Another Goggle Redirect Virus Thread

jmvar · March 28, 2011

Hi, I have read several of these threads and tried to get a jump start.

Here is my log from my quick scan:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6199

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

3/28/2011 4:48:36 PM

mbam-log-2011-03-28 (16-48-36).txt

Scan type: Quick scan

Objects scanned: 177586

Time elapsed: 7 minute(s), 2 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

-------------------------------------------------------------------------

These are my logs from DDS:

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Julio at 16:53:09.31 on Mon 03/28/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.901 [GMT -4:00]

.

AV: Norton AntiVirus 2005 *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Worm Protection *Disabled*

.

============== Running Processes ===============

.

C:\Program Files\Common Files\Virtual Token\vtserver.exe

C:\WINDOWS\system32\ibmpmsvc.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\Explorer.EXE

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

svchost.exe 4

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe 4

svchost.exe

C:\Program Files\Common Files\Apricorn\Schedule2\schedul2.exe

C:\WINDOWS\System32\svchost.exe -k Akamai

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe

C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe

c:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\iDumpPro\NMSAccessU.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

C:\WINDOWS\System32\QCONSVC.EXE

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\Program Files\VERIZONDM\bin\sprtsvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\VERIZONDM\bin\tgsrvc.exe

C:\WINDOWS\System32\TPHDEXLG.EXE

C:\WINDOWS\system32\TpKmpSVC.exe

C:\Program Files\TVersity\Media Server\MediaServer.exe

c:\WINDOWS\system32\ZuneBusEnum.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\TpShocks.exe

C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.EXE

C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\IBM\Messages By IBM\ibmmessages.exe

C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe

C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\IBMTOOLS\UTILS\ibmprc.exe

C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Apricorn\EZ Gig II\EZGigMonitor.exe

C:\Program Files\Apricorn\EZ Gig II\TimounterMonitor.exe

C:\Program Files\Common Files\Apricorn\Schedule2\schedhlp.exe

C:\Program Files\Zune\ZuneLauncher.exe

C:\Program Files\Verizon\McciTrayApp.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\MediaMall\MediaMallServer.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\MediaMall\MediaMallServer.exe

C:\Program Files\Java\jre6\bin\jucheck.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Julio\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Documents and Settings\Julio\My Documents\Downloads\dds.scr

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: CNavExtBho Class: {bdf3e430-b101-42ad-a544-fadc6b084872} - c:\program files\norton antivirus\NavShExt.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Norton AntiVirus: {42cdd1bf-3ffb-4238-8ad1-7859df00b1d6} - c:\program files\norton antivirus\NavShExt.dll

uRun: [uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\RegistryBooster.exe /S

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [ibmmessages] c:\program files\ibm\messages by ibm\ibmmessages.exe

uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\Wcescomm.exe"

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uRun: [Google Update] "c:\documents and settings\julio\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

mRun: [synTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [TPKMAPHELPER] c:\program files\thinkpad\utilities\TpKmapAp.exe -helper

mRun: [TpShocks] TpShocks.exe

mRun: [TPHOTKEY] c:\progra~1\thinkpad\pkgmgr\hotkey\TPHKMGR.exe

mRun: [ControlCenter] "c:\program files\ibm fingerprint software\ctlcntr.exe" /startup

mRun: [TP4EX] tp4ex.exe

mRun: [EZEJMNAP] c:\progra~1\thinkpad\utilit~1\EzEjMnAp.Exe

mRun: [soundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe

mRun: [soundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray

mRun: [updateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r

mRun: [dla] c:\windows\system32\dla\tfswctrl.exe

mRun: [<NO NAME>]

mRun: [ibmmessages] c:\program files\ibm\messages by ibm\\ibmmessages.exe

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [iBMPRC] c:\ibmtools\utils\ibmprc.exe

mRun: [QCWLICON] c:\program files\thinkpad\connectutilities\QCWLICON.EXE

mRun: [PWRMGRTR] rundll32 c:\progra~1\thinkpad\utilit~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor

mRun: [bLOG] rundll32 c:\progra~1\thinkpad\utilit~1\BatLogEx.DLL,StartBattLog

mRun: [symantec NetDriver Monitor] c:\progra~1\symnet~1\SNDMon.exe /Consumer

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [EZGigMonitor.exe] c:\program files\apricorn\ez gig ii\EZGigMonitor.exe

mRun: [AcronisTimounterMonitor] c:\program files\apricorn\ez gig ii\TimounterMonitor.exe

mRun: [Apricorn Scheduler Service] "c:\program files\common files\apricorn\schedule2\schedhlp.exe"

mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"

mRun: [VERIZONDM] "c:\program files\verizondm\bin\sprtcmd.exe" /P VERIZONDM

mRun: [Verizon_McciTrayApp] "c:\program files\verizon\McciTrayApp.exe"

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [updatePDRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\9.0"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - c:\program files\lenovo\pkgmgr\\PkgMgr.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll

Trusted Zone: aol.com\free

DPF: {44C1E3A2-B594-401C-B27A-D1B4476E4797} - hxxps://68.164.31.203/XTSAC.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1245079895000

DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} - hxxps://68.164.31.203/msrdp.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.4.2/jinstall-142-win.cab

DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

TCP: NameServer = 208.67.220.220,208.67.222.222

TCP: {4A252C32-6BD2-41D4-B49E-0D2EF0DEA045} = 208.67.220.220,208.67.222.222

TCP: {DDE5750D-32D8-47F2-8870-086BD3EFA670} = 208.67.220.220,208.67.222.222

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll

Notify: igfxcui - igfxsrvc.dll

Notify: psfus - c:\program files\ibm fingerprint software\psfus.dll

Notify: QConGina - QConGina.dll

Notify: tphotkey - tphklock.dll

AppInit_DLLs: c:\docume~1\julio\locals~1\temp\201350xxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

LSA: Authentication Packages = msv1_0 relog_ap

LSA: Notification Packages = scecli pwdmon

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\julio\applic~1\mozilla\firefox\profiles\fihpp3jb.default\

FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl&ltmpl=default&ltmplcache=2

FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll

FF - plugin: c:\documents and settings\julio\application data\mozilla\firefox\profiles\fihpp3jb.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000006.dll

FF - plugin: c:\documents and settings\julio\application data\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\julio\application data\mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\documents and settings\julio\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\common files\motive\npMotive.dll

FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll

FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\picasa2\npPicasa3.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Unsorted Bookmarks Folder Menu: UnsortedBookmarksMenu@alice - %profile%\extensions\UnsortedBookmarksMenu@alice

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

.

============= SERVICES / DRIVERS ===============

.

R0 TPDiskPM;TPDiskPM;c:\windows\system32\drivers\TPDiskPM.sys [2006-8-11 14208]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 66632]

R1 SAVRTPEL;SAVRTPEL;c:\program files\norton antivirus\SAVRTPEL.SYS [2004-7-23 50312]

R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [1980-1-1 14336]

R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\CCSETMGR.EXE [2004-8-13 181920]

R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\verizon\iha_messagecenter\bin\Verizon_IHAMessageCenter.exe [2010-10-13 98304]

R2 MediaMall Server;MediaMall Server;c:\program files\mediamall\MediaMallServer.exe [2011-1-29 3999600]

R2 navapsvc;Norton AntiVirus Auto-Protect Service;c:\program files\norton antivirus\NAVAPSVC.EXE [2004-8-18 177264]

R2 SBKUPNT;SBKUPNT;c:\windows\system32\drivers\SBKUPNT.SYS [2011-2-2 14976]

R2 SmiHlp;SMI helper driver;c:\program files\ibm fingerprint software\smihlp.sys [2005-4-12 3328]

R2 sprtsvc_verizondm;SupportSoft Sprocket Service (verizondm);c:\program files\verizondm\bin\sprtsvc.exe [2010-9-2 206120]

R2 tgsrvc_verizondm;SupportSoft Repair Service (verizondm);c:\program files\verizondm\bin\tgsrvc.exe [2010-9-2 185640]

R3 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\CCEVTMGR.EXE [2004-8-13 198304]

R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20061122.019\NAVENG.Sys [2006-11-24 79240]

R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20061122.019\NavEx15.Sys [2006-11-24 831880]

R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872]

R3 SAVRT;SAVRT;c:\program files\norton antivirus\SAVRT.SYS [2004-7-23 338056]

R3 TPInput;TPInput;c:\windows\system32\drivers\TPInput.sys [2006-8-11 6016]

R3 TPM11;NSC Integrated Trusted Platform Module 1.1;c:\windows\system32\drivers\nsctpm11.sys [1980-1-1 14336]

S1 oznxulxe;oznxulxe;\??\c:\windows\system32\drivers\oznxulxe.sys --> c:\windows\system32\drivers\oznxulxe.sys [?]

S1 stzhlabv;stzhlabv;\??\c:\windows\system32\drivers\stzhlabv.sys --> c:\windows\system32\drivers\stzhlabv.sys [?]

S2 Ias;Windows Visual Provider;c:\windows\system32\svchost.exe -k netsvcs [1980-1-1 14336]

S2 SBService;ScriptBlocking Service;c:\progra~1\common~1\symant~1\script~1\SBServ.exe [2004-8-18 67184]

S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\CCPWDSVC.EXE [2004-8-13 79520]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-4-30 18176]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-4-30 7680]

S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2008-4-30 23680]

S3 QCNDISIF;QCNDISIF;c:\windows\system32\drivers\qcndisif.sys [2006-8-11 12288]

S3 SAVScan;SAVScan;c:\program files\norton antivirus\SAVSCAN.EXE [2004-7-23 198368]

S3 USTORAGE;UMass Storage Device;c:\windows\system32\drivers\UStorage.sys [2009-4-14 31104]

.

=============== Created Last 30 ================

.

2011-03-25 15:19:29 -------- d-----w- c:\windows\system32\wbem\repository\FS

2011-03-25 15:19:29 -------- d-----w- c:\windows\system32\wbem\Repository

2011-03-25 14:45:47 -------- d-----w- c:\docume~1\julio\applic~1\361DA375F6275768B3A388F8B1149E32

2011-03-24 14:59:30 -------- d-----w- c:\program files\iPod

2011-03-24 14:42:27 -------- d-----w- c:\program files\Bonjour

2011-03-14 14:26:34 -------- d-----w- c:\docume~1\alluse~1\applic~1\Protexis

2011-03-14 13:59:15 -------- d-----w- c:\program files\common files\Akamai

.

==================== Find3M ====================

.

2011-03-14 13:56:46 5642 --sha-w- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys

2011-03-14 13:56:42 88 --sh--r- c:\docume~1\alluse~1\applic~1\24E1664BF0.sys

2011-02-18 20:36:58 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600

.

CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.

device: opened successfully

user: error reading MBR

.

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A59F439]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a5a57d0]; MOV EAX, [0x8a5a584c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 ntkrnlpa!IofCallDriver[0x804EE136] -> \Device\Harddisk0\DR0[0x8A5BAAB8]

3 CLASSPNP[0xBA0F905B] -> ntkrnlpa!IofCallDriver[0x804EE136] -> \Device\0000009f[0x8A6059E8]

5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EE136] -> [0x8A607D98]

\Driver\atapi[0x8A5F4A08] -> IRP_MJ_CREATE -> 0x8A59F439

kernel: MBR read successfully

_asm { XOR AX, AX; MOV DS, AX; MOV ES, AX; MOV SS, AX; MOV SP, 0x7c00; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x80; CLD ; REP MOVSD ; NOP ; JMP FAR 0x0:0x61e; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x8A59F27F

user != kernel MBR !!!

Warning: possible TDL4 rootkit infection !

TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.

.

============= FINISH: 16:54:57.29 ===============

Maniac · March 28, 2011

Hello jmvar! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.
Post all of your log files, don't attach them.

Please post Attach.txt .

jmvar · March 28, 2011

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_11-03-05.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 8/22/2006 7:34:07 AM

System Uptime: 3/28/2011 11:44:44 AM (5 hours ago)

.

Motherboard: IBM | | 187124U

Processor: Intel® Pentium® M processor 1.60GHz | None | 1596/533mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 265 GiB total, 121.304 GiB free.

D: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP909: 2/20/2011 10:35:41 PM - System Checkpoint

RP910: 2/22/2011 12:48:55 AM - System Checkpoint

RP911: 2/23/2011 1:35:46 AM - System Checkpoint

RP912: 2/24/2011 2:34:30 AM - System Checkpoint

RP913: 2/25/2011 2:35:47 AM - System Checkpoint

RP914: 2/25/2011 9:51:50 AM - Restore Operation

RP915: 2/26/2011 10:55:42 AM - System Checkpoint

RP916: 2/27/2011 12:50:10 PM - System Checkpoint

RP917: 2/28/2011 12:57:54 PM - System Checkpoint

RP918: 3/1/2011 1:57:53 PM - System Checkpoint

RP919: 3/2/2011 2:57:53 PM - System Checkpoint

RP920: 3/3/2011 4:50:43 PM - System Checkpoint

RP921: 3/4/2011 4:57:57 PM - System Checkpoint

RP922: 3/5/2011 5:58:01 PM - System Checkpoint

RP923: 3/6/2011 6:57:57 PM - System Checkpoint

RP924: 3/7/2011 7:57:57 PM - System Checkpoint

RP925: 3/8/2011 3:00:17 AM - Software Distribution Service 3.0

RP926: 3/9/2011 3:00:21 AM - Software Distribution Service 3.0

RP927: 3/10/2011 3:57:57 AM - System Checkpoint

RP928: 3/11/2011 4:57:59 AM - System Checkpoint

RP929: 3/12/2011 8:53:54 AM - Unsigned driver install

RP930: 3/13/2011 10:34:23 AM - System Checkpoint

RP931: 3/14/2011 9:54:30 AM - Unsigned driver install

RP932: 3/14/2011 10:12:36 AM - Installed DirectX

RP933: 3/15/2011 10:29:37 AM - System Checkpoint

RP934: 3/16/2011 10:36:25 AM - System Checkpoint

RP935: 3/17/2011 11:45:06 AM - System Checkpoint

RP936: 3/18/2011 3:16:37 PM - Unsigned driver install

RP937: 3/20/2011 1:55:23 AM - System Checkpoint

RP938: 3/21/2011 12:25:34 PM - System Checkpoint

RP939: 3/22/2011 12:51:22 PM - System Checkpoint

RP940: 3/23/2011 3:16:49 PM - System Checkpoint

RP941: 3/24/2011 5:34:19 PM - Unsigned driver install

RP942: 3/25/2011 11:18:21 AM - Restore Operation

RP943: 3/26/2011 12:57:29 PM - System Checkpoint

RP944: 3/27/2011 11:26:44 PM - System Checkpoint

RP945: 3/28/2011 10:08:50 AM - Restore Operation

RP946: 3/28/2011 10:18:27 AM - Restore Operation

RP947: 3/28/2011 11:02:01 AM - Restore Operation

.

==== Installed Programs ======================

.

Maniac · March 29, 2011

Step 1

I see you are running Teatimer.

I suggest you to disable it because it can interfere with the changes you'll make on your system.

When everything is done and your log is clean again, you can enable it again.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer <== click me for instructions.

After you disabled Teatimer, download ResetTeaTimer.exe to your desktop.

Then run ResetTeaTimer.exe.

This will only take a few seconds.

Step 2

Going over your logs I noticed that you have

jmvar · March 31, 2011

Thank you for your help, here is the info requested.

TDSSKiller Log:

2011/03/31 12:19:14.0000 5160 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28

2011/03/31 12:19:14.0125 5160 ================================================================================

2011/03/31 12:19:14.0125 5160 SystemInfo:

2011/03/31 12:19:14.0125 5160

2011/03/31 12:19:14.0125 5160 OS Version: 5.1.2600 ServicePack: 2.0

2011/03/31 12:19:14.0125 5160 Product type: Workstation

2011/03/31 12:19:14.0125 5160 ComputerName: IBM-PERSONAL

2011/03/31 12:19:14.0125 5160 UserName: Julio

2011/03/31 12:19:14.0125 5160 Windows directory: C:\WINDOWS

2011/03/31 12:19:14.0125 5160 System windows directory: C:\WINDOWS

2011/03/31 12:19:14.0125 5160 Processor architecture: Intel x86

2011/03/31 12:19:14.0125 5160 Number of processors: 1

2011/03/31 12:19:14.0125 5160 Page size: 0x1000

2011/03/31 12:19:14.0125 5160 Boot type: Normal boot

2011/03/31 12:19:14.0125 5160 ================================================================================

2011/03/31 12:19:14.0390 5160 Initialize success

======================================================================================================================

DDS Log:

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Julio at 12:27:21.67 on Thu 03/31/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1291 [GMT -4:00]

.

AV: Norton AntiVirus 2005 *Disabled/Outdated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Worm Protection *Disabled*

.

============== Running Processes ===============

.

C:\Program Files\Common Files\Virtual Token\vtserver.exe

C:\WINDOWS\system32\ibmpmsvc.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apricorn\Schedule2\schedul2.exe

C:\WINDOWS\System32\svchost.exe -k Akamai

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe

C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe

c:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\iDumpPro\NMSAccessU.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

C:\WINDOWS\System32\QCONSVC.EXE

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\Program Files\VERIZONDM\bin\sprtsvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\VERIZONDM\bin\tgsrvc.exe

C:\WINDOWS\System32\TPHDEXLG.EXE

C:\WINDOWS\system32\TpKmpSVC.exe

C:\Program Files\TVersity\Media Server\MediaServer.exe

c:\WINDOWS\system32\ZuneBusEnum.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\TpShocks.exe

C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe

C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe

C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\IBM\Messages By IBM\ibmmessages.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\IBMTOOLS\UTILS\ibmprc.exe

C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Apricorn\EZ Gig II\EZGigMonitor.exe

C:\Program Files\Apricorn\EZ Gig II\TimounterMonitor.exe

C:\Program Files\Common Files\Apricorn\Schedule2\schedhlp.exe

C:\Program Files\Zune\ZuneLauncher.exe

C:\Program Files\Verizon\McciTrayApp.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\MediaMall\MediaMallServer.exe

C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\MediaMall\MediaMallServer.exe

C:\Documents and Settings\Julio\Desktop\tdsskiller\TDSSKiller.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Java\jre6\bin\jucheck.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Documents and Settings\Julio\My Documents\Downloads\dds.com