w- c:\windows\system32\wucltui.dll

2009-08-07 02:24 . 2006-08-08 05:39 209632 ----a-w- c:\windows\system32\wuweb.dll

2009-08-07 02:24 . 2006-08-08 05:39 35552 ----a-w- c:\windows\system32\wups.dll

2009-08-07 02:24 . 2005-05-26 11:16 44768 ----a-w- c:\windows\system32\wups2.dll

2009-08-07 02:24 . 2003-07-15 20:59 53472 ----a-w- c:\windows\system32\wuauclt.exe

2009-08-07 02:24 . 2003-07-15 21:17 96480 ----a-w- c:\windows\system32\cdm.dll

2009-08-07 02:23 . 2006-08-08 05:39 575704 ----a-w- c:\windows\system32\wuapi.dll

2009-08-07 02:23 . 2003-07-15 20:59 1929952 ----a-w- c:\windows\system32\wuaueng.dll

2008-09-03 14:51 . 2007-05-16 04:53 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

2009-08-02 13:50 . 2009-08-02 13:50 60928 --sha-w- c:\windows\system32\guyetisu.dll

2009-08-01 13:49 . 2009-08-01 13:49 52224 --sha-w- c:\windows\system32\naveriju.dll

2009-08-01 13:50 . 2009-08-01 13:50 52224 --sha-w- c:\windows\system32\povehana.dll

2009-08-04 01:50 . 2009-08-04 01:50 89088 --sha-w- c:\windows\system32\wahewozi.dll

2009-08-03 13:50 . 2009-08-03 13:50 89088 --sha-w- c:\windows\system32\yaveyayu.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87cfbaa5-068c-4f4c-9888-872ef576b65f}]

2009-08-01 13:50 52224 --sha-w- c:\windows\system32\povehana.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ATI Remote Control"="c:\program files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-04-16 196608]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856]

"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" [2006-03-30 313472]

"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-09-03 3342336]

"Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-10 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]

"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-03-12 114688]

"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]

"PS2"="c:\windows\system32\ps2.exe" [2002-08-01 81920]

"YBrowser"="c:\program files\Yahoo!\browser\ybrwicon.exe" [2003-07-11 57344]

"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-13 483328]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-03 29744]

"ATI DeviceDetect"="c:\program files\ATI Multimedia\main\ATIDtct.EXE" [2004-06-16 69705]

"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 84640]

"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-09-06 26248]

"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-30 583048]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]

"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\

qlock.lnk - c:\program files\Qlock\qlock.exe [2005-3-14 1468928]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-BA7E-000000000002}\SC_Acrobat.exe [2005-10-22 25214]

EPSON SMART PANEL for Scanner.lnk - c:\program files\EPSON\EPSON SMART PANEL for Scanner\ESPMAIN.EXE [2003-11-22 180224]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YPager.exe"=

"c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [11/2/2009 10:05 PM 206256]

R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 11:03 AM 169312]

R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]

R2 RioPNP;RioPNP;c:\windows\system32\drivers\RioPnP.sys [10/21/2003 7:31 AM 6736]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/1/2009 10:20 PM 99176]

S0 szkg5;szkg;c:\windows\system32\DRIVERS\szkg.sys --> c:\windows\system32\DRIVERS\szkg.sys [?]

S2 gupdate1c9106f549cdb70;Google Update Service (gupdate1c9106f549cdb70);c:\program files\Google\Update\GoogleUpdate.exe [9/6/2008 2:24 PM 133104]

S2 RIOUSB;RioPort.Com Rio500 USB Driver;c:\windows\system32\drivers\RioUsb.sys [10/21/2003 7:18 AM 10020]

S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [6/10/2006 8:27 AM 29744]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [11/2/2009 10:04 PM 348752]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

*NewlyCreated* - MBR

*Deregistered* - mbr

.

Contents of the 'Scheduled Tasks' folder

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2008-09-06 22:23]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2008-09-06 22:23]

2009-11-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2812118526-93401058-2379829806-500Core.job

- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-30 23:13]

2009-11-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2812118526-93401058-2379829806-500UA.job

- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-30 23:13]

2009-11-02 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Administrator.job

- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-09-07 05:38]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uDefault_Search_URL = hxxp://srch-qus8.hpwis.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uInternet Settings,ProxyOverride = localhost;*.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm

IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm

IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycdict.htm

Trusted Zone: brownpapertickets.com\www

Trusted Zone: intuit.com

Trusted Zone: turbotax.com

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: {53C9A69F-A62B-4A09-9B04-F7395682B3AF} - hxxps://worksite.pillsburylaw.com/WorkSite/includes/iManFile.cab

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\zyml2zxq.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\zyml2zxq.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll

FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\zyml2zxq.default\extensions\kodak-companion@mozilla.com\platform\WINNT_x86-msvc\components\mozFotofox.dll

FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll

FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava11.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava12.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava13.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava14.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJava32.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPJPI150_03.dll

FF - plugin: c:\program files\Java\jre1.5.0_03\bin\NPOJI610.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll

FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll

FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-jobexec - c:\windows\System32\jobexec.exe

HKCU-Run-Search Protection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe

HKCU-Run-ATI Launchpad - (no file)

HKLM-Run-PRISMSVR.EXE - c:\windows\System32\PRISMSVR.EXE

HKLM-Run-kujavefik - c:\windows\system32\fodedozu.dll

HKLM-Run-nidadoyudi - hiduvudi.dll

SharedTaskScheduler-{b80c7ef4-a34d-47f6-b20e-15ccfb30ee0d} - c:\windows\system32\fodedozu.dll

SSODL-SysNet-{235AAC05-FA55-4646-A2CA-82397C8CD6D8} - c:\documents and settings\All Users\Microsoft AData\sysnet.dll

SSODL-zeyuwawir-{b80c7ef4-a34d-47f6-b20e-15ccfb30ee0d} - c:\windows\system32\fodedozu.dll

AddRemove-Malwarebytes' Anti-Malware_is1 - c:\program files\dave\unins000.exe

AddRemove-SBC Yahoo! UMUninstaller - c:\program files\SBC Yahoo!\umuninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-04 08:11

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2812118526-93401058-2379829806-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ba,1d,eb,4c,0c,48,ac,44,ba,7b,99,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ba,1d,eb,4c,0c,48,ac,44,ba,7b,99,\

[HKEY_USERS\S-1-5-21-2812118526-93401058-2379829806-500\Software\SecuROM\License information*]

"datasecu"=hex:49,ec,ea,a4,0e,09,50,56,63,22,98,6e,90,50,1d,f0,23,c3,40,a7,21,

f4,1a,55,9b,2c,21,b8,8b,0e,32,df,29,2f,af,39,8b,f0,8a,bd,66,5f,14,ff,ca,e3,\

"rkeysecu"=hex:fa,de,aa,8d,fd,91,9b,db,ef,64,66,f1,8c,35,40,be

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(580)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2112)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\System32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Symantec Shared\ccSvcHst.exe

c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe

c:\program files\Windows Media Player\WMPNetwk.exe

c:\progra~1\Yahoo!\browser\ycommon.exe

c:\program files\ATI Technologies\ATI.ACE\CLI.EXE

c:\windows\System32\rundll32.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\ATI Technologies\ATI.ACE\cli.exe

.

**************************************************************************

.

Completion time: 2009-11-04 8:27 - machine was rebooted

ComboFix-quarantined-files.txt 2009-11-04 16:27

Pre-Run: 2,385,465,344 bytes free

Post-Run: 4,527,882,240 bytes free

Download ComboFix from one of these locations:
Link 1
Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link HERE
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

chamber · November 4, 2009

Hi,

1) CFScript

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\system32\guyetisu.dll
c:\windows\system32\naveriju.dll
c:\windows\system32\povehana.dll
c:\windows\system32\wahewozi.dll
c:\windows\system32\yaveyayu.dll
Folder::
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87cfbaa5-068c-4f4c-9888-872ef576b65f}]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\DNA\\btdna.exe"=-
"c:\\Program Files\\uTorrent\\uTorrent.exe"=-
Driver::

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

2) OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
%SYSTEMDRIVE%\eventlog.dll /s /md5
%SYSTEMDRIVE%\scecli.dll /s /md5
%SYSTEMDRIVE%\netlogon.dll /s /md5
%SYSTEMDRIVE%\cngaudit.dll /s /md5
%SYSTEMDRIVE%\sceclt.dll /s /md5
%SYSTEMDRIVE%\ntelogon.dll /s /md5
%SYSTEMDRIVE%\logevent.dll /s /md5
%SYSTEMDRIVE%\iaStor.sys /s /md5
%SYSTEMDRIVE%\nvstor.sys /s /md5
%SYSTEMDRIVE%\atapi.sys /s /md5
%SYSTEMDRIVE%\IdeChnDr.sys /s /md5
%SYSTEMDRIVE%\viasraid.sys /s /md5
%SYSTEMDRIVE%\AGP440.sys /s /md5
%SYSTEMDRIVE%\vaxscsi.sys /s /md5
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

In your reply I would like to see copied and pasted,

1) ComboFix log

2) OTL logs

bobsmg · November 5, 2009

Ok, here is the 2nd ComboFix log; next post will include the OTL logs.

ComboFix 09-11-03.03 - Administrator 11/04/2009 20:12.2.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.985 [GMT -8:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

FILE ::

"c:\windows\system32\guyetisu.dll"

"c:\windows\system32\naveriju.dll"

"c:\windows\system32\povehana.dll"

"c:\windows\system32\wahewozi.dll"

"c:\windows\system32\yaveyayu.dll"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\guyetisu.dll

c:\windows\system32\naveriju.dll

c:\windows\system32\povehana.dll

c:\windows\system32\wahewozi.dll

c:\windows\system32\yaveyayu.dll

.

((((((((((((((((((((((((( Files Created from 2009-10-05 to 2009-11-05 )))))))))))))))))))))))))))))))